adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 11:28:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
19376 commits 7 branches 0 tags 44 MiB
Commit graph

3875 commits

Author SHA1 Message Date
Cory Thompson
990d0a962f Allow database JSON operations in conditions 2017-01-24 19:33:12 +11:00
Cory Thompson
82a64a3729 Merge remote-tracking branch 'doublemap/exclude-column-trailing-hyphen' into ticket-8872 2017-01-24 19:25:24 +11:00
mark_story
273a8a2d7d Add support for the parseHuge option. 
Sometimes people need to load huge XML files. Add an option to enable
people to enable this flag.

Refs #10031
 2017-01-13 21:26:54 -05:00
Mark Story
d40b39f18b Merge pull request #9970 from cakephp/issue-9962 
Fix query string parsing on requestAction()
 2017-01-06 13:47:42 -05:00
chinpei215
94d9bcd674 Fix FlashHelper::render() cannot render default messages 
Fixes #9910
 2017-01-05 19:00:52 +09:00
mark_story
304117d228 Fix query string parsing on requestAction() 
This also fixes a long standing oddity around string URLs that include
a query string where the query string data would be duplicated.

Refs #9962
 2017-01-04 22:34:19 -05:00
mark_story
1a8f2202c0 Merge branch '2.x' into 2.next 2017-01-03 11:01:04 -05:00
Shunsuke Takahashi
6f5b16b31f Allow the prepend the addCrumb method 2016-12-21 16:34:35 +09:00
mark_story
53bcc1550f Fix PHPCS error. 2016-12-13 22:50:07 -05:00
mark_story
4c3e9356ba Merge branch '2.next' of github.com:cakephp/cakephp into 2.next 2016-12-13 22:48:57 -05:00
mark_story
837741db66 Merge branch '2.x' into 2.next 2016-12-13 22:48:44 -05:00
mark_story
99af4bba83 Merge branch 'domingues-2x' into 2.x 
Refs #9870
 2016-12-13 22:48:12 -05:00
mark_story
3c44ddd10b Add tests for #9870 2016-12-13 22:47:57 -05:00
Mark Story
4a4c83c3e9 Merge pull request #9859 from cakephp/debugger-encoding 
2.x - Debugger encoding
 2016-12-13 19:26:52 -05:00
mark_story
ee7739a3bf Try another approach to get the same error in all php versions. 2016-12-13 00:46:13 -05:00
mark_story
69afeb08af Skip error encoding test in PHP5.3 
Index errors work funny in PHP5.3, which makes testing them not work
like other versions of PHP.
 2016-12-12 21:28:20 -05:00
mark_story
edfda47cf4 Fix missing HTML encoding in Debugger 
Fix missing HTML encoding when error messages contain HTML. This can
happen when user data is used as an offset in an array in an unchecked
way.

Thanks to Teppei Fukuda for reporting this issue via the responsible
security disclosure process.
 2016-12-10 08:47:13 -05:00
Mark Story
420336f536 Merge pull request #9843 from cakephp/php71 
Add PHP7.1 to test matrix.
 2016-12-07 21:40:54 -05:00
mark_story
12cdc247ac Fix PHPCS errors. 2016-12-07 00:38:55 -05:00
mark_story
0a2a400ea4 Fix type error tests to work in PHP5 & PHP7.1 
Catch the TypeErrors that are raised and make the match the PHP5
behavior of a converted error.
 2016-12-06 21:21:52 -05:00
Mark Story
9e6e08704e Merge pull request #9838 from cakephp/issue-9779 
Fix CookieComponent erroring on corrupted data.
 2016-12-05 16:44:24 -05:00
mark_story
e3221b1c38 Fix errors in php7.1 
* The constructor of errors has changed in PHP 7.1
* mcrypt is no longer available in PHP 7.1 by default.
 2016-12-05 16:14:33 -05:00
chinpei215
26731b93bf Use ternary operator 2016-12-04 21:55:29 +09:00
chinpei215
b7481096c8 Fix redirectUrl issue when loginRedirect is empty 
Fixes #9819
 2016-12-04 20:06:24 +09:00
mark_story
934bb00b36 Add tests showing recent changes fix #9784 2016-12-03 14:14:57 -05:00
mark_story
27f951fb41 Don't emit errors when operating on corrupted cookie data. 
When deleting from corrupted cookie data, there shouldn't be any errors.

Refs #9779
 2016-12-03 14:10:47 -05:00
chinpei215
74c2ded872 Fix directory traversal of .ctp files 2016-11-27 18:14:44 +09:00
mark_story
bbb87b3e87 Use null instead of false for failure. 
null is better to indicate that a thing doesn't exist.
 2016-11-26 10:38:28 -05:00
Mark Story
ba9f62a7a0 Merge pull request #9747 from tersmitten/cache-does-not-expose-configured-engines 
Expose Cache engines
 2016-11-26 10:16:20 -05:00
mark_story
e057b5572c Fix PHPCS. 2016-11-21 20:51:12 -05:00
mark_story
71b7d6211b Fix AclNode constructor. 
It should forward the settings from ClassRegistry::init() so that
aliases can be customized as needed.

Refs #9766
 2016-11-19 22:30:18 -04:00
mark_story
66363e6bea Add tests for #9766 
I'm not able to reproduce incorrect aliases coming out of ClassRegistry.
As reported.
 2016-11-19 10:02:09 -04:00
Mischa ter Smitten
e71afa225e Merge remote-tracking branch 'upstream/2.x' into make-it-possible-to-configure-cachemethodhashalgo-in-dbosource 2016-11-14 16:26:48 +01:00
Mischa ter Smitten
936b9924b3 Add tests for overridden cacheMethodFilter 2016-11-14 12:51:57 +01:00
Mischa ter Smitten
1952d2ee17 Add tests for cacheMethodFilter 2016-11-14 11:44:35 +01:00
Mischa ter Smitten
5947c2346b Fix failing test 2016-11-14 10:53:33 +01:00
Mischa ter Smitten
7ffb5c3600 Add tests for cacheMethodHasher 2016-11-14 10:00:47 +01:00
Mischa ter Smitten
94572ae384 Do not use deprecated assertIsA 2016-11-11 21:41:23 +01:00
Mischa ter Smitten
175503fafa Expose engines 
By implementing the `engine` method just like in version 3
 2016-11-11 13:42:22 +01:00
Val Bancer
467ee851bf some refactoring to fix failed shell dispatcher tests 2016-11-08 10:03:46 +01:00
mark_story
3837f40394 Autodetect content-types for email attachments (2.x) 
This ports the safe parts of #9619 and updates the tests. Because
existing tests had to change and I was concerned about changing people's
email messages in a bugfix release I'm targetting 2.next with this
change.
 2016-11-06 21:49:15 -05:00
mark_story
c0150f62ed Merge branch '2.x' into 2.next 2016-11-06 21:42:31 -05:00
mark_story
9d94487b23 Fix PHPCS 
Refs MATES-9698
 2016-11-04 09:31:05 -04:00
Rodrigo Pérez
20da4484de refs #backport-paginate-multiple-queries Backporting cakephp 3.3 feature to paginate multiple queries 2016-11-04 11:10:28 +00:00
mark_story
6a201696dd Fix HttpSocket emitting errors when nameless cookies are encountered. 
Refs #9698
 2016-11-03 19:07:25 -04:00
xhs345
e1c5ef9e7a Add clear option to Flash Message 
To give user the option to disable Stacking of messages and being consistent with 3.x
 2016-10-30 20:39:00 -07:00
Val Bancer
744b455de1 fixed configuration of 'enabled' setting in components inside a 
component
 2016-10-28 22:14:20 +02:00
xhs345
924d382bb3 Fix tests 2016-10-28 09:10:01 -07:00
xhs345
c59fb85da8 Add support for stacking Flash messages 
See Issue #7830
 2016-10-28 09:10:01 -07:00
mark_story
135a24e0f1 Merge branch '2.x' into 2.next 2016-10-28 00:29:46 -04:00
mark_story
c935bed8f6 Fix PHPCS 2016-10-21 18:35:05 -04:00
mark_story
816801902e Allow '' to be a valid key for Hash, and Session 
By removing a bunch of empty() guards we can make '' behave like all the
other key names. This does change the existing behavior/tests around ''
key, but I think that is ok given the need to manipulate ''.

Refs #9632
 2016-10-21 10:54:39 -04:00
chinpei215
3102d89313 Fix a test for PHP5.3 2016-10-16 22:40:27 +09:00
chinpei215
739664d6c7 Add more tests 2016-10-16 22:28:28 +09:00
chinpei215
d7ae1c92e7 Backport test cases and make sure those pass 2016-10-16 22:04:24 +09:00
mark_story
ecd270d04b Tweak/Add doc blocks. 2016-10-09 11:05:35 -04:00
David Maicher
a932bce3de [Bugfix] use Model::$cacheQueries as default for ->query(...) 2016-10-09 13:43:27 +02:00
Ashley Pinner
5f22fae1da Adding Base64 support to the HtmlHelper::image() function 
Requested by cakephp/cakephp#9560
 2016-10-06 09:01:15 +01:00
José Lorenzo Rodríguez
9425234b87 Merge pull request #9550 from cakephp/issue-9526 
Fix enum column length detection.
 2016-10-06 09:29:25 +02:00
Andrej Griniuk
2d6e85ed14 validate table name before generating schema file 2016-10-03 00:23:05 +08:00
mark_story
e41ccdb701 Fix enum column length detection. 
Use simpler code to calculate the length of fields. Include more tests
for DboSource as there weren't any before.

Refs #9526
 2016-09-30 22:25:25 -04:00
Mischa ter Smitten
197c2f4e60 Make use of assertAttributeEquals 2016-09-22 21:30:18 +02:00
Mischa ter Smitten
4c9f1cc154 _lastAction() should also work with named parameters in the url 2016-09-20 15:07:36 +02:00
mark_story
ad5130cd31 Merge branch '2.next' into 2.x 2016-09-18 22:22:56 -04:00
mark_story
4f70bdb3b8 The _lastAction property should not double include the base path. 
FormHelper should not run URLs through Router twice when determining the
the form's lastAction attribute. However, because we're using the helper
method (see #9414) we do need to HTML decode the URL before using it in
form token generation.

Refs #9455
 2016-09-13 22:21:01 -04:00
mark_story
dc2fa498ef PHPCS. 2016-09-12 23:19:08 -04:00
mark_story
9d1fbb95b3 Allow datasource access in constructors of mocked models. 
When mock objects are created from models that access their datasource
in the constructor, an exception would be raised for the missing default
datasource. By changing how configuration data is handled in the mock
creation we can avoid this issue and not reopen #4867

Refs #8225
 2016-09-12 22:15:55 -04:00
Val Bancer
98cd278c02 improved performance of insertMulti() in Mysql 2016-09-05 21:28:07 +02:00
mark_story
e8d63725d8 Merge branch '2.x' into 2.next 2016-09-04 23:54:22 -04:00
mark_story
2ffde69d5b Skip test that always fails on PHP5.3 2016-08-29 21:56:30 -04:00
mark_story
d1cfe203c4 Fix PHPCS error. 2016-08-29 21:53:47 -04:00
Mark Story
51963ab8fc Merge pull request #9349 from cakephp/2.x-sort-locale 
2.x sort locale backport
 2016-08-26 11:13:21 -04:00
Mark Sch
ee319baec1 Backport skip 2016-08-26 16:15:39 +02:00
mscherer
03df288e78 Re-add spacing. 2016-08-26 14:45:59 +02:00
mscherer
dab4b85596 Backport Hash::sort() support for type locale. 2016-08-26 14:32:21 +02:00
ndm2
87d86aaed9 Fix/tighten Folder::inPath() checks. 
The current checks are way too relaxed, and are more like testing
for a substring, which makes it easy for invalid paths to slip
trough, for example `/foo/var/www` is falsely tested to reside in
`/var/www`.

Passing an empty path never worked properly, it was triggering a
warning, didn't worked on Windows, and the behavior that the current
top level directory would be assumed for empty paths wasn't
documented.

Similar is true for relative paths. While they did match at one point,
this was incorrect behavior, and matching actual path fragments seems
out of scope for this method.

This change makes the `$path` argument required, requires it to be an
absolute path, and throws an exception in case a non-absolute path is
being passed.
 2016-08-26 13:45:45 +02:00
Mark van Driel
e3b0aca95e Removed bug fix for Helper::_confirm to keep the code compatible 2016-08-21 17:09:43 +02:00
Mark van Driel
34afc377ec Added support for confirm (message) option to submit in FormHelper 2016-08-20 12:51:13 +02:00
José Lorenzo Rodríguez
3937a4f02e Merge pull request #9255 from cakephp/issue-9229-restore 
Restore header() behavior inadvertantely removed.
 2016-08-15 09:51:10 +02:00
mark_story
3e16f8911d Add tests covering basic use of <> in deleteAll() 
Refs #9253
 2016-08-13 22:48:02 -04:00
mark_story
bc73e928b6 Restore header() behavior inadvertantely removed. 
In eaa2bbbcae I changed the behavior to
now use the TitleCased name as I didn't understand the intended behavior
or how apache was working in the reporter's specific case.

Refs #9229
 2016-08-11 21:54:24 -04:00
Marc Würth
f2638b3e38 Remove superfluous "Class" from doc blocks 2016-08-10 12:22:09 +02:00
mark_story
61b3fbd605 Merge branch '2.x' into 2.next 2016-08-09 22:12:26 -04:00
mark_story
eaa2bbbcae Merge branch 'auth-header' into 2.x 
Refs #9229
 2016-08-09 22:07:46 -04:00
mark_story
20a2af8c16 Fix casing issues with Authorization header. 
We need to check the upper case versions of headers in $_SERVER.
Also fix lint issues.
 2016-08-09 22:06:49 -04:00
nojimage
e71d83c612 TestShell passes the 'directive' option to PHPUnit correctly 2016-08-08 20:09:37 +09:00
Sebastien Barre
345375b6b6 add test 2016-08-07 23:08:55 -04:00
Juan I. Benavides
93db51cf10 Avoiding circular object reference in SmptTransport 
This fixes a memory leak while sending multiple emails.

Fixes: #9198
 2016-08-01 13:09:45 -05:00
Mark van Driel
5caac5f340 Prevent unnecessary joins / complex conditions in delete 2016-07-27 16:31:57 +02:00
Andrej Griniuk
147693618c refs #9174 fix CakeSchema compare when changing field length to the default one 2016-07-26 23:39:09 +03:00
Mark van Driel
d6e45131ad Prevent unnecessary joins / complex conditions in delete 2016-07-25 17:15:18 +02:00
Mark Story
b50c06423d Merge pull request #9115 from biesbjerg/ticket-7488 
Fire Controller.shutdown and Dispatcher.afterDispatch events when exceptions are thrown
 2016-07-19 22:49:02 -04:00
Mark Story
876b508797 Merge pull request #9108 from cakephp/issue-9106 
Don't split strings headers that lack a ':'.
 2016-07-15 22:20:13 -04:00
Kim Biesbjerg
38cad279d1 Updated test method name and description 2016-07-14 04:57:25 +02:00
Kim Biesbjerg
c77b628841 Dispatch Controller.shutdown instead of calling afterFilter directly. Updated test 2016-07-14 04:51:49 +02:00
Kim Biesbjerg
a05639a30e Don't save buffered output to var since it is not used 2016-07-14 00:20:33 +02:00
Kim Biesbjerg
5a63ee4e3e Added tests to prove that Dispatcher.afterDispatch event is dispatched by exception renderer on error response 2016-07-14 00:17:02 +02:00
mark_story
4e1b601ed8 Don't split strings headers that lack a ':'. 
Refs #9106
 2016-07-12 22:46:47 -04:00
Philippe Saint-Just
b0e5e39e45 Added test case 2016-07-10 09:57:24 +01:00
Kim Biesbjerg
1d7a4da903 Fixed wrong assertion 2016-07-07 09:24:33 +02:00
Kim Biesbjerg
0ea315b2e0 Add assertion to prove session is not started on stateless login 2016-07-07 08:58:51 +02:00
Kim Biesbjerg
c63de8d9f5 Added test to prove stateless login sets user 2016-07-06 12:34:23 +02:00
mark_story
234f732d6d Attempt to get tests passing on travis. 
Also attempt to get stickler to ignore the 2.x branch.
 2016-07-01 17:52:02 -04:00
mark_story
d816ea6e16 Add test showing that niceShort translates month names. 
Refs #8968
 2016-07-01 17:51:23 -04:00
nojimage
57e0a97483 refs #8654 FormHelper cleanup unlockFields key 2016-06-28 22:01:06 -04:00
mark_story
432eb9c432 Merge branch '2.x' into 2.next 2016-06-27 21:47:47 -04:00
mark_story
f28c21c7a7 Stop testing against SSL ciphers that emit warnings. 
Testing that SSLv3 still works is causing test failures.
 2016-06-27 21:47:37 -04:00
Mark Story
55e9638044 Merge pull request #8844 from icyrizard/add_http_patch_content_type_check 
Add HTTP patch Content-Type check
 2016-05-27 15:41:18 +02:00
Aloïs Thévenot
b737e9f732 #8844 Add test 2016-05-27 12:50:23 +00:00
Eric Jiang
11dfe0b40c Add test case for trailing hyphen in column name 2016-05-26 19:27:18 -07:00
mark_story
e78af35af7 Only clear the unlocked fields on end(). 
Doing this work on end() allows fields to be unlocked before the form is
created which can be helpful.

Refs #8880
 2016-05-25 23:04:53 +02:00
Mark Story
b15560ea0c Merge pull request #8880 from nojimage/form-unlockfields-2x 
Reset FormHelper::$_unlockFields for 2.x
 2016-05-25 22:59:25 +02:00
mark_story
d5d46e21bd Fix indentation. 2016-05-22 16:39:49 -04:00
Mark Story
1a7e8c51e7 Merge pull request #8848 from xhs345/2.x 
Add attribute 'fieldset' to Form->radio
 2016-05-22 16:38:39 -04:00
nojimage
850305a384 fixes reset FormHelper::$_unlockFields 2016-05-21 13:33:20 +09:00
xhs345
eeefa03546 Updated Radio and Inputs form helper 
Also added UnitTest for radio fieldset class-name
 2016-05-19 17:28:47 -07:00
Mark Story
0fd3ad9b76 Merge pull request #8851 from MarkusBauer/v2.x/SqliteTestEnhancements 
Sqlite testcase enhancements
 2016-05-18 22:01:33 -04:00
Markus Bauer
2227e01990 Fixing Sqlite's handling of datetime/timestamp columns with current_timestamp default set 2016-05-19 00:21:43 +02:00
Markus Bauer
058809275c Enable nested transactions before trying to test them 2016-05-18 23:46:51 +02:00
Markus Bauer
f75ebf8cb9 Make Sqlite Testcases compatible with Windows / NTFS file systems 2016-05-18 23:46:10 +02:00
Steampilot
723ed96fd6 Added sorting by modified time in Folder util 2016-05-12 16:28:04 +02:00
Juan Basso
fa6e74ca22
Improved apc calls 
Instead of calling the call_user_func_array it does the call directly. It is a little bit more verbose, but performs better.
 2016-05-07 14:26:09 -04:00
Juan Basso
4a61f7f23c
Supporting APCu on PHP 7 2016-05-07 03:46:21 -04:00
xhs345
4d65091d0c Updated tests 2016-05-03 15:39:37 -07:00
mark_story
12c6fd4e22 Merge branch '2.x' into 2.next 2016-05-02 21:58:41 -04:00
mark_story
0912867b49 Minor formatting clean up. 
Refs #8754
 2016-05-02 21:58:20 -04:00
schrolli
e0682fc8a1 added testcases for time and datetime-fields 
both have set their length field and should be displayed as text-inputs
 2016-05-02 17:13:22 +02:00
Mark Sch
32cb25465f Make CS tests pass. 2016-05-02 10:42:42 +02:00
mark_story
ade9d8a811 Restore backwards compatibility with old 2.x in FormHelper. 
Restore the behavior of the string 'action' option to its former glory.
While we've deprecated this it needs to continue working as it did
before.

Refs #8628
 2016-05-01 22:21:23 -04:00
Philippe Saint-Just
c2f028ab49 Fix spacing 2016-04-30 13:13:14 -04:00
Philippe Saint-Just
cd07850337 Merge branch 'backport-8741-8690' into 2.x 2016-04-30 13:11:34 -04:00
mark_story
af953700b8 Fix short array usage. 
Refs FIVESMX-8723
 2016-04-29 09:28:05 -04:00
mark_story
cf55767fa0 Backport range parsing resiliancy fixes from 3.x 
Refs #8723
 2016-04-28 22:27:37 -04:00
mark_story
9536a10d6d Make schema import plugin friendly. 
The changes in #8694 pointed out that schema importing doesn't play nice
with plugins. This corrects that.
 2016-04-23 16:18:15 -04:00
mark_story
3a75e8aa72 Use import options when going through execute() 
The `records` and `schema` options should work when using execute().
Previously they were not working. Furthermore, the records option did
a non-sensical thing where it both set import=>records and generated
static records from the live table. The `records` option now enables
the generation of static data from a live table, as I think this is
a more common scenario.

Refs #8693
 2016-04-23 16:15:54 -04:00
Mark Story
be35880b2f Merge pull request #8692 from garethellis36/dont-override-shell-loggers 
Don't override already-configured loggers
 2016-04-22 16:05:03 -04:00
Gareth Ellis
bfb6ebb049 PHPCS fixes 2016-04-22 19:21:47 +01:00
Gareth Ellis
bc3a1fb6c5 Makes ShellTest::testShellLoggersDoNotGetOverridden actually useful 2016-04-22 19:18:29 +01:00
Gareth Ellis
153f04a976 Changes behaviour of _useLogger so that already-configured loggers are not overridden 2016-04-22 13:56:26 +01:00
chinpei215
1826b4cb08 Add DboSource::flushQueryCache() 2016-04-19 00:01:06 +09:00
mark_story
8b5023282e Randomly generate a salt when the salt is '' or null. 
To prevent an issue where any value is accepted as a password when '' is
provided as the hashed password.

Refs #8650
 2016-04-15 21:49:17 -04:00
mark_story
f451efa511 Attempt to fix tests in 2.x 
Relying on tv.eurosport.com having a bad peer name is pretty fragile.
However, we can more easily rely on their cert coming from a CA we no
longer trust.
 2016-04-14 15:28:34 -04:00
chinpei215
5006cc396a Add a test case to make sure of backward compatibility 2016-04-11 00:43:35 +09:00
mscherer
e84ff5e0d5 Fix doc block param types. 2016-04-08 15:12:48 +02:00
mscherer
657b1a1029 Fix doc block param types. 2016-04-08 15:02:03 +02:00
mscherer
bae4a11e5e Rename test file. 2016-04-08 14:40:30 +02:00
mscherer
dda9e83ab6 Refactor Object to CakeObject for future PHP7 comp. 2016-04-08 14:33:26 +02:00
mark_story
79db545b69 Fix PHP 5.4 syntax. 2016-04-02 21:45:02 -04:00
mark_story
1333cc4b3e Merge branch 'postlink-token' into 2.x 
Fix inline postLink() calls corrupting the containing form's tampering
token.

Refs #8387
 2016-04-01 23:08:41 -04:00
mark_story
c551faad46 Add tests for changes in #8387 
Add tests covering the new behavior.
 2016-04-01 23:08:31 -04:00
mark_story
84fc9498b5 Allow N11 exchange numbers as valid. 
The previous code and commit (fa3d4a0bb5)
were incorrect about invalid exchange numbers as 1-800-211-4511 is
a real phone number.

I've also removed a duplicate alternation pattern.

Refs #8567
 2016-03-31 22:38:16 -04:00
mark_story
1926d40d40 Fix possibility for spoofed files to pass validation. 
Use `is_uploaded_file` to prevent crafty requests that contain bogus
files from getting through. A testing stub class was necessary to avoid
making significant changes to the test suite.
 2016-03-28 22:10:36 -04:00
Gareth Ellis
a6702b70d4 Extracts error trace in ErrorHandler to a helper function to allow customization 2016-03-23 19:05:23 +00:00
mark_story
f57f038c09 Fix for PHP 5.3 2016-03-16 21:17:42 -04:00
mark_story
745f3a33e6 Fix boolean values in select widgets. 
Boolean `false` should be treated like `0` when comparing option values.

Refs #8468
 2016-03-15 22:59:03 -04:00
mark_story
af046fc7d6 Merge branch 'request-ip' into 2.x 2016-03-13 23:00:47 -04:00
mark_story
fef3090717 Fix incorrectly inheriting permissions. 
When child inherits from a deny parent the '*' permission should reflect
permissions on all nodes not just the leaf node. Previously once a node
with all permissions set to inherit was found, the check would pass.
Instead it should cascade to the parent nodes and look for explicit
allow/deny.

Refs #8450
 2016-03-11 23:18:50 -05:00
mark_story
48af49ddde Don't trust CLIENT_IP 
The client_ip header can easily be forged. In 'safe' modes we should
only trust the remote_addr which comes from the sapi. Remove support for
http_clientaddress as I can't seem to find where this ever came from in
PHP on the http specs.
 2016-03-10 22:04:13 -05:00
Mark Story
18b0334890 Merge pull request #8384 from garas/mailtransport-log-subject 
Email log missing Subject and To headers when using MailTransport
 2016-03-02 21:29:13 -05:00
mark_story
3ad68db5eb Tweak fix from #8359 
This fixes a regression introduced in that change that we didn't
previously have tests for. The issue fixed in #8359 was related to
PHP7.0, whereas PHP5 didn't have an issue. Now both versions will work
the same.
 2016-03-02 12:30:48 -05:00
Edgaras Janušauskas
2386a86adc Include Subject and To in email log when using MailTransport 2016-03-01 22:21:14 +02:00
mark_story
3ed321dff4 Handle negative numbers in Redis correctly. 
Update number sniff to handle negative numbers. We need to do number
sniffing so we can maintain compatbility between write() and
increment()/decrement().

Refs #8364
 2016-02-27 00:07:58 -05:00
Mark Story
eae7a8926b Merge pull request #8345 from cakephp/issue-8330 
Fix parsing empty header values.
 2016-02-26 23:01:59 -05:00
Mark Story
31b3f39b67 Merge pull request #8310 from cakephp/secure-random 
2.x - Secure random
 2016-02-25 22:05:08 -05:00
mark_story
1a170e1eec Fix parsing empty header values. 
Replace the complex and somewhat unfixable regexp based parser for
a parser that handles each line individually. Normalize multi-line
headers to replace multiple spaces with a single one. Section 4.2 of the
HTTP1.1 standard states

> Any LWS that occurs between field-content MAY be replaced with
> a single SP before interpreting the field value or forwarding the
> message downstream.

This makes me somewhat confident that we can safely normalize
multi-line HTTP header values.

Refs #8330
 2016-02-24 22:25:58 -05:00
mark_story
9c0da41858 Skip test on PHP7 as the warning is not consistent. 2016-02-23 20:54:16 -05:00
Mark Story
ff6cdd4b73 Merge pull request #8279 from cakephp/issue-8114 
Fix inherited permissions when checking the '*' permission.
 2016-02-22 14:48:58 -05:00
mark_story
7df99fff1f Backport Security::randomBytes() to 2.x 
I decided to leave the warning in. People who can't upgrade their
applications should at least be aware of the risks they are taking.

I'm flexible if people are strongly opposed to a warning, but I feel
that these kinds of warnings can be supressed in production if they
really are in a jam and don't care.

Refs #8282
 2016-02-22 00:14:44 -05:00
mark_story
4389c79442 Update tests. 
The old tests were relying on the fixed inherit bug. Instead check
a specific permission which will result in a deny.

Refs #8114
 2016-02-18 21:24:52 -05:00
mark_story
8f3df8b13e Make tests not fail when extensions are installed 
If the extensions are installed but memcached/redis are not running
errors should not be emitted.
 2016-02-18 21:14:55 -05:00
mark_story
b2509ea13d Fix inherited permissions when checking the '*' permission. 
When checking inherited permissions for '*' also copy inherited
permissions onto the inherited list. By copying the inherited values, we
get the union of explit allow and inherited permissions, which if all
things go well will match the permission key list.

Refs #8114
 2016-02-16 22:30:19 -05:00
Mark Story
68082fad02 Merge pull request #8207 from CakeDC/feature/uuid 
Add support for Postgres native uuid datatype
 2016-02-16 21:53:08 -05:00
Chris Hallgren
bf22e84d65 CS fixes 2016-02-15 20:44:27 -06:00
Chris Hallgren
849abab6a4 Fixing test case 2016-02-15 19:34:05 -06:00
Chris Hallgren
0c183b9b8e Read content type in a more compatible way. 
Not all webservers set CONTENT_TYPE. The built-in PHP webserver for
example sets HTTP_CONTENT_TYPE instead. Add a public method to the
request object to smooth over this difference.

Refs #6051, #8267
 2016-02-15 19:31:24 -06:00
Marc Würth
b5655d63ff Remove lighthouse references 2016-02-10 12:27:34 +01:00
mark_story
e4b939bba0 Backport fix for Validation::uploadedFile to 2.x 
Don't fail validation when the keys are not the expected order.

Refs #8201
 2016-02-08 22:37:25 -05:00
mark_story
c0d897b45c Merge branch '2.x' into 2.8 2016-02-06 20:55:08 -05:00
Mark Story
41a12e9aa2 Merge pull request #8067 from cakephp/issue-7906 
Make the session cacheLimiter a configuration option.
 2016-02-06 20:30:48 -05:00
Edgaras Janušauskas
f389231058 Improve ExtractTask when CakePHP installed via Composer 2016-02-03 14:52:15 +02:00
Jorge M. González Martín
3ca3ffeeee fix phpcs 2016-01-29 08:56:36 +00:00
mark_story
3b5a71df37 Merge branch '2.7' into 2.8 2016-01-28 21:51:59 -05:00
mark_story
fc57dee72f Fix error in PHP 5.3 2016-01-28 21:50:56 -05:00
Mark Story
aa449b194d Merge pull request #8125 from CakeDC/issue/7978 
Add support for NOT IN in Model::find() conditions.

Refs #7978 fixing regex to take in account IN operator
 2016-01-28 21:48:04 -05:00
Yevgeny Tomenko
70c4e40532 Fix value check and formatting. 2016-01-28 23:36:07 +03:00
Pedro Fernandes Steimbruch
bf8e6ce576 Refs #7978 fixing code standard 2016-01-28 17:55:19 -02:00
Pedro Fernandes Steimbruch
eaeb7cea9e Refs #7978 fixing regex to take in account IN operator 2016-01-28 17:34:08 -02:00
Yevgeny Tomenko
e83a532af0 Fixed array syntax. 2016-01-28 22:12:24 +03:00
Yevgeny Tomenko
06853a137a Merge remote-tracking branch 'remotes/origin/2.8' into feature/uuid 2016-01-28 22:08:10 +03:00
Yevgeny Tomenko
209cdd71a9 code formatting fixes 2016-01-28 21:54:49 +03:00
Yevgeny Tomenko
296f698db3 Added test cases covering native uuid field usage for Postgres class 2016-01-28 21:13:33 +03:00
mark_story
3e67685c7c Merge branch '2.7' into 2.8 2016-01-21 21:46:51 -05:00
mark_story
4b8d628a2e Backport SecurityComponent fixes from #8071 to 2.x 
If the request manages to have data set outside of post/put we should
still validate the request body. This expands SecurityComponent to cover
PATCH and DELETE methods, as well as request methods that should be
safe, but somehow end up not safe.
 2016-01-20 21:34:58 -05:00
mark_story
91109c33b2 Merge branch '2.7' into 2.8 2016-01-19 21:15:08 -05:00
José Lorenzo Rodríguez
835fc9ce01 More CS fixes 2016-01-19 13:52:16 -04:30
José Lorenzo Rodríguez
2962b387d7 Fixed CS error 2016-01-19 11:17:06 -04:30
mark_story
57f620fc22 Make the session cacheLimiter a configuration option. 
Instead of hardcoding to must-revalidate, developers can use a more
suitable option if they do not have to support IE8.

Refs #7096
 2016-01-18 22:18:38 -05:00
Jose Lorenzo Rodriguez
bd53ef01a6 Better method overriding emulation for GET 2016-01-18 20:34:32 -04:30
Seth Tanner
e75858d342 refs #7929 update uuid test 2016-01-15 12:15:59 -08:00
mark_story
d773644232 Merge branch '2.7' into 2.8 2016-01-12 22:14:16 -05:00