tonyair/silverstripe-cms
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-cms synced 2024-10-22 08:05:56 +02:00
Code Issues Projects Releases Wiki Activity

FIX Do now allow arbitary class creation in CMS

Browse Source
This commit is contained in:
Stephen Shkardoon 2014-03-19 19:26:18 +13:00
parent b6194c304d
commit bf9b22fd43
2 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
code/controllers/CMSMain.php
View File

@ -865,8 +865,17 @@ class CMSMain extends LeftAndMain implements CurrentPageIdentifier, PermissionPr
* @uses LeftAndMainExtension->augmentNewSiteTreeItem()
*/
public function getNewItem($id, $setID = true) {
$parentClass = $this->stat('tree_class');
list($dummy, $className, $parentID, $suffix) = array_pad(explode('-',$id),4,null);
if(!is_subclass_of($className, $parentClass) && strcasecmp($className, $parentClass) != 0) {
$response = Security::permissionFailure($this);
if (!$response) {
$response = $this->response;
}
throw new SS_HTTPResponse_Exception($response);
}
$newItem = new $className();
if( !$suffix ) {

23
tests/controller/CMSMainTest.php
View File

@ -284,6 +284,27 @@ class CMSMainTest extends FunctionalTest {
$this->session()->inst_set('loggedInAs', null);
}
public function testGetNewItem() {
$controller = new CMSMain();
$id = 'new-Page-0';
// Test success
$page = $controller->getNewItem($id, false);
$this->assertEquals($page->Title, 'New Page');
$this->assertNotEquals($page->Sort, 0);
$this->assertInstanceOf('Page', $page);
// Test failure
try {
$id = 'new-Member-0';
$member = $controller->getNewItem($id, false);
$this->fail('Should not be able to create a Member object');
} catch (SS_HTTPResponse_Exception $e) {
$this->assertEquals($controller->getResponse()->getStatusCode(), 302);
}
}
}
class CMSMainTest_ClassA extends Page implements TestOnly {
@ -292,4 +313,4 @@ class CMSMainTest_ClassA extends Page implements TestOnly {
class CMSMainTest_ClassB extends Page implements TestOnly {
}
}