Commit graph

703 commits

Author SHA1 Message Date
mark_story
99af4bba83 Merge branch 'domingues-2x' into 2.x
Refs #9870
2016-12-13 22:48:12 -05:00
mark_story
3c44ddd10b Add tests for #9870 2016-12-13 22:47:57 -05:00
Mark Story
4a4c83c3e9 Merge pull request #9859 from cakephp/debugger-encoding
2.x - Debugger encoding
2016-12-13 19:26:52 -05:00
mark_story
ee7739a3bf Try another approach to get the same error in all php versions. 2016-12-13 00:46:13 -05:00
mark_story
69afeb08af Skip error encoding test in PHP5.3
Index errors work funny in PHP5.3, which makes testing them not work
like other versions of PHP.
2016-12-12 21:28:20 -05:00
mark_story
edfda47cf4 Fix missing HTML encoding in Debugger
Fix missing HTML encoding when error messages contain HTML. This can
happen when user data is used as an offset in an array in an unchecked
way.

Thanks to Teppei Fukuda for reporting this issue via the responsible
security disclosure process.
2016-12-10 08:47:13 -05:00
mark_story
e3221b1c38 Fix errors in php7.1
* The constructor of errors has changed in PHP 7.1
* mcrypt is no longer available in PHP 7.1 by default.
2016-12-05 16:14:33 -05:00
mark_story
e057b5572c Fix PHPCS. 2016-11-21 20:51:12 -05:00
mark_story
71b7d6211b Fix AclNode constructor.
It should forward the settings from ClassRegistry::init() so that
aliases can be customized as needed.

Refs #9766
2016-11-19 22:30:18 -04:00
mark_story
66363e6bea Add tests for #9766
I'm not able to reproduce incorrect aliases coming out of ClassRegistry.
As reported.
2016-11-19 10:02:09 -04:00
mark_story
c935bed8f6 Fix PHPCS 2016-10-21 18:35:05 -04:00
mark_story
816801902e Allow '' to be a valid key for Hash, and Session
By removing a bunch of empty() guards we can make '' behave like all the
other key names. This does change the existing behavior/tests around ''
key, but I think that is ok given the need to manipulate ''.

Refs #9632
2016-10-21 10:54:39 -04:00
mark_story
e8d63725d8 Merge branch '2.x' into 2.next 2016-09-04 23:54:22 -04:00
mark_story
2ffde69d5b Skip test that always fails on PHP5.3 2016-08-29 21:56:30 -04:00
mark_story
d1cfe203c4 Fix PHPCS error. 2016-08-29 21:53:47 -04:00
Mark Story
51963ab8fc Merge pull request #9349 from cakephp/2.x-sort-locale
2.x sort locale backport
2016-08-26 11:13:21 -04:00
Mark Sch
ee319baec1 Backport skip 2016-08-26 16:15:39 +02:00
mscherer
03df288e78 Re-add spacing. 2016-08-26 14:45:59 +02:00
mscherer
dab4b85596 Backport Hash::sort() support for type locale. 2016-08-26 14:32:21 +02:00
ndm2
87d86aaed9 Fix/tighten Folder::inPath() checks.
The current checks are way too relaxed, and are more like testing
for a substring, which makes it easy for invalid paths to slip
trough, for example `/foo/var/www` is falsely tested to reside in
`/var/www`.

Passing an empty path never worked properly, it was triggering a
warning, didn't worked on Windows, and the behavior that the current
top level directory would be assumed for empty paths wasn't
documented.

Similar is true for relative paths. While they did match at one point,
this was incorrect behavior, and matching actual path fragments seems
out of scope for this method.

This change makes the `$path` argument required, requires it to be an
absolute path, and throws an exception in case a non-absolute path is
being passed.
2016-08-26 13:45:45 +02:00
Marc Würth
f2638b3e38 Remove superfluous "Class" from doc blocks 2016-08-10 12:22:09 +02:00
mark_story
61b3fbd605 Merge branch '2.x' into 2.next 2016-08-09 22:12:26 -04:00
mark_story
234f732d6d Attempt to get tests passing on travis.
Also attempt to get stickler to ignore the 2.x branch.
2016-07-01 17:52:02 -04:00
mark_story
d816ea6e16 Add test showing that niceShort translates month names.
Refs #8968
2016-07-01 17:51:23 -04:00
mark_story
432eb9c432 Merge branch '2.x' into 2.next 2016-06-27 21:47:47 -04:00
Steampilot
723ed96fd6 Added sorting by modified time in Folder util 2016-05-12 16:28:04 +02:00
mark_story
12c6fd4e22 Merge branch '2.x' into 2.next 2016-05-02 21:58:41 -04:00
Philippe Saint-Just
c2f028ab49 Fix spacing 2016-04-30 13:13:14 -04:00
Philippe Saint-Just
cd07850337 Merge branch 'backport-8741-8690' into 2.x 2016-04-30 13:11:34 -04:00
mark_story
8b5023282e Randomly generate a salt when the salt is '' or null.
To prevent an issue where any value is accepted as a password when '' is
provided as the hashed password.

Refs #8650
2016-04-15 21:49:17 -04:00
mscherer
dda9e83ab6 Refactor Object to CakeObject for future PHP7 comp. 2016-04-08 14:33:26 +02:00
mark_story
84fc9498b5 Allow N11 exchange numbers as valid.
The previous code and commit (fa3d4a0bb5)
were incorrect about invalid exchange numbers as 1-800-211-4511 is
a real phone number.

I've also removed a duplicate alternation pattern.

Refs #8567
2016-03-31 22:38:16 -04:00
mark_story
1926d40d40 Fix possibility for spoofed files to pass validation.
Use `is_uploaded_file` to prevent crafty requests that contain bogus
files from getting through. A testing stub class was necessary to avoid
making significant changes to the test suite.
2016-03-28 22:10:36 -04:00
mark_story
7df99fff1f Backport Security::randomBytes() to 2.x
I decided to leave the warning in. People who can't upgrade their
applications should at least be aware of the risks they are taking.

I'm flexible if people are strongly opposed to a warning, but I feel
that these kinds of warnings can be supressed in production if they
really are in a jam and don't care.

Refs #8282
2016-02-22 00:14:44 -05:00
mark_story
e4b939bba0 Backport fix for Validation::uploadedFile to 2.x
Don't fail validation when the keys are not the expected order.

Refs #8201
2016-02-08 22:37:25 -05:00
mark_story
b5e64bbad5 Merge branch '2.7' into 2.8 2015-12-24 16:20:27 -05:00
mark_story
7d052bdbc1 Backport 5714cf14a9ca4b439b872aaf3ad6e5bfddda46ad to 2.x
Fix file:// paths being mishandled on windows.

While I don't think its feasible to fix all the cases reported in #7275
as certain paths have different meaning in windows, we can fix file://
not working.

Refs #7275
2015-12-24 16:19:57 -05:00
mark_story
37fe25909f Merge branch '2.7' into 2.8 2015-12-20 21:59:43 -05:00
Yasushi Ichikawa
5b098af240 remove extract function in the Validation::comparison 2015-11-29 22:42:55 +09:00
mark_story
48450e71fa Merge branch '2.7' into 2.8 2015-11-11 22:53:45 -05:00
Jose Lorenzo Rodriguez
18544c5aaa Fix validation allowing arrays.
Accepting arrays can cause a number of adverse effects. While this may
be a breaking change the alternatives are worse.
2015-11-04 21:35:05 -05:00
mark_story
bc977544c5 Use a more stable timezone.
Regina does not observe DST meaning this test won't fail twice a year.
2015-10-26 22:28:00 -04:00
vanquang9387
0cdfed0aee Add more test on UploadedFileSize validation 2015-10-20 09:00:32 +07:00
vanquang9387
af8c992655 2.x uploadedFile validation (backported from #4524) 2015-10-19 15:15:28 +07:00
mark_story
a6a699b4b9 Merge branch '2.7' into 2.8 2015-09-28 21:17:45 -04:00
mark_story
13f147940f Correct inflection of virus.
Instead of viri, it should be viruses.

Refs #7466
2015-09-28 21:04:23 -04:00
mark_story
8a57d78dba Merge branch '2.7' into 2.8 2015-09-27 11:12:55 -04:00
Marc Würth
1ede742d92 Various improvements to the CakePHP test files
Mostly CS, doc blocks and unused variables.
2015-09-25 17:22:00 +02:00
mark_story
9b910dff31 Merge branch '2.8-hash-sort-ignore-case' into 2.8
Refs #7217
2015-08-25 21:46:08 -04:00
mark_story
a9ef1f8aea Simplify branching and add default options.
Use fewer conditionals by merging defaults and avoid exceptions
by setting defaults as well.

Refs #7217
2015-08-25 21:39:02 -04:00