adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix plugin view names being able to escape the plugin root directory.

Browse source 
Remove the ability to specify completely arbitrary view files. This is
possibly a breaking change. However, I feel the risks out weigh the
benefits in this situation. Now absolute paths must be located *within*
a configured view path.
This commit is contained in:
mark_story 2015-11-01 22:04:15 -05:00
parent d220616b5a
commit 5e60cc5d18
2 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
lib/Cake/Test/Case/View/ViewTest.php
View file

@ -395,6 +395,26 @@ class ViewTest extends CakeTestCase {
$this->assertEquals($expected, $result);
}
/**
* Test that plugin files with absolute file paths are scoped
* to the plugin and do now allow any file path.
*
* @expectedException MissingViewException
* @return void
*/
public function testPluginGetTemplateAbsoluteFail() {
$this->Controller->viewPath = 'Pages';
$this->Controller->action = 'display';
$this->Controller->params['pass'] = array('home');
$view = new TestThemeView($this->Controller);
$expected = CAKE . 'Test' . DS . 'test_app' . DS . 'Plugin' . DS . 'Company' . DS . 'TestPluginThree' . DS . 'View' . DS . 'Pages' . DS . 'index.ctp';
$result = $view->getViewFileName('Company/TestPluginThree./Pages/index');
$this->assertPathEquals($expected, $result);
$view->getViewFileName('Company/TestPluginThree./etc/passwd');
}
/**
* Test getLayoutFileName method on plugin
*

3
lib/Cake/View/View.php
View file

@ -1012,9 +1012,6 @@ class View extends Object {
$name = $this->viewPath . DS . $subDir . Inflector::underscore($name);
} elseif (strpos($name, DS) !== false) {
if ($name[0] === DS || $name[1] === ':') {
if (is_file($name)) {
return $name;
}
$name = trim($name, DS);
} elseif ($name[0] === '.') {
$name = substr($name, 3);