adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixing Router::reverse() serializing all of _Token.

Browse source 
Removing CSRF tokens from the parameters SecurityComponent exports.
Updating tests for both Router and SecurityComponent.
Fixes #1697
This commit is contained in:
mark_story 2011-05-16 20:35:27 -04:00
parent f2e953d892
commit 6289f20b83
4 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lib/Cake/Controller/Component/SecurityComponent.php
View file

@ -495,8 +495,11 @@ class SecurityComponent extends Component {
if ($this->csrfCheck && ($this->csrfUseOnce || empty($tokenData['csrfTokens'])) ) {
$token['csrfTokens'][$authKey] = strtotime($this->csrfExpires);
}
$controller->request->params['_Token'] = $token;
$this->Session->write('_Token', $token);
$controller->request->params['_Token'] = array(
'key' => $token['key'],
'disabledFields' => $token['disabledFields']
);
return true;
}

3
lib/Cake/Routing/Router.php
View file

@ -1029,7 +1029,8 @@ class Router {
unset(
$params['pass'], $params['named'], $params['paging'], $params['models'], $params['url'], $url['url'],
$params['autoRender'], $params['bare'], $params['requested'], $params['return']
$params['autoRender'], $params['bare'], $params['requested'], $params['return'],
$params['_Token']
);
$params = array_merge($params, $pass, $named);
if (!empty($url)) {

1
lib/Cake/Test/Case/Controller/Component/SecurityComponentTest.php
View file

@ -996,6 +996,7 @@ class SecurityComponentTest extends CakeTestCase {
$token = $this->Security->Session->read('_Token');
$this->assertEquals(count($token['csrfTokens']), 1, 'Missing the csrf token.');
$this->assertEquals(strtotime('+10 minutes'), current($token['csrfTokens']), 'Token expiry does not match');
$this->assertEquals(array('key', 'disabledFields'), array_keys($this->Controller->request->params['_Token']), 'Keys don not match');
}
/**

3
lib/Cake/Test/Case/Routing/RouterTest.php
View file

@ -2285,7 +2285,8 @@ class RouterTest extends CakeTestCase {
'autoRender' => 1,
'bare' => 1,
'return' => 1,
'requested' => 1
'requested' => 1,
'_Token' => array('key' => 'sekret')
);
$result = Router::reverse($params);
$this->assertEqual($result, '/posts/view/1');