diff --git a/admin/code/LeftAndMain.php b/admin/code/LeftAndMain.php index 40198e6c4..5e379f327 100644 --- a/admin/code/LeftAndMain.php +++ b/admin/code/LeftAndMain.php @@ -449,6 +449,9 @@ class LeftAndMain extends Controller implements PermissionProvider { $title = $this->Title(); if(!$response->getHeader('X-Controller')) $response->addHeader('X-Controller', $this->class); if(!$response->getHeader('X-Title')) $response->addHeader('X-Title', urlencode($title)); + + // Prevent clickjacking, see https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options + $this->response->addHeader('X-Frame-Options', 'SAMEORIGIN'); return $response; } diff --git a/admin/templates/CMSBreadcrumbs.ss b/admin/templates/CMSBreadcrumbs.ss index 9ef793482..e0d9f13e5 100644 --- a/admin/templates/CMSBreadcrumbs.ss +++ b/admin/templates/CMSBreadcrumbs.ss @@ -1,15 +1,15 @@

- <% if ToplevelController %> + <% if $ToplevelController %> - <% else_if Controller %> + <% else_if $Controller %> <% else %> <% end_if %> - <% loop Breadcrumbs %> - <% if Last %> + <% loop $Breadcrumbs %> + <% if $Last %> $Title.XML <% else %> $Title.XML diff --git a/admin/templates/CMSProfileController_Content.ss b/admin/templates/CMSProfileController_Content.ss index 1def543a3..d7675888e 100644 --- a/admin/templates/CMSProfileController_Content.ss +++ b/admin/templates/CMSProfileController_Content.ss @@ -1,18 +1,18 @@
- <% with EditForm %> + <% with $EditForm %>
- <% with Controller %> + <% with $Controller %> <% include CMSBreadcrumbs %> <% end_with %>
- <% if Fields.hasTabset %> - <% with Fields.fieldByName('Root') %> + <% if $Fields.hasTabset %> + <% with $Fields.fieldByName('Root') %>
    - <% loop Tabs %> - class="$extraClass"<% end_if %>>$Title + <% loop $Tabs %> + class="$extraClass"<% end_if %>>$Title <% end_loop %>
diff --git a/admin/templates/CMSTabSet.ss b/admin/templates/CMSTabSet.ss index 7a64cfe6f..4e232624c 100644 --- a/admin/templates/CMSTabSet.ss +++ b/admin/templates/CMSTabSet.ss @@ -5,12 +5,12 @@ <%-- e.g. through LeftAndMain_EditForm.ss. --%>
- <% loop Tabs %> - <% if Tabs %> + <% loop $Tabs %> + <% if $Tabs %> $FieldHolder <% else %>
- <% loop Fields %> + <% loop $Fields %> $FieldHolder <% end_loop %>
diff --git a/admin/templates/Includes/BackLink_Button.ss b/admin/templates/Includes/BackLink_Button.ss index cdca8ff0e..d6217a98f 100644 --- a/admin/templates/Includes/BackLink_Button.ss +++ b/admin/templates/Includes/BackLink_Button.ss @@ -1,7 +1,7 @@ -<% if Backlink %> +<% if $Backlink %>
<% _t('BackLink_Button.ss.Back', 'Back') %>
-<% end_if %> \ No newline at end of file +<% end_if %> diff --git a/admin/templates/Includes/CMSSectionIcon.ss b/admin/templates/Includes/CMSSectionIcon.ss index 7402c7f9d..463981c54 100644 --- a/admin/templates/Includes/CMSSectionIcon.ss +++ b/admin/templates/Includes/CMSSectionIcon.ss @@ -1,7 +1,7 @@ -<% if ToplevelController %> +<% if $ToplevelController %> -<% else_if Controller %> +<% else_if $Controller %> <% else %> -<% end_if %> \ No newline at end of file +<% end_if %> diff --git a/admin/templates/Includes/Editor_toolbar.ss b/admin/templates/Includes/Editor_toolbar.ss index 773877982..6a5be7c28 100644 --- a/admin/templates/Includes/Editor_toolbar.ss +++ b/admin/templates/Includes/Editor_toolbar.ss @@ -1,20 +1,20 @@ -<% with EditorToolbar %> +<% with $EditorToolbar %>
- <% loop Fields %> + <% loop $Fields %> <% end_loop %> diff --git a/templates/Includes/GridFieldFooter.ss b/templates/Includes/GridFieldFooter.ss index f4b47d73d..c464d936c 100644 --- a/templates/Includes/GridFieldFooter.ss +++ b/templates/Includes/GridFieldFooter.ss @@ -7,8 +7,8 @@ $NumRecords - <% if Message %> + <% if $Message %>
$Message
<% end_if %> - \ No newline at end of file + diff --git a/templates/Includes/GridFieldItemEditView.ss b/templates/Includes/GridFieldItemEditView.ss index 8a6a025b8..20b780413 100644 --- a/templates/Includes/GridFieldItemEditView.ss +++ b/templates/Includes/GridFieldItemEditView.ss @@ -1,5 +1,5 @@ -<% if Backlink %> +<% if $Backlink %> <% _t('Go back', 'Go back' ) %> <% end_if %> -$ItemEditForm \ No newline at end of file +$ItemEditForm diff --git a/templates/Includes/GridFieldSortableHeader_Row.ss b/templates/Includes/GridFieldSortableHeader_Row.ss index 0197407b7..2b12b728a 100644 --- a/templates/Includes/GridFieldSortableHeader_Row.ss +++ b/templates/Includes/GridFieldSortableHeader_Row.ss @@ -1,5 +1,5 @@ - <% loop Fields %> + <% loop $Fields %> <% end_loop %> diff --git a/templates/Includes/GridFieldToolbarHeader.ss b/templates/Includes/GridFieldToolbarHeader.ss index 27aabb79a..6c94910a3 100644 --- a/templates/Includes/GridFieldToolbarHeader.ss +++ b/templates/Includes/GridFieldToolbarHeader.ss @@ -1,7 +1,7 @@ - \ No newline at end of file + diff --git a/templates/Includes/GridField_FormAction.ss b/templates/Includes/GridField_FormAction.ss index 90e1cf96c..039f1fd34 100644 --- a/templates/Includes/GridField_FormAction.ss +++ b/templates/Includes/GridField_FormAction.ss @@ -1,3 +1,3 @@ \ No newline at end of file + <% if $ButtonContent %>$ButtonContent<% else %>$Title<% end_if %> + diff --git a/templates/Includes/GridField_Item.ss b/templates/Includes/GridField_Item.ss index 2128f53af..ed5a5fe15 100644 --- a/templates/Includes/GridField_Item.ss +++ b/templates/Includes/GridField_Item.ss @@ -1,11 +1,11 @@ <% if $GridField.ExtraColumnsCount %> - <% loop Fields %> + <% loop $Fields %> <% end_loop %> <% else %> - <% loop Fields %> + <% loop $Fields %> <% end_loop %> <% end_if %> diff --git a/templates/Includes/GridField_print.ss b/templates/Includes/GridField_print.ss index 8595007fd..be23e8bba 100644 --- a/templates/Includes/GridField_print.ss +++ b/templates/Includes/GridField_print.ss @@ -7,12 +7,12 @@ <% if $Title %>

$Title

<% end_if %>
-<% loop Buttons %> - <% if Type = button %> +<% loop $Buttons %> + <% if $Type = button %> $Title - <% else_if Type = dropdown %> + <% else_if $Type = dropdown %> - <% else_if Type = separator %> + <% else_if $Type = separator %> | - <% else_if Type = break %> + <% else_if $Type = break %>
<% end_if %> <% end_loop %> diff --git a/admin/templates/Includes/LeftAndMain_EditForm.ss b/admin/templates/Includes/LeftAndMain_EditForm.ss index 1274f741e..3de5007ec 100644 --- a/admin/templates/Includes/LeftAndMain_EditForm.ss +++ b/admin/templates/Includes/LeftAndMain_EditForm.ss @@ -1,19 +1,19 @@ -<% if IncludeFormTag %> +<% if $IncludeFormTag %>
<% end_if %>
<% include BackLink_Button %> - <% with Controller %> + <% with $Controller %> <% include CMSBreadcrumbs %> <% end_with %>
- <% if Fields.hasTabset %> - <% with Fields.fieldByName('Root') %> + <% if $Fields.hasTabset %> + <% with $Fields.fieldByName('Root') %>
    - <% loop Tabs %> - class="$extraClass"<% end_if %>>$Title + <% loop $Tabs %> + class="$extraClass"<% end_if %>>$Title <% end_loop %>
@@ -23,20 +23,20 @@
- <% with Controller %> + <% with $Controller %> $EditFormTools <% end_with %>
- <% if Message %> + <% if $Message %>

$Message

<% else %> <% end_if %>
- <% if Legend %>$Legend<% end_if %> - <% loop Fields %> + <% if $Legend %>$Legend<% end_if %> + <% loop $Fields %> $FieldHolder <% end_loop %>
@@ -44,12 +44,12 @@
- <% if Actions %> + <% if $Actions %>
- <% loop Actions %> + <% loop $Actions %> $Field <% end_loop %> - <% if Controller.LinkPreview %> + <% if $Controller.LinkPreview %> <% _t('LeftAndMain.PreviewButton', 'Preview') %> » @@ -57,6 +57,6 @@
<% end_if %>
-<% if IncludeFormTag %> +<% if $IncludeFormTag %>
<% end_if %> diff --git a/admin/templates/Includes/LeftAndMain_Menu.ss b/admin/templates/Includes/LeftAndMain_Menu.ss index ce11e587e..1f1da0c03 100644 --- a/admin/templates/Includes/LeftAndMain_Menu.ss +++ b/admin/templates/Includes/LeftAndMain_Menu.ss @@ -2,18 +2,18 @@
$Field
- <% if Title %>

$Title

<% end_if %> + <% if $Title %>

$Title

<% end_if %>
\$DefineFragment(toolbar-header-right)
\$DefineFragment(toolbar-header-left)
$Valueclass="ss-gridfield-{$FirstLast}"<% end_if %>>$Value
- <% loop Header %><% end_loop %> + <% loop $Header %><% end_loop %> - <% if ItemRows %> - <% loop ItemRows %> - <% loop ItemRow %><% end_loop %> + <% if $ItemRows %> + <% loop $ItemRows %> + <% loop $ItemRow %><% end_loop %> <% end_loop %> <% else %> diff --git a/templates/Includes/HtmlEditorField_viewfile.ss b/templates/Includes/HtmlEditorField_viewfile.ss index a2bf9f7c2..997fa0e46 100644 --- a/templates/Includes/HtmlEditorField_viewfile.ss +++ b/templates/Includes/HtmlEditorField_viewfile.ss @@ -38,10 +38,10 @@ - <% if Info %>
$Info
<% end_if %> + <% if $Info %>
$Info
<% end_if %>
- <% loop Fields %> + <% loop $Fields %> $FieldHolder <% end_loop %>
diff --git a/templates/Includes/UploadField_FileButtons.ss b/templates/Includes/UploadField_FileButtons.ss index 1f0e920c7..1c14f0823 100644 --- a/templates/Includes/UploadField_FileButtons.ss +++ b/templates/Includes/UploadField_FileButtons.ss @@ -1,4 +1,4 @@ -<% if canEdit %> +<% if $canEdit %> -<% if canDelete %> +<% if $canDelete %> <% end_if %> -<% if UploadField.canAttachExisting %> +<% if $UploadField.canAttachExisting %> <% end_if %> diff --git a/templates/RSSFeed.ss b/templates/RSSFeed.ss index 45bcab748..f4bc1ff97 100644 --- a/templates/RSSFeed.ss +++ b/templates/RSSFeed.ss @@ -6,14 +6,14 @@ $Description.XML - <% loop Entries %> + <% loop $Entries %> $Title.XML $AbsoluteLink - <% if Description %>$Description.AbsoluteLinks.XML<% end_if %> - <% if Date %>$Date.Rfc822 + <% if $Description %>$Description.AbsoluteLinks.XML<% end_if %> + <% if $Date %>$Date.Rfc822 <% else %>$Created.Rfc822<% end_if %> - <% if Author %>$Author.XML<% end_if %> + <% if $Author %>$Author.XML<% end_if %> $AbsoluteLink <% end_loop %> diff --git a/templates/RightLabelledFieldHolder.ss b/templates/RightLabelledFieldHolder.ss index f20e1ccaf..574ab26d4 100644 --- a/templates/RightLabelledFieldHolder.ss +++ b/templates/RightLabelledFieldHolder.ss @@ -1,5 +1,5 @@

$Field - <% if Message %>$Message<% end_if %> -

\ No newline at end of file + <% if $Message %>$Message<% end_if %> +

diff --git a/templates/SearchForm.ss b/templates/SearchForm.ss index c6a525d1e..8b4c9c148 100644 --- a/templates/SearchForm.ss +++ b/templates/SearchForm.ss @@ -1,15 +1,15 @@
- <% if Message %> + <% if $Message %>

$Message

<% else %> <% end_if %>
- <% loop Fields %> - $FieldHolder + <% loop $Fields %> + $FieldHolder <% end_loop %> - <% loop Actions %> - $Field + <% loop $Actions %> + $Field <% end_loop %>
diff --git a/templates/UploadField.ss b/templates/UploadField.ss index 9f9af1e87..ecf70ee30 100644 --- a/templates/UploadField.ss +++ b/templates/UploadField.ss @@ -13,7 +13,7 @@
- <% if Top.isActive %> + <% if $Top.isActive %> $UploadFieldFileButtons <% end_if %>
@@ -25,7 +25,7 @@ <% end_loop %> <% end_if %> -<% if canUpload || canAttachExisting %> +<% if $canUpload || $canAttachExisting %>
<% if canUpload %>
@@ -43,21 +43,21 @@ <% else %> <% _t('UploadField.ATTACHFILE', 'Attach a file') %> <% end_if %> - <% if canPreviewFolder %> + <% if $canPreviewFolder %> (<%t UploadField.UPLOADSINTO 'saves into /{path}' path=$FolderName %>) <% end_if %> - <% if canUpload %> + <% if $canUpload %> <% end_if %> - <% if canAttachExisting %> + <% if $canAttachExisting %> <% end_if %> - <% if canUpload %> + <% if $canUpload %> <% if not $autoUpload %> <% end_if %> diff --git a/templates/forms/CheckboxField_holder.ss b/templates/forms/CheckboxField_holder.ss index c60045ebf..1e116aac2 100644 --- a/templates/forms/CheckboxField_holder.ss +++ b/templates/forms/CheckboxField_holder.ss @@ -1,6 +1,6 @@
$Field - <% if Message %>$Message<% end_if %> - <% if Description %>$Description<% end_if %> + <% if $Message %>$Message<% end_if %> + <% if $Description %>$Description<% end_if %>
diff --git a/templates/forms/CheckboxField_holder_small.ss b/templates/forms/CheckboxField_holder_small.ss index 511dbb1be..a4f8d4423 100644 --- a/templates/forms/CheckboxField_holder_small.ss +++ b/templates/forms/CheckboxField_holder_small.ss @@ -1,5 +1,5 @@ $Field <% if $Title %> - -<% end_if %> \ No newline at end of file + +<% end_if %> diff --git a/templates/forms/CheckboxSetField.ss b/templates/forms/CheckboxSetField.ss index b3090925b..0826cdc17 100644 --- a/templates/forms/CheckboxSetField.ss +++ b/templates/forms/CheckboxSetField.ss @@ -1,8 +1,8 @@
    - <% if Options.Count %> - <% loop Options %> + <% if $Options.Count %> + <% loop $Options %>
  • - checked="checked"<% end_if %><% if isDisabled %> disabled="disabled"<% end_if %> /> + checked="checked"<% end_if %><% if $isDisabled %> disabled="disabled"<% end_if %> />
    • <% end_loop %> diff --git a/templates/forms/CompositeField.ss b/templates/forms/CompositeField.ss index 452f1c979..9ab9c820e 100644 --- a/templates/forms/CompositeField.ss +++ b/templates/forms/CompositeField.ss @@ -3,8 +3,8 @@ $Legend <% end_if %> - <% loop FieldList %> - <% if ColumnCount %> + <% loop $FieldList %> + <% if $ColumnCount %>
    $Field
    @@ -12,4 +12,4 @@ $Field <% end_if %> <% end_loop %> - \ No newline at end of file + diff --git a/templates/forms/CompositeField_holder.ss b/templates/forms/CompositeField_holder.ss index 83f015f0b..bb3042350 100644 --- a/templates/forms/CompositeField_holder.ss +++ b/templates/forms/CompositeField_holder.ss @@ -3,8 +3,8 @@ $Legend <% end_if %> - <% loop FieldList %> - <% if ColumnCount %> + <% loop $FieldList %> + <% if $ColumnCount %>
    $FieldHolder
    @@ -13,5 +13,5 @@ <% end_if %> <% end_loop %> - <% if Description %>$Description<% end_if %> - \ No newline at end of file + <% if $Description %>$Description<% end_if %> + diff --git a/templates/forms/DropdownField.ss b/templates/forms/DropdownField.ss index 00d654e82..5d5c24d04 100644 --- a/templates/forms/DropdownField.ss +++ b/templates/forms/DropdownField.ss @@ -1,5 +1,5 @@ diff --git a/templates/forms/FieldGroup.ss b/templates/forms/FieldGroup.ss index 21fd1aa43..c9b6eb94a 100644 --- a/templates/forms/FieldGroup.ss +++ b/templates/forms/FieldGroup.ss @@ -1,7 +1,7 @@ -
    id="$ID"<% end_if %>> - <% loop FieldList %> +
    id="$ID"<% end_if %>> + <% loop $FieldList %>
    $SmallFieldHolder
    <% end_loop %> -
    \ No newline at end of file +
    diff --git a/templates/forms/FieldGroup_DefaultFieldHolder.ss b/templates/forms/FieldGroup_DefaultFieldHolder.ss index cb9478322..5a1558e69 100644 --- a/templates/forms/FieldGroup_DefaultFieldHolder.ss +++ b/templates/forms/FieldGroup_DefaultFieldHolder.ss @@ -1,7 +1,7 @@ -
    id="$ID"<% end_if %>> - <% loop FieldList %> +
    id="$ID"<% end_if %>> + <% loop $FieldList %>
    $FieldHolder
    <% end_loop %> -
    \ No newline at end of file +
    diff --git a/templates/forms/FieldGroup_holder.ss b/templates/forms/FieldGroup_holder.ss index 423baae1c..95ab1a153 100644 --- a/templates/forms/FieldGroup_holder.ss +++ b/templates/forms/FieldGroup_holder.ss @@ -1,13 +1,13 @@ -
    id="$Name"<% end_if %> class="field $Type $extraClass"> - <% if Title %><% end_if %> +
    id="$Name"<% end_if %> class="field $Type $extraClass"> + <% if $Title %><% end_if %>
    - <% loop FieldList %> + <% loop $FieldList %>
    $SmallFieldHolder
    <% end_loop %>
    - <% if RightTitle %><% end_if %> - <% if Message %>$Message<% end_if %> -
    \ No newline at end of file + <% if $RightTitle %><% end_if %> + <% if $Message %>$Message<% end_if %> +
    diff --git a/templates/forms/FormAction.ss b/templates/forms/FormAction.ss index fb5cf21ee..16e61fb1c 100644 --- a/templates/forms/FormAction.ss +++ b/templates/forms/FormAction.ss @@ -1,7 +1,7 @@ -<% if UseButtonTag %> +<% if $UseButtonTag %> <% else %> -<% end_if %> \ No newline at end of file +<% end_if %> diff --git a/templates/forms/FormField.ss b/templates/forms/FormField.ss index 73a06489b..8c763daf1 100644 --- a/templates/forms/FormField.ss +++ b/templates/forms/FormField.ss @@ -1,5 +1,5 @@ -<% if isReadonly %> - class="$extraClass"<% end_if %>> +<% if $isReadonly %> + class="$extraClass"<% end_if %>> $Value <% else %> diff --git a/templates/forms/FormField_holder.ss b/templates/forms/FormField_holder.ss index ae6f5353b..df878d9ac 100644 --- a/templates/forms/FormField_holder.ss +++ b/templates/forms/FormField_holder.ss @@ -1,9 +1,9 @@ -
    - <% if Title %><% end_if %> +
    + <% if $Title %><% end_if %>
    $Field
    - <% if RightTitle %><% end_if %> - <% if Message %>$Message<% end_if %> - <% if Description %>$Description<% end_if %> -
    \ No newline at end of file + <% if $RightTitle %><% end_if %> + <% if $Message %>$Message<% end_if %> + <% if $Description %>$Description<% end_if %> +
    diff --git a/templates/forms/FormField_holder_small.ss b/templates/forms/FormField_holder_small.ss index 4360afac5..101a190c5 100644 --- a/templates/forms/FormField_holder_small.ss +++ b/templates/forms/FormField_holder_small.ss @@ -1,11 +1,11 @@
    <% if $RightTitle %> - + <% else_if $LeftTitle %> - + <% else_if $Title %> - + <% end_if %> $Field -
    \ No newline at end of file +
diff --git a/templates/forms/OptionsetField.ss b/templates/forms/OptionsetField.ss index 273402241..d84d9829e 100644 --- a/templates/forms/OptionsetField.ss +++ b/templates/forms/OptionsetField.ss @@ -1,7 +1,7 @@
    - <% loop Options %> + <% loop $Options %>
  • - checked<% end_if %><% if isDisabled %> disabled<% end_if %> /> + checked<% end_if %><% if $isDisabled %> disabled<% end_if %> />
    • <% end_loop %> diff --git a/templates/forms/SelectionGroup.ss b/templates/forms/SelectionGroup.ss index dccec5d6f..14737897c 100644 --- a/templates/forms/SelectionGroup.ss +++ b/templates/forms/SelectionGroup.ss @@ -1,14 +1,20 @@ -<% if IsReadonly %> +<% if $IsReadonly %>
      - <% loop FieldSet %> - <% if Selected %> - - $RadioLabel - $FieldHolder - + <% loop $FieldSet %> + <% if $Selected %> + + $RadioLabel + $FieldHolder +
    <% end_if %> <% end_loop %> <% else %> -
      <% loop FieldSet %>{$RadioButton}{$RadioLabel}{$FieldHolder}<% end_loop %>
    +
      + <% loop $FieldSet %> + + {$RadioButton}{$RadioLabel}{$FieldHolder} + + <% end_loop %> +
    <% end_if %> diff --git a/templates/forms/TabSet.ss b/templates/forms/TabSet.ss index 9f1535037..3d748954f 100644 --- a/templates/forms/TabSet.ss +++ b/templates/forms/TabSet.ss @@ -1,16 +1,16 @@
      - <% loop Tabs %> + <% loop $Tabs %>
    • $Title
      • <% end_loop %>
    - <% loop Tabs %> - <% if Tabs %> + <% loop $Tabs %> + <% if $Tabs %> $FieldHolder <% else %>
    - <% loop Fields %> + <% loop $Fields %> $FieldHolder <% end_loop %>
    diff --git a/templates/forms/TreeDropdownField.ss b/templates/forms/TreeDropdownField.ss index 10039d587..12c7fbd0e 100644 --- a/templates/forms/TreeDropdownField.ss +++ b/templates/forms/TreeDropdownField.ss @@ -2,7 +2,7 @@ class="TreeDropdownField single<% if extraClass %> $extraClass<% end_if %><% if ShowSearch %> searchable<% end_if %>" data-url-tree="$Link(tree)" data-title="$TitleURLEncoded" - <% if Description %>title="$Description"<% end_if %> - <% if Metadata %>data-metadata="$Metadata"<% end_if %>> + <% if $Description %>title="$Description"<% end_if %> + <% if $Metadata %>data-metadata="$Metadata"<% end_if %>> -
    \ No newline at end of file +
diff --git a/tests/api/RestfulServiceTest.php b/tests/api/RestfulServiceTest.php index a9248db3a..772ccd9ef 100644 --- a/tests/api/RestfulServiceTest.php +++ b/tests/api/RestfulServiceTest.php @@ -172,12 +172,14 @@ class RestfulServiceTest extends SapphireTest { public function testHttpHeaderParseing() { $headers = "content-type: text/html; charset=UTF-8\r\n". "Server: Funky/1.0\r\n". + "X-BB-ExampleMANycaPS: test\r\n". "Set-Cookie: foo=bar\r\n". "Set-Cookie: baz=quux\r\n". "Set-Cookie: bar=foo\r\n"; $expected = array( 'Content-Type' => 'text/html; charset=UTF-8', 'Server' => 'Funky/1.0', + 'X-BB-ExampleMANycaPS' => 'test', 'Set-Cookie' => array( 'foo=bar', 'baz=quux', diff --git a/tests/core/startup/ErrorControlChainTest.php b/tests/core/startup/ErrorControlChainTest.php new file mode 100644 index 000000000..e9c2c8435 --- /dev/null +++ b/tests/core/startup/ErrorControlChainTest.php @@ -0,0 +1,90 @@ +then(function(){ + user_error('This error should be suppressed', E_USER_ERROR); + }) + ->execute(); + + $this->assertTrue($chain->hasErrored()); + } + + function testMultipleErrorSuppression() { + $chain = new ErrorControlChain(); + + $chain + ->then(function(){ + user_error('This error should be suppressed', E_USER_ERROR); + }) + ->thenAlways(function(){ + user_error('This error should also be suppressed', E_USER_ERROR); + }) + ->execute(); + + $this->assertTrue($chain->hasErrored()); + } + + function testExceptionSuppression() { + $chain = new ErrorControlChain(); + + $chain + ->then(function(){ + throw new Exception('This exception should be suppressed'); + }) + ->execute(); + + $this->assertTrue($chain->hasErrored()); + } + + function testMultipleExceptionSuppression() { + $chain = new ErrorControlChain(); + + $chain + ->then(function(){ + throw new Exception('This exception should be suppressed'); + }) + ->thenAlways(function(){ + throw new Exception('This exception should also be suppressed'); + }) + ->execute(); + + $this->assertTrue($chain->hasErrored()); + } + + function testErrorControl() { + $preError = $postError = array('then' => false, 'thenIfErrored' => false, 'thenAlways' => false); + + $chain = new ErrorControlChain(); + + $chain + ->then(function() use (&$preError) { $preError['then'] = true; }) + ->thenIfErrored(function() use (&$preError) { $preError['thenIfErrored'] = true; }) + ->thenAlways(function() use (&$preError) { $preError['thenAlways'] = true; }) + + ->then(function(){ user_error('An error', E_USER_ERROR); }) + + ->then(function() use (&$postError) { $postError['then'] = true; }) + ->thenIfErrored(function() use (&$postError) { $postError['thenIfErrored'] = true; }) + ->thenAlways(function() use (&$postError) { $postError['thenAlways'] = true; }) + + ->execute(); + + $this->assertEquals( + array('then' => true, 'thenIfErrored' => false, 'thenAlways' => true), + $preError, + 'Then and thenAlways callbacks called before error, thenIfErrored callback not called' + ); + + $this->assertEquals( + array('then' => false, 'thenIfErrored' => true, 'thenAlways' => true), + $postError, + 'thenIfErrored and thenAlways callbacks called after error, then callback not called' + ); + } + +} \ No newline at end of file diff --git a/tests/forms/uploadfield/UploadFieldTest.php b/tests/forms/uploadfield/UploadFieldTest.php index 9fe415b45..f09975d0e 100644 --- a/tests/forms/uploadfield/UploadFieldTest.php +++ b/tests/forms/uploadfield/UploadFieldTest.php @@ -153,6 +153,33 @@ class UploadFieldTest extends FunctionalTest { $this->assertEquals($relationCount + 1, $record->ManyManyFiles()->Count()); } + /** + * Partially covered by {@link UploadTest->testUploadAcceptsAllowedExtension()}, + * but this test additionally verifies that those constraints are actually enforced + * in this controller method. + */ + public function testAllowedExtensions() { + $this->loginWithPermission('ADMIN'); + + $invalidFile = 'invalid.php'; + $_FILES = array('AllowedExtensionsField' => $this->getUploadFile($invalidFile)); + $response = $this->post( + 'UploadFieldTest_Controller/Form/field/AllowedExtensionsField/upload', + array('AllowedExtensionsField' => $this->getUploadFile($invalidFile)) + ); + $this->assertTrue($response->isError()); + $this->assertContains('Extension is not allowed', $response->getBody()); + + $validFile = 'valid.txt'; + $_FILES = array('AllowedExtensionsField' => $this->getUploadFile($validFile)); + $response = $this->post( + 'UploadFieldTest_Controller/Form/field/AllowedExtensionsField/upload', + array('AllowedExtensionsField' => $this->getUploadFile($validFile)) + ); + $this->assertFalse($response->isError()); + $this->assertNotContains('Extension is not allowed', $response->getBody()); + } + /** * Test that has_one relations do not support multiple files */ @@ -899,6 +926,9 @@ class UploadFieldTestForm extends Form implements TestOnly { $fieldCanAttachExisting = UploadField::create('CanAttachExistingFalseField') ->setCanAttachExisting(false); + $fieldAllowedExtensions = new UploadField('AllowedExtensionsField'); + $fieldAllowedExtensions->getValidator()->setAllowedExtensions(array('txt')); + $fields = new FieldList( $fieldNoRelation, $fieldHasOne, @@ -913,7 +943,8 @@ class UploadFieldTestForm extends Form implements TestOnly { $fieldDisabled, $fieldSubfolder, $fieldCanUploadFalse, - $fieldCanAttachExisting + $fieldCanAttachExisting, + $fieldAllowedExtensions ); $actions = new FieldList( new FormAction('submit') @@ -943,4 +974,4 @@ class UploadFieldTest_Controller extends Controller implements TestOnly { public function Form() { return new UploadFieldTestForm($this, 'Form'); } -} \ No newline at end of file +} diff --git a/tests/security/SecurityTest.php b/tests/security/SecurityTest.php index 294b082b4..0f76c7ac6 100644 --- a/tests/security/SecurityTest.php +++ b/tests/security/SecurityTest.php @@ -250,61 +250,76 @@ class SecurityTest extends FunctionalTest { i18n::set_locale('en_US'); Member::config()->lock_out_after_incorrect_logins = 5; + Member::config()->lock_out_delay_mins = 15; - /* LOG IN WITH A BAD PASSWORD 7 TIMES */ - - for($i=1;$i<=7;$i++) { + // Login with a wrong password for more than the defined threshold + for($i = 1; $i <= Member::config()->lock_out_after_incorrect_logins+1; $i++) { $this->doTestLoginForm('sam@silverstripe.com' , 'incorrectpassword'); $member = DataObject::get_by_id("Member", $this->idFromFixture('Member', 'test')); - /* THE FIRST 4 TIMES, THE MEMBER SHOULDN'T BE LOCKED OUT */ - if($i < 5) { - $this->assertNull($member->LockedOutUntil); + if($i < Member::config()->lock_out_after_incorrect_logins) { + $this->assertNull( + $member->LockedOutUntil, + 'User does not have a lockout time set if under threshold for failed attempts' + ); $this->assertContains($this->loginErrorMessage(), _t('Member.ERRORWRONGCRED')); + } else { + // Fuzzy matching for time to avoid side effects from slow running tests + $this->assertGreaterThan( + time() + 14*60, + strtotime($member->LockedOutUntil), + 'User has a lockout time set after too many failed attempts' + ); } - - /* AFTER THAT THE USER IS LOCKED OUT FOR 15 MINUTES */ - //(we check for at least 14 minutes because we don't want a slow running test to report a failure.) - else { - $this->assertGreaterThan(time() + 14*60, strtotime($member->LockedOutUntil)); - } - - if($i > 5) { - $this->assertContains(_t('Member.ERRORLOCKEDOUT'), $this->loginErrorMessage()); - // $this->assertTrue(false !== stripos($this->loginErrorMessage(), _t('Member.ERRORLOCKEDOUT'))); + $msg = _t( + 'Member.ERRORLOCKEDOUT2', + 'Your account has been temporarily disabled because of too many failed attempts at ' . + 'logging in. Please try again in {count} minutes.', + null, + array('count' => Member::config()->lock_out_delay_mins) + ); + if($i > Member::config()->lock_out_after_incorrect_logins) { + $this->assertContains($msg, $this->loginErrorMessage()); } } - /* THE USER CAN'T LOG IN NOW, EVEN IF THEY GET THE RIGHT PASSWORD */ - $this->doTestLoginForm('sam@silverstripe.com' , '1nitialPassword'); - $this->assertNull($this->session()->inst_get('loggedInAs')); + $this->assertNull( + $this->session()->inst_get('loggedInAs'), + 'The user can\'t log in after being locked out, even with the right password' + ); - /* BUT, IF TIME PASSES, THEY CAN LOG IN */ - // (We fake this by re-setting LockedOutUntil) $member = DataObject::get_by_id("Member", $this->idFromFixture('Member', 'test')); $member->LockedOutUntil = date('Y-m-d H:i:s', time() - 30); $member->write(); - $this->doTestLoginForm('sam@silverstripe.com' , '1nitialPassword'); - $this->assertEquals($this->session()->inst_get('loggedInAs'), $member->ID); + $this->assertEquals( + $this->session()->inst_get('loggedInAs'), + $member->ID, + 'After lockout expires, the user can login again' + ); // Log the user out $this->session()->inst_set('loggedInAs', null); - /* NOW THAT THE LOCK-OUT HAS EXPIRED, CHECK THAT WE ARE ALLOWED 4 FAILED ATTEMPTS BEFORE LOGGING IN */ - - $this->doTestLoginForm('sam@silverstripe.com' , 'incorrectpassword'); - $this->doTestLoginForm('sam@silverstripe.com' , 'incorrectpassword'); - $this->doTestLoginForm('sam@silverstripe.com' , 'incorrectpassword'); - $this->doTestLoginForm('sam@silverstripe.com' , 'incorrectpassword'); + // Login again with wrong password, but less attempts than threshold + for($i = 1; $i < Member::config()->lock_out_after_incorrect_logins; $i++) { + $this->doTestLoginForm('sam@silverstripe.com' , 'incorrectpassword'); + } $this->assertNull($this->session()->inst_get('loggedInAs')); - $this->assertTrue(false !== stripos($this->loginErrorMessage(), _t('Member.ERRORWRONGCRED'))); + $this->assertTrue( + false !== stripos($this->loginErrorMessage(), _t('Member.ERRORWRONGCRED')), + 'The user can retry with a wrong password after the lockout expires' + ); $this->doTestLoginForm('sam@silverstripe.com' , '1nitialPassword'); - $this->assertEquals($this->session()->inst_get('loggedInAs'), $member->ID); + $this->assertEquals( + $this->session()->inst_get('loggedInAs'), + $member->ID, + 'The user can login successfully after lockout expires, if staying below the threshold' + ); i18n::set_locale($local); }
$CellString
$CellString
$CellString
$CellString