adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2025-01-19 11:06:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

if blackHoleCallback is set, requests _must_ get blackholed

Browse source
This commit is contained in:
Rachman Chavik 2012-07-03 19:23:21 +07:00
parent 86a74e3887
commit 22373868bb
2 changed files with 34 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/Cake/Controller/Component/SecurityComponent.php
View file

@ -590,7 +590,7 @@ class SecurityComponent extends Component {
if (is_callable(array($controller, $method))) {
return call_user_func_array(array(&$controller, $method), empty($params) ? null : $params);
} else {
return null;
throw new BadRequestException(__d('cake_dev', 'The request has been black-holed'));
}
}

33
lib/Cake/Test/Case/Controller/Component/SecurityComponentTest.php
View file

@ -107,6 +107,20 @@ class SecurityTestController extends Controller {
}
class BrokenCallbackController extends Controller {
public $name = 'UncallableCallback';
public $components = array('Session', 'TestSecurity');
public function index() {
}
protected function _fail() {
}
}
/**
* SecurityComponentTest class
*
@ -161,6 +175,25 @@ class SecurityComponentTest extends CakeTestCase {
unset($this->Controller);
}
/**
* Test that requests are still blackholed when controller has incorrect
* visibility keyword in the blackhole callback
*
* @expectedException BadRequestException
*/
public function testBlackholeWithBrokenCallback() {
$request = new CakeRequest('posts/index', false);
$request->addParams(array(
'controller' => 'posts', 'action' => 'index')
);
$this->Controller = new BrokenCallbackController($request);
$this->Controller->Components->init($this->Controller);
$this->Controller->Security = $this->Controller->TestSecurity;
$this->Controller->Security->blackHoleCallback = '_fail';
$this->Controller->Security->startup($this->Controller);
$this->Controller->Security->blackHole($this->Controller, 'csrf');
}
/**
* test that initialize can set properties.
*