tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #7699 from open-sausages/pulls/4/html-in-security-msg

Browse Source 
ENHANCEMENT Allow html in security failure message
This commit is contained in:
Damian Mooyman 2017-12-14 14:30:09 +13:00 committed by GitHub
commit 529e341dbc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
14 changed files with 75 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/Security/Security.php
View File

@ -317,6 +317,15 @@ class Security extends Controller implements TemplateGlobalProvider
public static function permissionFailure($controller = null, $messageSet = null)
{
self::set_ignore_disallowed_actions(true);
$shouldEscapeHtml = function ($message) {
if ($message instanceof DBField) {
$escapeHtml = $message->config()->escape_type === 'raw';
} else {
$escapeHtml = true;
}
return $escapeHtml;
};
if (!$controller && Controller::has_curr()) {
$controller = Controller::curr();
@ -380,7 +389,7 @@ class Security extends Controller implements TemplateGlobalProvider
$message = $messageSet['default'];
}
static::singleton()->setSessionMessage($message, ValidationResult::TYPE_WARNING);
static::singleton()->setSessionMessage($message, ValidationResult::TYPE_WARNING, $shouldEscapeHtml($message) ? ValidationResult::CAST_TEXT : ValidationResult::CAST_HTML);
$request = new HTTPRequest('GET', '/');
if ($controller) {
$request->setSession($controller->getRequest()->getSession());
@ -399,7 +408,13 @@ class Security extends Controller implements TemplateGlobalProvider
$message = $messageSet['default'];
}
static::singleton()->setSessionMessage($message, ValidationResult::TYPE_WARNING);
static::singleton()->setSessionMessage(
$message,
ValidationResult::TYPE_WARNING,
$shouldEscapeHtml($message) ?
ValidationResult::CAST_TEXT :
ValidationResult::CAST_HTML
);
$controller->getRequest()->getSession()->set("BackURL", $_SERVER['REQUEST_URI']);