tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity
2,873 Commits 31 Branches 527 Tags 162 MiB
2.3
Commit Graph

2873 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Sam Minnee
1cfbbada99 MINOR: Amended PHPUnit execution to work with PHPUnit 3.6 2013-03-19 13:38:45 +01:00
Stephen Shkardoon
bfbc7bca1b BUG SQL Injection in CsvBulkLoader (fixes #6227) 
Diff should speak for itself, looks like this will have to be implemented in all supported branches.
 2013-03-19 13:33:58 +01:00
Ingo Schommer
f0c893bd60 API CHANGE silverstripe_version file now contains the plain version number, rather than an SVN path 2012-02-01 18:55:45 +01:00
Ingo Schommer
15e9e059e5 BUGFIX Casting return values on text helper methods in StringField, Text, Varchar 2012-01-31 16:32:25 +01:00
Sam Minnee
acf9e01f61 BUGFIX: Don't break CMS tree if HTML gets into MenuTitle 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/trunk@77826 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2012-01-31 16:10:27 +01:00
Ingo Schommer
475e0772a2 SECURITY Sanitize messages passed to generated JS calls in FormResponse::status_message(), e.g. to avoid XSS on 'Successfully published <page title>' messages 2012-01-31 15:16:28 +01:00
Ingo Schommer
bdd63913bc BUGFIX Respecting SSViewer::$options["rewriteHashlinks"] in SSViewer::process() 2011-10-18 11:27:32 +02:00
Ingo Schommer
fbe8b7bec3 MINO Switching 'rewriteHashlinks' sanitization from Convert::raw2att() to strip_tags() to make the resulting PHP more portable when mode is set to 'php' 2011-10-18 11:27:32 +02:00
Ingo Schommer
8113e9ce84 ENHANCEMENT Added SSViewer::getOption() as a logical counterpart to SSViewer::setOption() 2011-10-18 11:27:32 +02:00
Ingo Schommer
52a895fbb2 BUGFIX Escaping base URLs for anchor links rewritten by SSViewer::process() with the 'rewriteHashlinks' option enabled (which is a framework default, and necessary because of the use of a <base> tag). Also added escaping for base URLs rendered through the 'php' variation of 'rewriteHashlinks' 2011-10-18 11:27:28 +02:00
Ingo Schommer
5bc0d008e9 BUGFIX Avoid privilege escalation from EDIT_PERMISSIONS to ADMIN through TreeMultiselectField (in Member->getCMSFields()) by checking for admin groups in Member->onChangeGroups() 2011-10-18 09:56:00 +02:00
Ingo Schommer
6d6c294ae3 BUGFIX Consistently using Convert::raw2sql() instead of DB::getConn()->addslashes() or PHP's deprecated addslashes() for database escaping 2011-09-15 14:40:21 +02:00
Ingo Schommer
ca7878453f SECURITY Backporting MySQLDatabase->addslashes() to use mysql_real_escape_string() instead of the non-multibyte-safe addslashes() PHP function, and using it in Convert::raw2sql() 2011-09-15 14:39:52 +02:00
Ingo Schommer
b37836ffa1 MINOR Added deprecated SapphireTest->assertType() in order to support PHPUnit 3.5 or newer, but stay backwards compatible to PHPUnit 3.4 
Conflicts:

	dev/SapphireTest.php
 2011-02-21 19:00:00 +13:00
Ingo Schommer
e527e54494 MINOR Fixing image links in docs/en/tutorials/ 2011-02-07 20:09:28 +13:00
Ingo Schommer
e2267a0728 ENHANCEMENT Added sapphire/docs (migrated from https://github.com/chillu/silverstripe-doc-restructuring) 2011-02-07 19:57:36 +13:00
Sean Harvey
a96e5a7dd5 BUGFIX #6291 Remove rollback action from CMSMain allowed_actions and rely on form action_rollback instead which is safer (from r115440) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@115919 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Ingo Schommer
e1742760c0 BUGFIX Checking for existence of FormAction in Form->httpSubmission() to avoid bypassing $allowed_actions definitions in controllers containing this form 
BUGFIX Checking for $allowed_actions in Form class, through Form->httpSubmission() (from r115182)

git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@115191 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Ingo Schommer
459a524388 BUGFIX Disallow web access to sapphire/silverstripe_version to avoid information leakage (from r114773) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@114776 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Ingo Schommer
061d2ecc0e BUGFIX Avoid potential referer leaking in Security->changepassword() form by storing Member->AutoLoginHash in session instead of 'h' GET parameter (from r114758) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@114763 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Ingo Schommer
5b0ecd913f BUGFIX: Fixed CSRF warning in image form after selecting a folder. (from r80237) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@114741 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Ingo Schommer
bed7d8cee6 BUGFIX Escaping $locale values in Translatable->augmentSQL() in addition to the i18n::validate_locale() input validation (from r114515) (from r114516) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@114517 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Ingo Schommer
51e55681f4 BUGFIX Limiting usage of mcrypt_create_iv() in RandomGenerator->generateEntropy() to *nix platforms to avoid fatal errors (specically in IIS) (from r114510) (from r114512) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@114513 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Ingo Schommer
a7c8de9bdf BUGFIX Using RandomGenerator class in Member->logIn(), Member->autoLogin() and Member->generateAutologinHash() for better randomization of tokens. Increased VARCHAR length of 'RememberLoginToken' and 'AutoLoginHash' fields to 1024 characters to support longer token strings. (from r114504) (from r114507) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@114509 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Ingo Schommer
0fb19f2884 BUGFIX Using RandomGenerator class in SecurityToken->generate() for more random tokens (from r114500) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@114502 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Ingo Schommer
67af64f484 ENHANCEMENT Added RandomGenerator for more secure CRSF tokens etc. (from r114497) (from r114499) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@114501 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:38 +13:00
Rainer Spittel
0e5d48fa6a BUGFIX Removing quotes from test data in RestfulServiceTest, it gives different results depending on magic_quotes_gpc setting on PHP configuration (merged from r80132). 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@114266 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
2d1d5363c8 API CHANGE Using Controller::join_links() to construct links in ComplexTableField and TableListField (partially merged from r88495, r96775) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113321 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
09d25b0d70 BUGFIX: Fixed Controller::join_links() handling of fragment identifiers (merged from r104580) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113319 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
452a8f8839 MINOR Using SecurityToken in ViewableData->getSecurityID() (from r113274) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113312 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
7aa32c089b ENHANCEMENT Added Form->enableSecurityToken() as a counterpart to the existing disableSecurityToken() (from r113284) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113305 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
af92845ebb MINOR Reverted commented out code (regression from r113293) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113303 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
75bd92de3c BUGFIX Clear static marking caches on Hierarchy->flushCache() (from r113277) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113302 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
2627281d5c BUGFIX Fixed ComplexTableField and TableListField GET actions against CSRF attacks (with Form_SecurityToken->checkRequest()) (from r113276) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113301 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
79bc6d5a21 MINOR Fixed HTTPRequest class usage (regression from r113293) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113298 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
b305ea0fc0 API CHANGE Added security token to TableListField->Link() in order to include it in all URL actions automatically. This ensures that field actions bypassing Form->httpSubmission() still get CSRF protection (from r113275) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113297 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:37 +13:00
Ingo Schommer
2cc957a702 BUGFIX Using current controller for MemberTableField constructor in Group->getCMSFields() instead of passing in a wrong instance (Group) (from r113273) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113294 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
9fff91dc08 ENHANCEMENT Added SecurityToken to wrap CSRF protection via "SecurityID" request parameter (from r113272) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113293 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
fd97e80224 BUGFIX Add PHPUnit includes to SapphireTest class (can be loaded outside of TestRunner for static calls, in which case the PHPUnit autoloaders/includes aren't in place yet) (merged from r113156) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@113158 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
eec37c2694 BUGFIX Using mock controller in RestfulServiceTest to avoid problems with missing require() calls for PHPUnit/Framework.php (performed in recently merged PHPUnitWrapper::init() which is never called for "nested" true HTTP calls within unit tests). Mostly merged from branches/2.4. 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@111837 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
9994a9c948 BUGFIX Renamed PHPUnit wrappers not to use underscores in classnames, as this confuses ManifestBuilder prior to the 2.4 release 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@111836 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
1176bab306 MINOR: added phpdoc to the new PHPUnitWrapper classes. 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@111835 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
d3d9e4560b ENHANCEMENT: refactored runTests, using the new phpunit wrapper classes. 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@111834 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
a57a027c43 API-CHANGE: remove include which is not required. 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@111833 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
534da4e076 ENHANCEMENT: Created a phpunit wrapper class to ensure that Sapphire's test framework is capable of running unit tests, coverage report and retrieve clover-statistics for PHPUnit 3.4 and PHPUnit 3.5 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@111832 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
a5dfb6257d ENHACENEMENT: Change behaviour of the MenufestBuilder to use spl_autoload_register instead of traditional __autoload. 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@111831 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
bdd30fa4fd API CHANGE Don't reflect changes in File and Folder property setters on filesystem before write() is called, to ensure that validate() applies in all cases. This fixes a problem where File->setName() would circumvent restrictions in File::$allowed_extensions (fixes #5693) 
API CHANGE Removed File->resetFilename(), use File->updateFilesystem() to update the filesystem, and File->getRelativePath() to just update the "Filename" property without any filesystem changes (emulating the old $renamePhysicalFile method argument in resetFilename())
API CHANGE Removed File->autosetFilename(), please set the "Filename" property via File->getRelativePath()
MINOR Added unit tests to FileTest and FolderTest (some of them copied from FileTest, to test Folder behaviour separately)
ENHANCEMENT Added File::$allowed_extensions (backport from 2.4 to enable File->validate() security fix)

git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@108062 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
c1295753b9 BUGFIX: Don't allow direct access to PHP files in sapphire module, except for main.php and static-main.php (from r108023) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@108043 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
dd696808b5 MINOR Added querystring option to Makefile (from r103884) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@103897 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:36 +13:00
Ingo Schommer
28e20364fd ENHANCEMENT Allowing TestRunner? to skip certain tests through the ?SkipTests?=... GET paramete (merged from branches/2.3-nzct) (from r80646) 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.3@103684 467b73ca-7a2a-4603-9d3b-597d59a354a9
 2011-02-02 14:27:35 +13:00