tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 12:05:37 +00:00
Code Issues Projects Releases Wiki Activity

BUGFIX: Don't allow calling of magically added methods via URL unless explicitly listed in allowed_actions

Browse Source 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.2@64988 467b73ca-7a2a-4603-9d3b-597d59a354a9
This commit is contained in:
Sam Minnee 2008-10-31 02:46:17 +00:00
parent 0431518314
commit 701ae9a4d9
1 changed files with 19 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
core/control/Controller.php
View File

@ -558,24 +558,29 @@ class Controller extends ViewableData {
} }
} }
if($access === null || (isset($accessParts[1]) && $accessParts[0] === $accessParts[1])) {
// user_error("Deprecated: please define static \$allowed_actions on your Controllers for security purposes", E_USER_NOTICE);
return true;
}
if($action == 'index') return true; if($action == 'index') return true;
if(isset($access[$action])) { if($access) {
$test = $access[$action]; if(isset($access[$action])) {
if($test === true) return true; $test = $access[$action];
if(substr($test,0,2) == '->') { if($test === true) return true;
$funcName = substr($test,2); if(substr($test,0,2) == '->') {
return $this->$funcName(); $funcName = substr($test,2);
return $this->$funcName();
}
if(Permission::check($test)) return true;
} else if((($key = array_search($action, $access)) !== false) && is_numeric($key)) {
return true;
} }
if(Permission::check($test)) return true;
} else if((($key = array_search($action, $access)) !== false) && is_numeric($key)) {
return true;
} }
if($access === null || (isset($accessParts[1]) && $accessParts[0] === $accessParts[1])) {
// If no allowed_actions are provided, then we should only let through actions that aren't handled by magic methods
// we test this by calling the unmagic method_exists and comparing it to the magic $this->hasMethod(). This will
// still let through actions that are handled by templates.
return method_exists($this, $action) || !$this->hasMethod($action);
}
return false; return false;
} }