adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2025-01-31 09:06:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Added disabledActions feature to SecurityComponent

Browse source
This commit is contained in:
Tigran Gabrielyan 2012-08-01 21:28:24 -07:00
parent 568c60de9f
commit df8ec17626
2 changed files with 24 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
lib/Cake/Controller/Component/SecurityComponent.php
View file

@ -178,6 +178,13 @@ class SecurityComponent extends Component {
*/
public $csrfLimit = 100;
/**
* List of actions to disable security checks
*
* @var array
*/
public $disabledActions = array();
/**
* Other components used by the Security component
*
@ -218,13 +225,11 @@ class SecurityComponent extends Component {
$controller->request->params['requested'] != 1
);
if ($isPost && $isNotRequestAction && $this->validatePost) {
if ($this->_validatePost($controller) === false) {
if (!in_array($this->_action, (array)$this->disabledActions) && $isPost && $isNotRequestAction) {
if ($this->validatePost && $this->_validatePost($controller) === false) {
return $this->blackHole($controller, 'auth');
}
}
if ($isPost && $isNotRequestAction && $this->csrfCheck) {
if ($this->_validateCsrf($controller) === false) {
if ($this->csrfCheck && $this->_validateCsrf($controller) === false) {
return $this->blackHole($controller, 'csrf');
}
}

14
lib/Cake/Test/Case/Controller/Component/SecurityComponentTest.php
View file

@ -1372,4 +1372,18 @@ class SecurityComponentTest extends CakeTestCase {
$this->assertTrue(isset($result['4']));
$this->assertTrue(isset($result['5']));
}
/**
* Test disabled actions
*
* @return void
*/
public function testDisabledActions() {
$_SERVER['REQUEST_METHOD'] = 'POST';
$this->Controller->request->data = array('data');
$this->Controller->Security->disabledActions = 'index';
$this->Controller->Security->blackHoleCallback = null;
$result = $this->Controller->Security->startup($this->Controller);
$this->assertNull($result);
}
}