Scenario
Call an URL like /<module>/' < with this quote. (r19592)
Defect
The execute() method of sfActions calls itself until nested function limit is reached or webserver crashes.
However this has to end in a 500, but it should not crash the webserver.
debug enabled
Fatal error: Maximum function nesting level of '500' reached, aborting!
debug disabled
500 Internal Server Error
Possible Fixes
I worked around this with a simple check. Maybe this is not the best solution, but it works so far.
Index: lib/action/sfActions.class.php
===================================================================
--- lib/action/sfActions.class.php (revision 19592)
+++ lib/action/sfActions.class.php (working copy)
@@ -38,6 +38,14 @@
{
// dispatch action
$actionToRun = 'execute'.ucfirst($this->getActionName());
+
+ // no action name given
+ if ($actionToRun === 'execute')
+ {
+ // no action given
+ throw new sfInitializationException(sprintf('sfAction initialization failed for module "%s". There was no action given.', $this->getModuleName()));
+ }
+
if (!is_callable(array($this, $actionToRun)))
{
// action not found
via
#symfony freenode IRC
<maximumbob> I just managed to crash Apache via PHP via Symfony, and its reproduceable
<maximumbob> I went to url/[module]/' <- put a quote by accident
<maximumbob> and crashed apache
