From be7ade3a4c80f1170d6a679ba7abc11c95ff14bb Mon Sep 17 00:00:00 2001 From: gwoo Date: Mon, 4 May 2009 20:13:10 +0000 Subject: [PATCH 01/22] Support for non-valid cookie values, fixes #6327 git-svn-id: https://svn.cakephp.org/repo/branches/1.2.x.x@8164 3807eeeb-6ff5-0310-8944-8be069107fe0 --- cake/libs/http_socket.php | 2 +- cake/tests/cases/libs/http_socket.test.php | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/cake/libs/http_socket.php b/cake/libs/http_socket.php index a98fd2bfb..25105fd55 100644 --- a/cake/libs/http_socket.php +++ b/cake/libs/http_socket.php @@ -846,7 +846,7 @@ class HttpSocket extends CakeSocket { $cookies = array(); foreach ((array)$header['Set-Cookie'] as $cookie) { $parts = preg_split('/(? array( 'foo=bar', - 'people=jim,jack,johnny";";Path=/accounts' + 'people=jim,jack,johnny";";Path=/accounts', + 'google=not=nice' ), 'Transfer-Encoding' => 'chunked', 'Date' => 'Sun, 18 Nov 2007 18:57:42 GMT', @@ -1168,7 +1169,10 @@ class HttpSocketTest extends CakeTestCase { ), 'people' => array( 'value' => 'jim,jack,johnny";"', - 'path' => '/accounts' + 'path' => '/accounts', + ), + 'google' => array( + 'value' => 'not=nice', ) ); $this->assertEqual($cookies, $expected); @@ -1179,7 +1183,7 @@ class HttpSocketTest extends CakeTestCase { $this->assertEqual($cookies, $expected); $header['Set-Cookie'] = 'foo=bar'; - unset($expected['people'], $expected['cakephp']); + unset($expected['people'], $expected['cakephp'], $expected['google']); $cookies = $this->Socket->parseCookies($header); $this->assertEqual($cookies, $expected); } From 8369a8f2d88f62c332d0a179c5ff54307a74e7be Mon Sep 17 00:00:00 2001 From: nate Date: Mon, 4 May 2009 20:36:22 +0000 Subject: [PATCH 02/22] Sanitizing path in Dispatcher::baseUrl(), fixes #6336, misc. whitespace fixes. git-svn-id: https://svn.cakephp.org/repo/branches/1.2.x.x@8165 3807eeeb-6ff5-0310-8944-8be069107fe0 --- cake/dispatcher.php | 3 ++- cake/libs/model/model.php | 5 ++++- cake/tests/cases/dispatcher.test.php | 17 +++++++++++++++++ cake/tests/cases/libs/router.test.php | 19 ++++++++++++++----- 4 files changed, 37 insertions(+), 7 deletions(-) diff --git a/cake/dispatcher.php b/cake/dispatcher.php index de0267563..9756c841a 100644 --- a/cake/dispatcher.php +++ b/cake/dispatcher.php @@ -344,7 +344,8 @@ class Dispatcher extends Object { return $this->base = $base; } if (!$baseUrl) { - $base = dirname(env('PHP_SELF')); + $replace = array('<', '>', '*', '\'', '"'); + $base = str_replace($replace, '', dirname(env('PHP_SELF'))); if ($webroot === 'webroot' && $webroot === basename($base)) { $base = dirname($base); diff --git a/cake/libs/model/model.php b/cake/libs/model/model.php index 1becede48..b20ad2c4e 100644 --- a/cake/libs/model/model.php +++ b/cake/libs/model/model.php @@ -1010,7 +1010,10 @@ class Model extends Overloadable { } if ($id !== null && $id !== false) { - $this->data = $this->find(array($this->alias . '.' . $this->primaryKey => $id), $fields); + $this->data = $this->find('first', array( + 'conditions' => array($this->alias . '.' . $this->primaryKey => $id), + 'fields' => $fields + )); return $this->data; } else { return false; diff --git a/cake/tests/cases/dispatcher.test.php b/cake/tests/cases/dispatcher.test.php index 0fcbfb3fb..a50037de8 100644 --- a/cake/tests/cases/dispatcher.test.php +++ b/cake/tests/cases/dispatcher.test.php @@ -1898,6 +1898,23 @@ class DispatcherTest extends CakeTestCase { unset($_POST['_method']); } + +/** + * Tests that invalid characters cannot be injected into the application base path. + * + * @return void + */ + function testBasePathInjection() { + $self = $_SERVER['PHP_SELF']; + $_SERVER['PHP_SELF'] = urldecode( + "/index.php/%22%3E%3Ch1%20onclick=%22alert('xss');%22%3Eheya%3C/h1%3E" + ); + + $dispatcher =& new Dispatcher(); + $result = $dispatcher->baseUrl(); + $expected = '/index.php/h1 onclick=alert(xss);heya'; + $this->assertEqual($result, $expected); + } /** * testEnvironmentDetection method * diff --git a/cake/tests/cases/libs/router.test.php b/cake/tests/cases/libs/router.test.php index f0bfb1441..f57c91d9c 100644 --- a/cake/tests/cases/libs/router.test.php +++ b/cake/tests/cases/libs/router.test.php @@ -658,14 +658,23 @@ class RouterTest extends CakeTestCase { Router::reload(); Router::setRequestInfo(array( - array('plugin' => 'shows', 'controller' => 'show_tickets', 'action' => 'admin_edit', 'pass' => - array(0 => '6'), 'prefix' => 'admin', 'admin' => true, 'form' => array(), 'url' => - array('url' => 'admin/shows/show_tickets/edit/6')), - array('plugin' => NULL, 'controller' => NULL, 'action' => NULL, 'base' => '', 'here' => '/admin/shows/show_tickets/edit/6', 'webroot' => '/'))); + array( + 'plugin' => 'shows', 'controller' => 'show_tickets', 'action' => 'admin_edit', + 'pass' => array('6'), 'prefix' => 'admin', 'admin' => true, 'form' => array(), + 'url' => array('url' => 'admin/shows/show_tickets/edit/6') + ), + array( + 'plugin' => null, 'controller' => null, 'action' => null, 'base' => '', + 'here' => '/admin/shows/show_tickets/edit/6', 'webroot' => '/' + ) + )); Router::parse('/'); - $result = Router::url(array('plugin' => 'shows', 'controller' => 'show_tickets', 'action' => 'edit', 'id' => '6', 'admin' => true, 'prefix' => 'admin', )); + $result = Router::url(array( + 'plugin' => 'shows', 'controller' => 'show_tickets', 'action' => 'edit', 'id' => '6', + 'admin' => true, 'prefix' => 'admin' + )); $expected = '/admin/shows/show_tickets/edit/6'; $this->assertEqual($result, $expected); } From c4878cf95d39593061f7ee368dd95d945a7fc9b0 Mon Sep 17 00:00:00 2001 From: gwoo Date: Mon, 4 May 2009 21:17:19 +0000 Subject: [PATCH 03/22] Merging fixes to trunk git-svn-id: https://svn.cakephp.org/repo/branches/1.2.x.x@8166 3807eeeb-6ff5-0310-8944-8be069107fe0 --- cake/VERSION.txt | 2 +- cake/config/config.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/cake/VERSION.txt b/cake/VERSION.txt index 328fa2e81..e210b41c1 100644 --- a/cake/VERSION.txt +++ b/cake/VERSION.txt @@ -6,4 +6,4 @@ // +---------------------------------------------------------------------------------------------------+ // /////////////////////////////////////////////////////////////////////////////////////////////////////////// -1.2.2.8120 \ No newline at end of file +1.2.3.8166 \ No newline at end of file diff --git a/cake/config/config.php b/cake/config/config.php index 1ad4c719c..446aea182 100644 --- a/cake/config/config.php +++ b/cake/config/config.php @@ -22,5 +22,5 @@ * @lastmodified $Date$ * @license http://www.opensource.org/licenses/mit-license.php The MIT License */ -return $config['Cake.version'] = '1.2.2.8120'; +return $config['Cake.version'] = '1.2.3.8166'; ?> \ No newline at end of file From bf7e257e02343f19021a45e7cb1d975d81cf1825 Mon Sep 17 00:00:00 2001 From: mark_story Date: Thu, 7 May 2009 00:53:44 +0000 Subject: [PATCH 04/22] Updating coding standards in bake templates and scaffolds. Fixes #6346 git-svn-id: https://svn.cakephp.org/repo/branches/1.2.x.x@8167 3807eeeb-6ff5-0310-8944-8be069107fe0 --- cake/console/libs/templates/views/form.ctp | 8 +++---- cake/console/libs/templates/views/index.ctp | 16 +++++++------- cake/console/libs/templates/views/view.ctp | 24 ++++++++++----------- cake/libs/view/scaffolds/edit.ctp | 8 +++---- cake/libs/view/scaffolds/index.ctp | 18 ++++++++-------- cake/libs/view/scaffolds/view.ctp | 24 ++++++++++----------- 6 files changed, 49 insertions(+), 49 deletions(-) diff --git a/cake/console/libs/templates/views/form.ctp b/cake/console/libs/templates/views/form.ctp index 961d653a3..78ebdda7b 100644 --- a/cake/console/libs/templates/views/form.ctp +++ b/cake/console/libs/templates/views/form.ctp @@ -50,16 +50,16 @@