Commit graph

549 commits

Author SHA1 Message Date
Mark Story
3bf93b7f76
Merge pull request #11526 from cakephp/post-conditions
Make postConditions() less permissive.
2017-12-15 14:36:38 -05:00
mark_story
340059be15 Check model names for bad characters as well. 2017-12-13 00:01:09 -05:00
mark_story
a9618f67f7 Use a permitted list instead of a ban list.
This should be safer as we are more confident on what is coming in.
2017-12-13 00:01:05 -05:00
mark_story
f66dec8a96 Make postConditions() less permissive.
We were notified by `ooooooo_q` that postConditions() is vulnerable to
SQL injection if used without SecurityComponent tampering prevention.

This change attempts to make postConditions() safer by exploding in
unsafe scenarios.
2017-12-10 21:44:47 -05:00
db-bogdan
e824346cca extra fix 2017-11-28 11:43:55 +02:00
db-bogdan
94e06dfeb3 add unit test 2017-11-28 11:31:46 +02:00
chinpei215
19bbb7da17 Simplify CookieComponent::read()
Also, this commit fixes an issue of when the second level key is empty.
Previously, read('foo.0') returned incorrect result.
2017-10-16 21:01:19 +09:00
chinpei215
bbea91090d Fix CookieComponent::delete() not working for deep children 2017-10-16 20:55:00 +09:00
chinpei215
959f45a6c6 Fix fatal error thrown when replacing scalar with array
Refs #11280
2017-10-06 13:43:32 +09:00
Jeremy Harris
f9f06e68b1
Stacking messages in SessionComponent::setFlash 2017-08-30 10:06:56 -05:00
mark_story
aa6770fa45 Merge branch '2.x' into 2.next 2017-07-22 14:59:41 -04:00
Val Bancer
85e0ebd7fd more unit tests added 2017-07-05 23:22:58 +02:00
Val Bancer
50334679d6 added a unit test 2017-07-05 22:40:41 +02:00
Val Bancer
31fd4217b1 more PaginatorComponent unit tests 2017-07-04 23:01:17 +02:00
mark_story
aaa37fa809 Merge branch '2.next' of github.com:cakephp/cakephp into 2.next 2017-06-26 21:51:55 -04:00
mark_story
2032fef772 Merge branch '2.x' into 2.next 2017-06-26 21:51:41 -04:00
Mark Story
52790443e8 Merge pull request #9705 from CakeDC/feature/backport-paginate-multiple-queries
2.next - Backport multiple paginators
2017-06-14 21:41:13 -04:00
Mark Story
8289b367f9 Merge pull request #10698 from lucasferreira/2.next
Cake 2.x - Some fix into Paginator component for order / sort classic sintax
2017-06-14 00:13:00 -04:00
Marc Würth
da8414e13b Use HTTPS for the opensource.org MIT license URL 2017-06-11 00:23:22 +02:00
Marc Würth
04efc7ba50 Use HTTPS for the book.cakephp.org URL 2017-06-11 00:15:36 +02:00
Marc Würth
10b89b51a9 Use HTTPS for the cakefoundation.org URL 2017-06-11 00:10:59 +02:00
Marc Würth
17314baa15 Use HTTPS for the cakephp.org URL 2017-06-10 23:40:28 +02:00
Lucas Ferreira
3258199193 Remove personal comments for pull request 2017-05-31 08:33:41 -03:00
mark_story
cf679a3233 Merge branch '2.x' into 2.next 2017-05-27 21:47:22 -04:00
Lucas Ferreira
ee1980b8f5 - Tests for array order syntax fix 2017-05-26 18:36:50 -03:00
chinpei215
a97bd234ee Fix _validatePost returns true when empty form is submitted
Backport of #10625
2017-05-06 21:59:29 +09:00
mark_story
5e35064a0b Read basic auth credentials from Authorization header
Merge branch 'issue-9365' into 2.x

Refs #9365
2017-04-28 21:49:47 -04:00
mark_story
275385d676 Add test covering basic auth reading from headers.
In some FastCGI setups basic auth values will only be present in the
header. Fallback to reading that value if the PHP_AUTH super globals are
empty.

Refs #9365
2017-04-28 21:49:27 -04:00
chinpei215
31a1837c1d Merge branch '2.x' into 2.next
Conflicts:
	lib/Cake/Test/Case/View/Helper/FlashHelperTest.php
	lib/Cake/VERSION.txt
	lib/Cake/View/Helper/FlashHelper.php
2017-03-25 17:12:28 +09:00
mark_story
ccc9006620 Unset the active user data on logout.
When using stateless authentication the current user should be cleared
after logout to maintain consistency with session based authentication.

Refs #10422
2017-03-16 11:31:20 -04:00
mark_story
837741db66 Merge branch '2.x' into 2.next 2016-12-13 22:48:44 -05:00
Mark Story
420336f536 Merge pull request #9843 from cakephp/php71
Add PHP7.1 to test matrix.
2016-12-07 21:40:54 -05:00
mark_story
12cdc247ac Fix PHPCS errors. 2016-12-07 00:38:55 -05:00
mark_story
0a2a400ea4 Fix type error tests to work in PHP5 & PHP7.1
Catch the TypeErrors that are raised and make the match the PHP5
behavior of a converted error.
2016-12-06 21:21:52 -05:00
Mark Story
9e6e08704e Merge pull request #9838 from cakephp/issue-9779
Fix CookieComponent erroring on corrupted data.
2016-12-05 16:44:24 -05:00
mark_story
e3221b1c38 Fix errors in php7.1
* The constructor of errors has changed in PHP 7.1
* mcrypt is no longer available in PHP 7.1 by default.
2016-12-05 16:14:33 -05:00
chinpei215
26731b93bf Use ternary operator 2016-12-04 21:55:29 +09:00
chinpei215
b7481096c8 Fix redirectUrl issue when loginRedirect is empty
Fixes #9819
2016-12-04 20:06:24 +09:00
mark_story
934bb00b36 Add tests showing recent changes fix #9784 2016-12-03 14:14:57 -05:00
mark_story
27f951fb41 Don't emit errors when operating on corrupted cookie data.
When deleting from corrupted cookie data, there shouldn't be any errors.

Refs #9779
2016-12-03 14:10:47 -05:00
chinpei215
74c2ded872 Fix directory traversal of .ctp files 2016-11-27 18:14:44 +09:00
mark_story
c0150f62ed Merge branch '2.x' into 2.next 2016-11-06 21:42:31 -05:00
Rodrigo Pérez
20da4484de refs #backport-paginate-multiple-queries Backporting cakephp 3.3 feature to paginate multiple queries 2016-11-04 11:10:28 +00:00
xhs345
e1c5ef9e7a Add clear option to Flash Message
To give user the option to disable Stacking of messages and being consistent with 3.x
2016-10-30 20:39:00 -07:00
Val Bancer
744b455de1 fixed configuration of 'enabled' setting in components inside a
component
2016-10-28 22:14:20 +02:00
xhs345
924d382bb3 Fix tests 2016-10-28 09:10:01 -07:00
xhs345
c59fb85da8 Add support for stacking Flash messages
See Issue #7830
2016-10-28 09:10:01 -07:00
chinpei215
3102d89313 Fix a test for PHP5.3 2016-10-16 22:40:27 +09:00
chinpei215
739664d6c7 Add more tests 2016-10-16 22:28:28 +09:00
chinpei215
d7ae1c92e7 Backport test cases and make sure those pass 2016-10-16 22:04:24 +09:00