Changeset 8925

Timestamp:

05/13/08 11:03:01 (5 years ago)

Author:

fabien

Message:

fixed yml validator file can be overriden by a remote attacker (closes #1617 - based on a patch from Carl.Vondrick)

Files:

• branches/1.1/lib/plugins/sfCompat10Plugin/lib/filter/sfValidationExecutionFilter.class.php (modified) (1 diff)
• branches/1.1/lib/plugins/sfCompat10Plugin/test/functional/fixtures/apps/frontend/modules/validation/actions/actions.class.php (modified) (1 diff)
• branches/1.1/lib/plugins/sfCompat10Plugin/test/functional/fixtures/apps/frontend/modules/validation/templates/Index2Success.php (copied) (copied from branches/1.1/lib/plugins/sfCompat10Plugin/test/functional/fixtures/apps/frontend/modules/validation/templates/indexSuccess.php)
• branches/1.1/lib/plugins/sfCompat10Plugin/test/functional/fixtures/apps/frontend/modules/validation/validate/Index2.yml (added)
• branches/1.1/lib/plugins/sfCompat10Plugin/test/functional/validationTest.php (modified) (1 diff)

branches/1.1/lib/plugins/sfCompat10Plugin/lib/filter/sfValidationExecutionFilter.class.php

@@ -108 +108 @@
-    $validated = true;
-
+    // the case of the first letter of the action is insignificant
-    // get the current action validation configuration
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    // load validation configuration
-    // do NOT use require_once
-null !== $validateFile = $this->context->getConfigCache()->checkConfig('modules/'.$validationConfig, tru
+!is_null($validateFil
-    {
-      // create validator manager

branches/1.1/lib/plugins/sfCompat10Plugin/test/functional/fixtures/apps/frontend/modules/validation/actions/actions.class.php

@@ -13 +13 @@
-  public function executeIndex()
-  {
+    if (sfWebRequest::POST == $this->getRequest()->getMethod())
+    {
+      $this->getResponse()->setHttpHeader('X-Validated', 'ok');
+    }
-  }
-
-  public function handleErrorIndex()
-  {
+    $this->getResponse()->setHttpHeader('X-Validated', 'ko');
+
+    return sfView::SUCCESS;
+  }
+
+  public function executeIndex2()
+  {
+    if (sfWebRequest::POST == $this->getRequest()->getMethod())
+    {
+      $this->getResponse()->setHttpHeader('X-Validated', 'ok');
+    }
+  }
+
+  public function handleErrorIndex2()
+  {
+    $this->getResponse()->setHttpHeader('X-Validated', 'ko');
+
-    return sfView::SUCCESS;
-  }

branches/1.1/lib/plugins/sfCompat10Plugin/test/functional/validationTest.php

@@ -137 +137 @@
-  checkResponseElement('body ul[class="errors"] li[class="input4"]', 'Required')
-;
+
+// check that /validation/index and /validation/Index both uses the index.yml validation file (see #1617)
+// those tests are only relevant on machines where filesystems are case sensitive.
+$b->
+  post('/validation/index')->
+  isStatusCode(200)->
+  isRequestParameter('module', 'validation')->
+  isRequestParameter('action', 'index')->
+  isResponseHeader('X-Validated', 'ko')
+;
+
+$b->
+  post('/validation/Index')->
+  isStatusCode(200)->
+  isRequestParameter('module', 'validation')->
+  isRequestParameter('action', 'Index')->
+  isResponseHeader('X-Validated', 'ko')
+;
+
+// needed to pass tests on case and non case sensitive machines
+if (!file_exists(dirname(__FILE__).'/fixtures/apps/frontend/modules/validation/templates/IndexSuccess.php'))
+{
+  $b->throwsException('sfRenderException');
+}
+
+$b->
+  post('/validation/INdex')->
+  isStatusCode(404)
+;
+
+$b->
+  post('/validation/index2')->
+  isStatusCode(200)->
+  isRequestParameter('module', 'validation')->
+  isRequestParameter('action', 'index2')->
+  isResponseHeader('X-Validated', 'ko')
+;
+
+if (!is_readable(dirname(__FILE__).'/fixtures/apps/frontend/modules/validation/templates/index2Success.php'))
+{
+  $b->throwsException('sfRenderException');
+}
+
+$b->
+  post('/validation/Index2')->
+  isStatusCode(200)->
+  isRequestParameter('module', 'validation')->
+  isRequestParameter('action', 'Index2')->
+  isResponseHeader('X-Validated', 'ko')
+;