From a2cc9843e43a98bde3e53ffedaf6e48164aa8479 Mon Sep 17 00:00:00 2001
From: Val Bancer <valerij.bancer@gmail.com>
Date: Tue, 21 Nov 2017 15:20:14 +0100
Subject: [PATCH 01/18] added missing ob_end_flush() call

---
 lib/Cake/TestSuite/Reporter/CakeHtmlReporter.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/Cake/TestSuite/Reporter/CakeHtmlReporter.php b/lib/Cake/TestSuite/Reporter/CakeHtmlReporter.php
index 8c07e9b45..f73bb1927 100644
--- a/lib/Cake/TestSuite/Reporter/CakeHtmlReporter.php
+++ b/lib/Cake/TestSuite/Reporter/CakeHtmlReporter.php
@@ -38,6 +38,7 @@ class CakeHtmlReporter extends CakeBaseReporter {
 		$this->paintDocumentStart();
 		$this->paintTestMenu();
 		echo "<ul class='tests'>\n";
+		ob_end_flush();
 	}
 
 /**

From bc1678cf2af1246e02739d352e4d3bf84a452f36 Mon Sep 17 00:00:00 2001
From: Mischa ter Smitten <mischa@tersmitten.nl>
Date: Thu, 23 Nov 2017 10:02:38 +0100
Subject: [PATCH 02/18] Add option to make `_validAgentAndTime` 3.x compatible

---
 lib/Cake/Model/Datasource/CakeSession.php | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/lib/Cake/Model/Datasource/CakeSession.php b/lib/Cake/Model/Datasource/CakeSession.php
index a692ed74c..b9917721e 100644
--- a/lib/Cake/Model/Datasource/CakeSession.php
+++ b/lib/Cake/Model/Datasource/CakeSession.php
@@ -134,6 +134,13 @@ class CakeSession {
  */
 	protected static $_cookieName = null;
 
+/**
+ * Whether or not to make `_validAgentAndTime` 3.x compatible.
+ *
+ * @var bool
+ */
+	protected static $_useForwardsCompatibleTimeout = false;
+
 /**
  * Whether this session is running under a CLI environment
  *
@@ -360,6 +367,9 @@ class CakeSession {
 	protected static function _validAgentAndTime() {
 		$userAgent = static::read('Config.userAgent');
 		$time = static::read('Config.time');
+		if (static::$_useForwardsCompatibleTimeout) {
+			$time += (Configure::read('Session.timeout') * 60);
+		}
 		$validAgent = (
 			Configure::read('Session.checkAgent') === false ||
 			isset($userAgent) && static::$_userAgent === $userAgent
@@ -527,6 +537,10 @@ class CakeSession {
 		if (isset($sessionConfig['timeout']) && !isset($sessionConfig['cookieTimeout'])) {
 			$sessionConfig['cookieTimeout'] = $sessionConfig['timeout'];
 		}
+		if (isset($sessionConfig['use_forwards_compatible_timeout']) && $sessionConfig['use_forwards_compatible_timeout']) {
+				static::$_useForwardsCompatibleTimeout = true;
+		}
+
 		if (!isset($sessionConfig['ini']['session.cookie_lifetime'])) {
 			$sessionConfig['ini']['session.cookie_lifetime'] = $sessionConfig['cookieTimeout'] * 60;
 		}
@@ -580,6 +594,9 @@ class CakeSession {
 		}
 		Configure::write('Session', $sessionConfig);
 		static::$sessionTime = static::$time + ($sessionConfig['timeout'] * 60);
+		if (static::$_useForwardsCompatibleTimeout) {
+			static::$sessionTime = static::$time;
+		}
 	}
 
 /**

From 4faac8e09a259912bf6dba299088d79dce566e3b Mon Sep 17 00:00:00 2001
From: Mischa ter Smitten <mischa@tersmitten.nl>
Date: Thu, 23 Nov 2017 10:06:14 +0100
Subject: [PATCH 03/18] Improved readability

---
 lib/Cake/Model/Datasource/CakeSession.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/Cake/Model/Datasource/CakeSession.php b/lib/Cake/Model/Datasource/CakeSession.php
index b9917721e..3a01f819f 100644
--- a/lib/Cake/Model/Datasource/CakeSession.php
+++ b/lib/Cake/Model/Datasource/CakeSession.php
@@ -593,9 +593,9 @@ class CakeSession {
 			);
 		}
 		Configure::write('Session', $sessionConfig);
-		static::$sessionTime = static::$time + ($sessionConfig['timeout'] * 60);
-		if (static::$_useForwardsCompatibleTimeout) {
-			static::$sessionTime = static::$time;
+		static::$sessionTime = static::$time;
+		if (!static::$_useForwardsCompatibleTimeout) {
+			static::$sessionTime += ($sessionConfig['timeout'] * 60);
 		}
 	}
 

From 05954ff405042a98dc09a1701a267da09a8e01c1 Mon Sep 17 00:00:00 2001
From: Mischa ter Smitten <mischa@tersmitten.nl>
Date: Thu, 23 Nov 2017 10:09:25 +0100
Subject: [PATCH 04/18] Consistency changes

---
 lib/Cake/Model/Datasource/CakeSession.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Cake/Model/Datasource/CakeSession.php b/lib/Cake/Model/Datasource/CakeSession.php
index 3a01f819f..28e25a79b 100644
--- a/lib/Cake/Model/Datasource/CakeSession.php
+++ b/lib/Cake/Model/Datasource/CakeSession.php
@@ -537,7 +537,7 @@ class CakeSession {
 		if (isset($sessionConfig['timeout']) && !isset($sessionConfig['cookieTimeout'])) {
 			$sessionConfig['cookieTimeout'] = $sessionConfig['timeout'];
 		}
-		if (isset($sessionConfig['use_forwards_compatible_timeout']) && $sessionConfig['use_forwards_compatible_timeout']) {
+		if (isset($sessionConfig['useForwardsCompatibleTimeout']) && $sessionConfig['useForwardsCompatibleTimeout']) {
 				static::$_useForwardsCompatibleTimeout = true;
 		}
 

From c437efd2a53cb1ec49e0237c8216aa52c6c0afa4 Mon Sep 17 00:00:00 2001
From: Mischa ter Smitten <mischa@tersmitten.nl>
Date: Thu, 23 Nov 2017 10:13:42 +0100
Subject: [PATCH 05/18] Improved documentation

---
 app/Config/core.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/Config/core.php b/app/Config/core.php
index e8dc9afda..da5555a34 100644
--- a/app/Config/core.php
+++ b/app/Config/core.php
@@ -198,6 +198,7 @@
  *
  * - `Session.cookie` - The name of the cookie to use. Defaults to 'CAKEPHP'
  * - `Session.timeout` - The number of minutes you want sessions to live for. This timeout is handled by CakePHP
+ * - `Session.useForwardsCompatibleTimeout` - Whether or not to make timeout 3.x compatible.
  * - `Session.cookieTimeout` - The number of minutes you want session cookies to live for.
  * - `Session.checkAgent` - Do you want the user agent to be checked when starting sessions? You might want to set the
  *    value to false, when dealing with older versions of IE, Chrome Frame or certain web-browsing devices and AJAX

From d7b9e55e98b478f49fda74358db3b4433f98d29d Mon Sep 17 00:00:00 2001
From: Mischa ter Smitten <mischa@tersmitten.nl>
Date: Thu, 23 Nov 2017 14:12:13 +0100
Subject: [PATCH 06/18] Fix indent

---
 lib/Cake/Model/Datasource/CakeSession.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Cake/Model/Datasource/CakeSession.php b/lib/Cake/Model/Datasource/CakeSession.php
index 28e25a79b..8e9429b53 100644
--- a/lib/Cake/Model/Datasource/CakeSession.php
+++ b/lib/Cake/Model/Datasource/CakeSession.php
@@ -538,7 +538,7 @@ class CakeSession {
 			$sessionConfig['cookieTimeout'] = $sessionConfig['timeout'];
 		}
 		if (isset($sessionConfig['useForwardsCompatibleTimeout']) && $sessionConfig['useForwardsCompatibleTimeout']) {
-				static::$_useForwardsCompatibleTimeout = true;
+			static::$_useForwardsCompatibleTimeout = true;
 		}
 
 		if (!isset($sessionConfig['ini']['session.cookie_lifetime'])) {

From 5695fef46f7042bc8e286621b936ec26adc61fff Mon Sep 17 00:00:00 2001
From: db-bogdan <ba.ro@dinnerbooking.com>
Date: Mon, 27 Nov 2017 11:59:34 +0200
Subject: [PATCH 07/18] fixes #11468

---
 lib/Cake/Controller/Component/AuthComponent.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/Cake/Controller/Component/AuthComponent.php b/lib/Cake/Controller/Component/AuthComponent.php
index e21f6e085..a652e950a 100644
--- a/lib/Cake/Controller/Component/AuthComponent.php
+++ b/lib/Cake/Controller/Component/AuthComponent.php
@@ -298,6 +298,7 @@ class AuthComponent extends Component {
 		}
 
 		if ($this->_isAllowed($controller)) {
+			$this->_getUser();
 			return true;
 		}
 

From 94e06dfeb3c6e9162ab8c125dd2650f3e4da2ee8 Mon Sep 17 00:00:00 2001
From: db-bogdan <ba.ro@dinnerbooking.com>
Date: Tue, 28 Nov 2017 11:31:46 +0200
Subject: [PATCH 08/18] add unit test

---
 .../Component/AuthComponentTest.php           | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/lib/Cake/Test/Case/Controller/Component/AuthComponentTest.php b/lib/Cake/Test/Case/Controller/Component/AuthComponentTest.php
index 1e5d79f2a..25ed6e9bb 100644
--- a/lib/Cake/Test/Case/Controller/Component/AuthComponentTest.php
+++ b/lib/Cake/Test/Case/Controller/Component/AuthComponentTest.php
@@ -1818,4 +1818,31 @@ class AuthComponentTest extends CakeTestCase {
 
 		$this->assertEquals('/users/login', $this->Controller->testUrl);
 	}
+
+/**
+ * testStatelessAuthAllowedActionsRetrieveUser method
+ *
+ * @return void
+ */
+	public function testStatelessAuthAllowedActionsRetrieveUser() {
+		$_SERVER['PHP_AUTH_USER'] = 'mariano';
+		$_SERVER['PHP_AUTH_PW'] = 'cake';
+		$url = '/auth_test/add';
+		$this->Controller->request->addParams(Router::parse($url));
+		$this->Controller->Auth->authenticate = array(
+			'Basic' => array('userModel' => 'AuthUser')
+		);
+		$this->Controller->Auth->initialize($this->Controller);
+		$this->Controller->Auth->allow();
+		$this->Controller->Auth->startup($this->Controller);
+
+		$expectedUser = array(
+			'id' => '1',
+			'username' => 'mariano',
+			'created' => '2007-03-17 01:16:23',
+			'updated' => '2007-03-17 01:18:31',
+		);
+
+		$this->assertEquals($expectedUser, $this->Controller->Auth->user());
+	}
 }

From e824346cca9ac4d91ca317f6e70c76ebcd786b97 Mon Sep 17 00:00:00 2001
From: db-bogdan <ba.ro@dinnerbooking.com>
Date: Tue, 28 Nov 2017 11:43:55 +0200
Subject: [PATCH 09/18] extra fix

---
 .../Case/Controller/Component/AuthComponentTest.php   | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/lib/Cake/Test/Case/Controller/Component/AuthComponentTest.php b/lib/Cake/Test/Case/Controller/Component/AuthComponentTest.php
index 25ed6e9bb..09e99c92e 100644
--- a/lib/Cake/Test/Case/Controller/Component/AuthComponentTest.php
+++ b/lib/Cake/Test/Case/Controller/Component/AuthComponentTest.php
@@ -1825,13 +1825,20 @@ class AuthComponentTest extends CakeTestCase {
  * @return void
  */
 	public function testStatelessAuthAllowedActionsRetrieveUser() {
+		if (CakeSession::id()) {
+			session_destroy();
+			CakeSession::$id = null;
+		}
+		$_SESSION = null;
+
 		$_SERVER['PHP_AUTH_USER'] = 'mariano';
 		$_SERVER['PHP_AUTH_PW'] = 'cake';
-		$url = '/auth_test/add';
-		$this->Controller->request->addParams(Router::parse($url));
+
+		AuthComponent::$sessionKey = false;
 		$this->Controller->Auth->authenticate = array(
 			'Basic' => array('userModel' => 'AuthUser')
 		);
+		$this->Controller->request['action'] = 'add';
 		$this->Controller->Auth->initialize($this->Controller);
 		$this->Controller->Auth->allow();
 		$this->Controller->Auth->startup($this->Controller);

From 4ae9f13dfd2aa53759c3f18260a45e3cee6725e8 Mon Sep 17 00:00:00 2001
From: chinpei215 <chinpei215@hotmail.com>
Date: Wed, 29 Nov 2017 00:17:57 +0900
Subject: [PATCH 10/18] Fix 'order' not working with a single expressions

---
 lib/Cake/Model/Model.php                   |  6 +++-
 lib/Cake/Test/Case/Model/ModelReadTest.php | 34 +++++++++++++++++++++-
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/lib/Cake/Model/Model.php b/lib/Cake/Model/Model.php
index 3813e3883..8b9534a40 100644
--- a/lib/Cake/Model/Model.php
+++ b/lib/Cake/Model/Model.php
@@ -3083,7 +3083,11 @@ class Model extends CakeObject implements CakeEventListener {
 			$query['order'] = $this->order;
 		}
 
-		$query['order'] = (array)$query['order'];
+		if (is_object($query['order'])) {
+			$query['order'] = array($query['order']);
+		} else {
+			$query['order'] = (array)$query['order'];
+		}
 
 		if ($query['callbacks'] === true || $query['callbacks'] === 'before') {
 			$event = new CakeEvent('Model.beforeFind', $this, array($query));
diff --git a/lib/Cake/Test/Case/Model/ModelReadTest.php b/lib/Cake/Test/Case/Model/ModelReadTest.php
index b42239f08..851290547 100644
--- a/lib/Cake/Test/Case/Model/ModelReadTest.php
+++ b/lib/Cake/Test/Case/Model/ModelReadTest.php
@@ -7423,7 +7423,7 @@ class ModelReadTest extends BaseModelTest {
 	}
 
 /**
- * Test find(count) with Db::expression
+ * Test find(count) with DboSource::expression
  *
  * @return void
  */
@@ -7445,6 +7445,38 @@ class ModelReadTest extends BaseModelTest {
 		$this->assertEquals(1, $result);
 	}
 
+/**
+ * Test 'order' with DboSource::expression
+ */
+	public function testOrderWithDbExpressions() {
+		$this->loadFixtures('User');
+
+		$User = new User();
+
+		$results = $User->find('all', array(
+			'fields' => array('id'),
+			'recursive' => -1,
+			'order' => $this->db->expression('CASE id WHEN 4 THEN 0 ELSE id END'),
+		));
+
+		$expected = array(
+			array(
+				'User' => array('id' => 4),
+			),
+			array(
+				'User' => array('id' => 1),
+			),
+			array(
+				'User' => array('id' => 2),
+			),
+			array(
+				'User' => array('id' => 3),
+			),
+		);
+
+		$this->assertEquals($expected, $results);
+	}
+
 /**
  * testFindMagic method
  *

From eaf74546287810807fa256e2038f642c219183e0 Mon Sep 17 00:00:00 2001
From: dereuromark <euromark@web.de>
Date: Wed, 29 Nov 2017 19:57:01 +0100
Subject: [PATCH 11/18] Clarify migration path to 3.x

---
 lib/Cake/Model/Model.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/Cake/Model/Model.php b/lib/Cake/Model/Model.php
index 8b9534a40..b9c041cec 100644
--- a/lib/Cake/Model/Model.php
+++ b/lib/Cake/Model/Model.php
@@ -1688,6 +1688,9 @@ class Model extends CakeObject implements CakeEventListener {
  * Saves the value of a single field to the database, based on the current
  * model ID.
  *
+ * @deprecated 3.0.0 To ease migration to the new major, do not use this method anymore.
+ *   Stateful model usage will be removed. Use the existing save() methods instead.
+ *
  * @param string $name Name of the table field
  * @param mixed $value Value of the field
  * @param bool|array $validate Either a boolean, or an array.

From 9f65402d2cb64344fe14dbe9ec9ea62b132ec871 Mon Sep 17 00:00:00 2001
From: chinpei215 <chinpei215@hotmail.com>
Date: Mon, 4 Dec 2017 21:18:27 +0900
Subject: [PATCH 12/18] Fix CakeRequest::referer(true) returning
 scheme-relative URLs

Backport of #11503 (and #8795)
---
 lib/Cake/Network/CakeRequest.php               |  2 +-
 lib/Cake/Test/Case/Network/CakeRequestTest.php | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/Cake/Network/CakeRequest.php b/lib/Cake/Network/CakeRequest.php
index 20589cb34..228e46e2e 100644
--- a/lib/Cake/Network/CakeRequest.php
+++ b/lib/Cake/Network/CakeRequest.php
@@ -439,7 +439,7 @@ class CakeRequest implements ArrayAccess {
 		if (!empty($ref) && !empty($base)) {
 			if ($local && strpos($ref, $base) === 0) {
 				$ref = substr($ref, strlen($base));
-				if (empty($ref)) {
+				if (!strlen($ref) || strpos($ref, '//') === 0) {
 					$ref = '/';
 				}
 				if ($ref[0] !== '/') {
diff --git a/lib/Cake/Test/Case/Network/CakeRequestTest.php b/lib/Cake/Test/Case/Network/CakeRequestTest.php
index 2ae40c980..abdb79be8 100644
--- a/lib/Cake/Test/Case/Network/CakeRequestTest.php
+++ b/lib/Cake/Test/Case/Network/CakeRequestTest.php
@@ -739,6 +739,9 @@ class CakeRequestTest extends CakeTestCase {
 		$result = $request->referer();
 		$this->assertSame($result, 'https://cakephp.org');
 
+		$result = $request->referer(true);
+		$this->assertSame('/', $result);
+
 		$_SERVER['HTTP_REFERER'] = '';
 		$result = $request->referer();
 		$this->assertSame($result, '/');
@@ -751,6 +754,18 @@ class CakeRequestTest extends CakeTestCase {
 		$result = $request->referer(true);
 		$this->assertSame($result, '/some/path');
 
+		$_SERVER['HTTP_REFERER'] = Configure::read('App.fullBaseUrl') . '///cakephp.org/';
+		$result = $request->referer(true);
+		$this->assertSame('/', $result); // Avoid returning scheme-relative URLs.
+
+		$_SERVER['HTTP_REFERER'] = Configure::read('App.fullBaseUrl') . '/0';
+		$result = $request->referer(true);
+		$this->assertSame('/0', $result);
+
+		$_SERVER['HTTP_REFERER'] = Configure::read('App.fullBaseUrl') . '/';
+		$result = $request->referer(true);
+		$this->assertSame('/', $result);
+
 		$_SERVER['HTTP_REFERER'] = Configure::read('App.fullBaseUrl') . '/some/path';
 		$result = $request->referer(false);
 		$this->assertSame($result, Configure::read('App.fullBaseUrl') . '/some/path');

From 6ad30946d8cc2e87327bd6db60802374840e9778 Mon Sep 17 00:00:00 2001
From: chinpei215 <chinpei215@hotmail.com>
Date: Mon, 4 Dec 2017 23:31:32 +0900
Subject: [PATCH 13/18] Fix CS

---
 lib/Cake/Model/Model.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/Cake/Model/Model.php b/lib/Cake/Model/Model.php
index b9c041cec..cb0b6ef83 100644
--- a/lib/Cake/Model/Model.php
+++ b/lib/Cake/Model/Model.php
@@ -1688,9 +1688,6 @@ class Model extends CakeObject implements CakeEventListener {
  * Saves the value of a single field to the database, based on the current
  * model ID.
  *
- * @deprecated 3.0.0 To ease migration to the new major, do not use this method anymore.
- *   Stateful model usage will be removed. Use the existing save() methods instead.
- *
  * @param string $name Name of the table field
  * @param mixed $value Value of the field
  * @param bool|array $validate Either a boolean, or an array.
@@ -1698,6 +1695,8 @@ class Model extends CakeObject implements CakeEventListener {
  *   If an array, allows control of 'validate', 'callbacks' and 'counterCache' options.
  *   See Model::save() for details of each options.
  * @return bool|array See Model::save() False on failure or an array of model data on success.
+ * @deprecated 3.0.0 To ease migration to the new major, do not use this method anymore.
+ *   Stateful model usage will be removed. Use the existing save() methods instead.
  * @see Model::save()
  * @link https://book.cakephp.org/2.0/en/models/saving-your-data.html#model-savefield-string-fieldname-string-fieldvalue-validate-false
  */

From f66dec8a96999a5ef042d9a72dec6784ac56fcc6 Mon Sep 17 00:00:00 2001
From: mark_story <mark@mark-story.com>
Date: Sun, 10 Dec 2017 21:44:47 -0500
Subject: [PATCH 14/18] Make postConditions() less permissive.

We were notified by `ooooooo_q` that postConditions() is vulnerable to
SQL injection if used without SecurityComponent tampering prevention.

This change attempts to make postConditions() safer by exploding in
unsafe scenarios.
---
 lib/Cake/Controller/Controller.php            | 10 +++++-
 .../Test/Case/Controller/ControllerTest.php   | 36 +++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/lib/Cake/Controller/Controller.php b/lib/Cake/Controller/Controller.php
index 41c848a7d..7dd2a4ae1 100644
--- a/lib/Cake/Controller/Controller.php
+++ b/lib/Cake/Controller/Controller.php
@@ -1018,7 +1018,12 @@ class Controller extends CakeObject implements CakeEventListener {
 	}
 
 /**
- * Converts POST'ed form data to a model conditions array, suitable for use in a Model::find() call.
+ * Converts POST'ed form data to a model conditions array. 
+ *
+ * If combined with SecurityComponent these conditions could be suitable
+ * for use in a Model::find() call. Without SecurityComponent this method
+ * is vulnerable creating conditions containing SQL injection. While we
+ * attempt to raise exceptions.
  *
  * @param array $data POST'ed data organized by model and field
  * @param string|array $op A string containing an SQL comparison operator, or an array matching operators
@@ -1046,6 +1051,9 @@ class Controller extends CakeObject implements CakeEventListener {
 		$arrayOp = is_array($op);
 		foreach ($data as $model => $fields) {
 			foreach ($fields as $field => $value) {
+				if (preg_match('#[!=><~\&\|\)\(]#', $field)) {
+					throw new RuntimeException("Unsafe operator found in {$model}.{$field}");
+				}
 				$key = $model . '.' . $field;
 				$fieldOp = $op;
 				if ($arrayOp) {
diff --git a/lib/Cake/Test/Case/Controller/ControllerTest.php b/lib/Cake/Test/Case/Controller/ControllerTest.php
index ef157ddd1..26e3c6b16 100644
--- a/lib/Cake/Test/Case/Controller/ControllerTest.php
+++ b/lib/Cake/Test/Case/Controller/ControllerTest.php
@@ -1177,6 +1177,42 @@ class ControllerTest extends CakeTestCase {
 		$this->assertSame($expected, $result);
 	}
 
+/**
+ * data provider for dangerous post conditions.
+ *
+ * @return array
+ */
+    public function dangerousPostConditionsProvider() {
+		return array(
+			array(
+				array('Model' => array('field !=' => 1))
+			),
+			array(
+				array('Model' => array('field AND 1=1 OR' => 'thing'))
+			),
+			array(
+				array('Model' => array('field >' => 1))
+			),
+			array(
+				array('Model' => array('field OR RAND()' => 1))
+			),
+		);
+	}
+
+/**
+ * test postConditions raising an exception on unsafe keys.
+ *
+ * @expectedException RuntimeException
+ * @dataProvider dangerousPostConditionsProvider
+ * @return void
+ */
+	public function testPostConditionsDangerous($data) {
+		$request = new CakeRequest('controller_posts/index');
+
+		$Controller = new Controller($request);
+		$Controller->postConditions($data);
+	}
+
 /**
  * testControllerHttpCodes method
  *

From fba7f1c6177268292deff2d49efc10181a7af1b8 Mon Sep 17 00:00:00 2001
From: Koji Tanaka <16202+tenkoma@users.noreply.github.com>
Date: Tue, 12 Dec 2017 20:00:21 +0900
Subject: [PATCH 15/18] Fix Phpdoc for CakeObject::log()

---
 lib/Cake/Core/CakeObject.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Cake/Core/CakeObject.php b/lib/Cake/Core/CakeObject.php
index 5c6b1e3d8..0a0f3ac16 100644
--- a/lib/Cake/Core/CakeObject.php
+++ b/lib/Cake/Core/CakeObject.php
@@ -148,7 +148,7 @@ class CakeObject {
  * Convenience method to write a message to CakeLog. See CakeLog::write()
  * for more information on writing to logs.
  *
- * @param string $msg Log message
+ * @param mixed $msg Log message
  * @param int $type Error type constant. Defined in app/Config/core.php.
  * @param null|string|array $scope The scope(s) a log message is being created in.
  *    See CakeLog::config() for more information on logging scopes.

From a9618f67f747f5ca9b3892509bd60b1d8f8eef63 Mon Sep 17 00:00:00 2001
From: mark_story <mark@mark-story.com>
Date: Mon, 11 Dec 2017 13:46:18 -0500
Subject: [PATCH 16/18] Use a permitted list instead of a ban list.

This should be safer as we are more confident on what is coming in.
---
 lib/Cake/Controller/Controller.php               | 3 ++-
 lib/Cake/Test/Case/Controller/ControllerTest.php | 5 ++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/Cake/Controller/Controller.php b/lib/Cake/Controller/Controller.php
index 7dd2a4ae1..05878f8ac 100644
--- a/lib/Cake/Controller/Controller.php
+++ b/lib/Cake/Controller/Controller.php
@@ -1033,6 +1033,7 @@ class Controller extends CakeObject implements CakeEventListener {
  *        included in the returned conditions
  * @return array|null An array of model conditions
  * @deprecated 3.0.0 Will be removed in 3.0.
+ * @throws RuntimeException when unsafe operators are found.
  */
 	public function postConditions($data = array(), $op = null, $bool = 'AND', $exclusive = false) {
 		if (!is_array($data) || empty($data)) {
@@ -1051,7 +1052,7 @@ class Controller extends CakeObject implements CakeEventListener {
 		$arrayOp = is_array($op);
 		foreach ($data as $model => $fields) {
 			foreach ($fields as $field => $value) {
-				if (preg_match('#[!=><~\&\|\)\(]#', $field)) {
+				if (preg_match('#[^a-zA-Z0-9_ ]#', $field)) {
 					throw new RuntimeException("Unsafe operator found in {$model}.{$field}");
 				}
 				$key = $model . '.' . $field;
diff --git a/lib/Cake/Test/Case/Controller/ControllerTest.php b/lib/Cake/Test/Case/Controller/ControllerTest.php
index 26e3c6b16..716d9019f 100644
--- a/lib/Cake/Test/Case/Controller/ControllerTest.php
+++ b/lib/Cake/Test/Case/Controller/ControllerTest.php
@@ -1182,7 +1182,7 @@ class ControllerTest extends CakeTestCase {
  *
  * @return array
  */
-    public function dangerousPostConditionsProvider() {
+	public function dangerousPostConditionsProvider() {
 		return array(
 			array(
 				array('Model' => array('field !=' => 1))
@@ -1196,6 +1196,9 @@ class ControllerTest extends CakeTestCase {
 			array(
 				array('Model' => array('field OR RAND()' => 1))
 			),
+			array(
+				array('Posts' => array('id IS NULL union all select posts.* from posts where id; --' => 1))
+			),
 		);
 	}
 

From 340059be151eae8eec32c3a70cd50a5c85c1c84e Mon Sep 17 00:00:00 2001
From: mark_story <mark@mark-story.com>
Date: Tue, 12 Dec 2017 13:45:33 -0500
Subject: [PATCH 17/18] Check model names for bad characters as well.

---
 lib/Cake/Controller/Controller.php               | 6 +++++-
 lib/Cake/Test/Case/Controller/ControllerTest.php | 3 +++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/Cake/Controller/Controller.php b/lib/Cake/Controller/Controller.php
index 05878f8ac..e9d5c6657 100644
--- a/lib/Cake/Controller/Controller.php
+++ b/lib/Cake/Controller/Controller.php
@@ -1049,10 +1049,14 @@ class Controller extends CakeObject implements CakeEventListener {
 			$op = '';
 		}
 
+		$allowedChars = '#[^a-zA-Z0-9_ ]#';
 		$arrayOp = is_array($op);
 		foreach ($data as $model => $fields) {
+			if (preg_match($allowedChars, $model)) {
+				throw new RuntimeException("Unsafe operator found in {$model}");
+			}
 			foreach ($fields as $field => $value) {
-				if (preg_match('#[^a-zA-Z0-9_ ]#', $field)) {
+				if (preg_match($allowedChars, $field)) {
 					throw new RuntimeException("Unsafe operator found in {$model}.{$field}");
 				}
 				$key = $model . '.' . $field;
diff --git a/lib/Cake/Test/Case/Controller/ControllerTest.php b/lib/Cake/Test/Case/Controller/ControllerTest.php
index 716d9019f..686520df6 100644
--- a/lib/Cake/Test/Case/Controller/ControllerTest.php
+++ b/lib/Cake/Test/Case/Controller/ControllerTest.php
@@ -1199,6 +1199,9 @@ class ControllerTest extends CakeTestCase {
 			array(
 				array('Posts' => array('id IS NULL union all select posts.* from posts where id; --' => 1))
 			),
+			array(
+				array('Post.id IS NULL; --' => array('id' => 1))
+			),
 		);
 	}
 

From 51206d73584178a409c5b71505e800acfd9b0ea8 Mon Sep 17 00:00:00 2001
From: mark_story <mark@mark-story.com>
Date: Mon, 18 Dec 2017 21:15:48 -0500
Subject: [PATCH 18/18] Update version number to 2.10.6

---
 lib/Cake/VERSION.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Cake/VERSION.txt b/lib/Cake/VERSION.txt
index 9b5d74257..9f0212d42 100644
--- a/lib/Cake/VERSION.txt
+++ b/lib/Cake/VERSION.txt
@@ -17,4 +17,4 @@
 // @license       https://opensource.org/licenses/mit-license.php MIT License
 // +--------------------------------------------------------------------------------------------+ //
 ////////////////////////////////////////////////////////////////////////////////////////////////////
-2.10.5
+2.10.6