Changeset 8922

Timestamp:

05/13/08 10:20:09 (1 year ago)

Author:

fabien

Message:

fixed yml validator file can be overriden by a remote attacker (closes #1617 - based on a patch from Carl.Vondrick)

Files:

• branches/1.0/lib/filter/sfExecutionFilter.class.php (modified) (1 diff)
• branches/1.0/test/functional/fixtures/project/apps/frontend/modules/validation/actions/actions.class.php (modified) (1 diff)
• branches/1.0/test/functional/fixtures/project/apps/frontend/modules/validation/validate/Index2.yml (added)
• branches/1.0/test/functional/validationTest.php (modified) (1 diff)

branches/1.0/lib/filter/sfExecutionFilter.class.php

@@ -72 +72 @@
-        $validated = true;
-
+        // the case of the first letter of the action is insignificant
-        // get the current action validation configuration
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-        // load validation configuration
-        // do NOT use require_once
-null !== $validateFile = sfConfigCache::getInstance()->checkConfig(sfConfig::get('sf_app_module_dir_name').'/'.$validationConfig, tru
+!is_null($validateFil
-        {
-          // create validator manager

branches/1.0/test/functional/fixtures/project/apps/frontend/modules/validation/actions/actions.class.php

@@ -13 +13 @@
-  public function executeIndex()
-  {
+    if (sfWebRequest::POST == $this->getRequest()->getMethod())
+    {
+      $this->getResponse()->setHttpHeader('X-Validated', 'ok');
+    }
-  }
-
-  public function handleErrorIndex()
-  {
+    $this->getResponse()->setHttpHeader('X-Validated', 'ko');
+
+    return sfView::SUCCESS;
+  }
+
+  public function executeIndex2()
+  {
+    if (sfWebRequest::POST == $this->getRequest()->getMethod())
+    {
+      $this->getResponse()->setHttpHeader('X-Validated', 'ok');
+    }
+  }
+
+  public function handleErrorIndex2()
+  {
+    $this->getResponse()->setHttpHeader('X-Validated', 'ko');
+
-    return sfView::SUCCESS;
-  }

branches/1.0/test/functional/validationTest.php

@@ -138 +138 @@
-  checkResponseElement('body ul[class="errors"] li[class="input4"]', 'Required')
-;
+
+// check that /validation/index and /validation/Index both uses the index.yml validation file (see #1617)
+// those tests are only relevant on machines where filesystems are case sensitive.
+$b->
+  post('/validation/index')->
+  isStatusCode(200)->
+  isRequestParameter('module', 'validation')->
+  isRequestParameter('action', 'index')->
+  isResponseHeader('X-Validated', 'ko')
+;
+
+$b->
+  post('/validation/Index')->
+  isStatusCode(200)->
+  isRequestParameter('module', 'validation')->
+  isRequestParameter('action', 'Index')->
+  isResponseHeader('X-Validated', 'ko')
+;
+
+$b->
+  post('/validation/INdex')->
+  isStatusCode(404)
+;
+
+$b->
+  post('/validation/index2')->
+  isStatusCode(200)->
+  isRequestParameter('module', 'validation')->
+  isRequestParameter('action', 'index2')->
+  isResponseHeader('X-Validated', 'ko')
+;
+
+$b->
+  post('/validation/Index2')->
+  isStatusCode(200)->
+  isRequestParameter('module', 'validation')->
+  isRequestParameter('action', 'Index2')->
+  isResponseHeader('X-Validated', 'ko')
+;