Changeset 28260 for branches/1.4

Timestamp:

02/25/10 00:42:54 (2 years ago)

Author:

Kris.Wallsmith

Message:

[1.2, 1.3, 1.4] fixed sql injection vulnerability in doctrine admin generator

Files:

• branches/1.4/lib/plugins/sfDoctrinePlugin/data/generator/sfDoctrineModule/admin/parts/sortingAction.php (modified) (1 diff)
• branches/1.4/lib/plugins/sfDoctrinePlugin/test/functional/AdminGenBrowser.class.php (modified) (2 diffs)

branches/1.4/lib/plugins/sfDoctrinePlugin/data/generator/sfDoctrineModule/admin/parts/sortingAction.php

@@ -4 +4 @@
-    {
-      return;
+    }
+
+    if (!in_array(strtolower($sort[1]), array('asc', 'desc')))
+    {
+      $sort[1] = 'asc';
-    }
-

branches/1.4/lib/plugins/sfDoctrinePlugin/test/functional/AdminGenBrowser.class.php

@@ -26 +26 @@
-        $this->$method();
-      }
+    }
+  }
+
+  protected function _testValidSort()
+  {
+    $this->info('Test valid sort parameter');
+
+    $this->get('/users?sort=username');
+
+    $matches = 0;
+    foreach ($this->_getQueryExecutionEvents() as $event)
+    {
+      if (false !== strpos($event->getQuery(), 'ORDER BY u.username asc'))
+      {
+        ++$matches;
+      }
+    }
+
+    $this->test()->is($matches, 1);
+  }
+
+  protected function _testInvalidSort()
+  {
+    $this->info('Test invalid sort parameter');
+
+    $this->get('/users?sort=INVALID');
+
+    // there should be no queries that match "INVALID"
+    foreach ($this->_getQueryExecutionEvents() as $event)
+    {
+      $this->test()->unlike($event->getQuery(), '/INVALID/');
+    }
+  }
+
+  protected function _testValidSortType()
+  {
+    $this->info('Test valid sort_type parameter');
+
+    foreach (array('asc', 'desc', 'ASC', 'DESC') as $sortType)
+    {
+      $this->get('/users?sort=username&sort_type='.$sortType);
+
+      $matches = 0;
+      foreach ($this->_getQueryExecutionEvents() as $event)
+      {
+        if (false !== strpos($event->getQuery(), 'ORDER BY u.username '.$sortType))
+        {
+          ++$matches;
+        }
+      }
+
+      $this->test()->is($matches, 1);
+    }
+  }
+
+  protected function _testInvalidSortType()
+  {
+    $this->info('Test invalid sort_type parameter');
+
+    $this->get('/users?sort=username&sort_type=INVALID');
+
+    // there should be no queries that match "INVALID"
+    foreach ($this->_getQueryExecutionEvents() as $event)
+    {
+      $this->test()->unlike($event->getQuery(), '/INVALID/');
-    }
-  }
@@ -203 +268 @@
-  }
-
+  protected function _getQueryExecutionEvents()
+  {
+    $events = array();
+
+    $databaseManager = $this->browser->getContext()->getDatabaseManager();
+    foreach ($databaseManager->getNames() as $name)
+    {
+      $database = $databaseManager->getDatabase($name);
+      if ($database instanceof sfDoctrineDatabase && $profiler = $database->getProfiler())
+      {
+        foreach ($profiler->getQueryExecutionEvents() as $event)
+        {
+          $events[$event->getSequence()] = $event;
+        }
+      }
+    }
+
+    ksort($events);
+
+    return array_values($events);
+  }
+
-  public function __destruct()
-  {