adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Forbid direct prefix access with mixed casing.

Browse source 
Changing the casing up should not allow prefix method access.
This commit is contained in:
mark_story 2015-08-05 23:05:30 -04:00
parent 01b6374a9d
commit 056f24a774
2 changed files with 21 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/Cake/Controller/Controller.php
View file

@ -514,12 +514,12 @@ class Controller extends Object implements CakeEventListener {
!$method->isPublic() ||
!in_array($method->name, $this->methods)
);
$prefixes = Router::prefixes();
$prefixes = array_map('strtolower', Router::prefixes());
if (!$privateAction && !empty($prefixes)) {
if (empty($request->params['prefix']) && strpos($request->params['action'], '_') > 0) {
list($prefix) = explode('_', $request->params['action']);
$privateAction = in_array($prefix, $prefixes);
$privateAction = in_array(strtolower($prefix), $prefixes);
}
}
return $privateAction;

19
lib/Cake/Test/Case/Controller/ControllerTest.php
View file

@ -1447,6 +1447,25 @@ class ControllerTest extends CakeTestCase {
$Controller->invokeAction($url);
}
/**
* test invoking controller methods.
*
* @expectedException PrivateActionException
* @expectedExceptionMessage Private Action TestController::Admin_add() is not directly accessible.
* @return void
*/
public function testInvokeActionPrefixProtectionCasing() {
Router::reload();
Router::connect('/admin/:controller/:action/*', array('prefix' => 'admin'));
$url = new CakeRequest('test/Admin_add/');
$url->addParams(array('controller' => 'test_controller', 'action' => 'Admin_add'));
$response = $this->getMock('CakeResponse');
$Controller = new TestController($url, $response);
$Controller->invokeAction($url);
}
/**
* test invoking controller methods.
*