Merge branch '2.5' into 2.6

lib/Cake/Network/CakeResponse.php

@@ -1320,7 +1320,8 @@ class CakeResponse {
  * - name: Alternate download name
  * - download: If `true` sets download header and forces file to be downloaded rather than displayed in browser
  *
- * @param string $path Path to file
+ * @param string $path Path to file. If the path is not an absolute path that resolves
+ *   to a file, `APP` will be prepended to the path.
  * @param array $options Options See above.
  * @return void
  * @throws NotFoundException
@@ -1331,6 +1332,13 @@ class CakeResponse {
 			'download' => null
 		);
 
+		if (strpos($path, '..') !== false) {
+			throw new NotFoundException(__d(
+				'cake_dev',
+				'The requested file contains `..` and will not be read.'
+			));
+		}
+
 		if (!is_file($path)) {
 			$path = APP . $path;
 		}

lib/Cake/Network/Email/CakeEmail.php

@@ -1224,15 +1224,14 @@ class CakeEmail {
 			$this->setHeaders($config['headers']);
 			unset($config['headers']);
 		}
+
 		if (array_key_exists('template', $config)) {
-			$layout = false;
+			$this->_template = $config['template'];
+		}
 		if (array_key_exists('layout', $config)) {
-				$layout = $config['layout'];
+			$this->_layout = $config['layout'];
-				unset($config['layout']);
-			}
-			$this->template($config['template'], $layout);
-			unset($config['template']);
 		}
+
 		$this->transportClass()->config($config);
 	}
 

lib/Cake/Test/Case/Network/CakeResponseTest.php

@@ -1166,6 +1166,17 @@ class CakeResponseTest extends CakeTestCase {
 		$response->file('/some/missing/folder/file.jpg');
 	}
 
+/**
+ * test file with ..
+ *
+ * @expectedException NotFoundException
+ * @return void
+ */
+	public function testFileWithPathTraversal() {
+		$response = new CakeResponse();
+		$response->file('my/../cat.gif');
+	}
+
 /**
  * testFile method
  *

lib/Cake/Test/Case/Network/Email/CakeEmailTest.php

@@ -1807,6 +1807,26 @@ class CakeEmailTest extends CakeTestCase {
 		$this->assertTrue((bool)strpos($result['headers'], 'To: '));
 	}
 
+/**
+ * testConfigArrayWithLayoutWithoutTemplate method
+ *
+ * @return void
+ */
+	public function testConfigArrayWithLayoutWithoutTemplate() {
+		$configs = array(
+			'from' => array('some@example.com' => 'My website'),
+			'to' => 'test@example.com',
+			'subject' => 'Test mail subject',
+			'transport' => 'Debug',
+			'layout' => 'custom'
+		);
+		$this->CakeEmail = new CakeEmail($configs);
+
+		$result = $this->CakeEmail->template();
+		$this->assertEquals('', $result['template']);
+		$this->assertEquals($configs['layout'], $result['layout']);
+	}
+
 /**
  * testConstructWithConfigString method
  *

lib/Cake/Test/Case/Utility/DebuggerTest.php

@@ -362,6 +362,7 @@ TEXT;
 	)
 	[protected] _scripts => array()
 	[protected] _paths => array()
+	[protected] _pathsForPlugin => array()
 	[protected] _parents => array()
 	[protected] _current => null
 	[protected] _currentType => ''

lib/Cake/View/View.php

@@ -251,6 +251,13 @@ class View extends Object {
  */
 	protected $_paths = array();
 
+/**
+ * Holds an array of plugin paths.
+ *
+ * @var array
+ */
+	protected $_pathsForPlugin = array();
+
 /**
  * The names of views and their parents used with View::extend();
  *
@@ -1112,9 +1119,14 @@ class View extends Object {
  * @return array paths
  */
 	protected function _paths($plugin = null, $cached = true) {
-		if ($plugin === null && $cached === true && !empty($this->_paths)) {
+		if ($cached === true) {
+			if ($plugin === null && !empty($this->_paths)) {
 				return $this->_paths;
 			}
+			if ($plugin !== null && isset($this->_pathsForPlugin[$plugin])) {
+				return $this->_pathsForPlugin[$plugin];
+			}
+		}
 		$paths = array();
 		$viewPaths = App::path('View');
 		$corePaths = array_merge(App::core('View'), App::core('Console/Templates/skel/View'));
@@ -1145,7 +1157,7 @@ class View extends Object {
 		}
 		$paths = array_merge($paths, $corePaths);
 		if ($plugin !== null) {
-			return $paths;
+			return $this->_pathsForPlugin[$plugin] = $paths;
 		}
 		return $this->_paths = $paths;
 	}