Commit Graph

4750 Commits

Author SHA1 Message Date
Hamish Friedlander
122a9f898e Split Core.php into Constants.php and Core.php and adjust main.php startup
The recent flush filter fix had a problem that you couldnt set a custom
BASE_PATH in _ss_environment because that file didnt get included until
after checking the confirmation token. This patch pulls the part of Core.php
that defines BASE_PATH into a seperate file that can be included earlier
in the startup sequence so that ParameterConfirmationToken can access it.

Core.php includes Constants.php with a require_once call, so for startup
scripts that dont pull in Constants.php themselves (like cli-script.php)
no change is needed.
2013-07-22 14:02:37 +12:00
Sam Minnee
e782648b3a FIX: Fixed TempPath inclusion for phpunit & cli-script 2013-07-19 15:50:44 +12:00
Sam Minnée
7fe183ab20 Merge pull request #2247 from hafriedlander/fix/flush_24
FIX: Have ParameterConfirmationToken work regardless of include path
2013-07-18 20:46:47 -07:00
Hamish Friedlander
296b131171 FIX: Actually use argument in getTempFolder 2013-07-19 15:05:12 +12:00
Hamish Friedlander
ec8c4b8569 FIX: Ignore invalid tokens instead of throwing 403 2013-07-19 15:04:50 +12:00
Hamish Friedlander
d42d8d0fc2 FIX: Have ParameterConfirmationToken includes work regardless of include path 2013-07-19 14:30:59 +12:00
Sam Minnée
b774db43fb Merge pull request #2246 from hafriedlander/fix/flush_24
FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692) in 2.4
2013-07-18 17:39:19 -07:00
Hamish Friedlander
8990788818 FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692) 2013-07-19 12:31:37 +12:00
Hamish Friedlander
31429b7936 Move getTempFolder out of Core.php to own file 2013-07-19 11:01:20 +12:00
Ingo Schommer
5796ed225e Updated github path 2013-05-17 00:35:28 +02:00
Sean Harvey
813749e909 Fixing array to string conversion in dev/build for PHP 5.4 2013-05-12 21:28:17 +12:00
Ingo Schommer
a2394331af composer/installer dep workaround
Moved to end of requirements, to work around a bug in composer - see https://github.com/composer/composer/issues/1147. This caused the dependencies to be installed in the wrong folder because the custom 'silverstripe-module' instructions hadn't been loaded at the time the core modules were installed via composer.
2013-04-30 19:08:50 +03:00
Ingo Schommer
ff63d7ae26 Merge pull request #1821 from oddnoc/csvbulkloader-findexisting-2.4
Use the correct variable as the key into $record
2013-04-30 06:48:54 -07:00
Fred Condo
433b883c6b Use the correct variable as the key into $record
It was using $fieldName, which is the CSV field name, not the database
field name. This prevents duplicate detection from working. It now
properly uses $SQL_fieldName
2013-04-29 17:27:27 -07:00
Ingo Schommer
c26b83ebfb Less trademark-encumbered doc icons (fixed #1787)
Thanks to http://p.yusukekamiyamane.com/
2013-04-30 00:41:58 +02:00
Ingo Schommer
43d4224286 Require cms in 2.4 composer.json (which is used in travis) 2013-03-28 22:18:08 +01:00
Ingo Schommer
05d1305497 Simplified travis builds (external setup scripts) 2013-03-28 22:10:35 +01:00
Ingo Schommer
5cad7fe9e3 Merge pull request #1308 from ss23/patch-10
BUG SQL Injection in CsvBulkLoader (fixes #6227)
2013-03-19 05:03:56 -07:00
Stephen Shkardoon
143317cc86 BUG SQL Injection in CsvBulkLoader (fixes #6227)
Diff should speak for itself, looks like this will have to be implemented in all supported branches.
2013-03-20 00:45:05 +13:00
Ingo Schommer
a8a10f8a1a BUG Transaction stub methods for better cross 2.x and 3.x compat
The transactionStart() naming is 3.x, and used by some modules
which are otherwise still 2.x compatible.

Specifically, this was added to avoid branching the payment module
into separate 2.x and 3.x compatible branches.
2013-02-26 13:49:46 +01:00
Ingo Schommer
56ad1d027e Updated changelog 2013-02-18 01:03:57 +01:00
Ingo Schommer
190e0b8a47 Add ContentController->handleWidget() to $allowed_actions
Required by recent $allowed_actions security fix
2013-02-18 00:10:06 +01:00
Ingo Schommer
eecd34868f BUGFIX Keep Member.PasswordEncryption setting on empty passwords
This will prevent empty passwords to set the encryption to 'none',
which in turn will store any subsequent password changes in cleartext.
Reproduceable e.g. with ConfirmedPasswordField and setCanBeEmpty(true).
2013-02-17 23:16:25 +01:00
Ingo Schommer
3e27d27f7a Improved docs on $allowed_actions
Added section to "Controllers" and "Form" topics,
added $allowed_actions definitions to all controller examples
2013-02-17 23:16:25 +01:00
Ingo Schommer
50995fbecb BUG Undefined $allowed_actions overrides parent definitions, stricter handling of $allowed_actions on Extension
Controller (and subclasses) failed to enforce $allowed_action restrictions
on parent classes if a child class didn't have it explicitly defined.

Controllers which are extended with $allowed_actions (through an Extension)
now deny access to methods defined on the controller, unless this class also has them in its own
$allowed_actions definition.
2013-02-17 23:16:22 +01:00
Ingo Schommer
5d3ed12e20 Nginx docs for denying composer file access (fixes #8011) 2013-02-15 19:22:21 +01:00
Sean Harvey
9337902fdd Merge pull request #1181 from chillu/pulls/showtemplate-admin
API Require ADMIN for ?showtemplate=1 (2.4)
2013-02-12 15:07:13 -08:00
Ingo Schommer
45c68d6821 API Require ADMIN for ?showtemplate=1 2013-02-12 23:21:13 +01:00
Fred Condo
78d21b511c Update documentation of nginx configuration
- Avoid using "if" to check for file existence (use try_files instead)
- Replicate the behavior of the .htaccess files
- TODO: get static error pages to work
2013-01-11 16:06:11 +01:00
Ingo Schommer
44c41085b9 Copying request params before Core.php exec in PHPUnit bootstrap
Same behaviour as with 3.0 bootstrap.php and the
2.4 cli-script.php (which it is based on).
This allows to use GET switches which are evaluated in _config.php
files, e.g. db=<db-alias> settings for running tests
with various DBs without changing the underlying PHP config.
2013-01-06 22:34:29 +01:00
Ingo Schommer
3fad49e2c0 2.4.9 changelog 2012-12-04 22:47:47 +01:00
Ingo Schommer
3be9499c3a Fixed HTML syntax in config-form.html 2012-12-04 17:27:05 +01:00
Ingo Schommer
d1e65b5657 Support for composer-created themes dir structure
Due to git limitations, we can't check out the blackcandy
"parent" theme into themes/blackcandy/ directly, since that
would require sharing paths with git repositories of other themes.
2012-12-04 17:21:53 +01:00
Ingo Schommer
f86bd977a4 Fixed DateTest timezone settings
Backport from 3.x, see d1a9e2b3 and 0aeda5c9
2012-12-04 12:36:43 +01:00
Ingo Schommer
3268c0dee8 Merge pull request #977 from simonwelsh/rename-Transliterator
API Rename Transliterator to SS_Transliterator to remove conflict with Intl extension
2012-11-30 06:55:53 -08:00
Simon Welsh
f49f1ff5df API Rename Transliterator to SS_Transliterator to remove conflict with Intl extension 2012-11-29 08:21:05 +13:00
Ingo Schommer
326036a501 Excluded or removed tests relying on actual webserver routing
The "sanitychecks" group excludes through phpunit.xml.dist.
Removed RestfulService->testHttpErrorWithoutCache()
since its not sufficiently isolated in terms of testing.
Has been refactored in 3.x, but too intrusive to backport.

Changes mainly necessary to get Travis builds passing,
since we don't want to start mucking around with
dynamically generated file-to-url mappings just to
get *unit* tests passing - as opposed to integration-testing
the whole environment incl. webserver.
2012-11-28 15:35:09 +01:00
Ingo Schommer
7db928ba17 Added cms to travis requirements 2012-11-09 13:31:22 +01:00
Ingo Schommer
0a63f449df Added README with build status 2012-11-09 13:14:17 +01:00
Ingo Schommer
21791e4114 Added travis support 2012-11-09 13:07:04 +01:00
Mateusz Uzdowski
22095dae6c API Hash autologin tokens before storing in the database.
Backported from 3.0, cc423c38fb.
2012-11-09 12:03:55 +01:00
Ingo Schommer
59680b52e2 Added composer.json 2012-11-01 16:30:14 +01:00
Ingo Schommer
9e595db7f3 Changelogs 2012-10-30 17:00:41 +01:00
Ingo Schommer
6a06965b37 Merge pull request #881 from simonwelsh/2.4-5.4-fixes
Minor PHP5.4 fixes
2012-10-16 06:02:12 -07:00
Simon Welsh
4ff8cff262 Minor PHP5.4 fixes
Explictly excludes E_STRICT from live error level and handle arrays in a backtrace
output, rather than trying to convert to string.
2012-10-16 23:37:30 +13:00
Ingo Schommer
392543bde3 BUGFIX Don't' set 'Referer' header in FunctionalTest->get()/post() if its explicitly passed to the method 2012-10-16 10:17:10 +02:00
Ingo Schommer
46064f8f88 SECURITY More solid relative/site URL checks (related to "BackURL" redirection)
Return true for Director::is_absolute_url() checks if they're prefixed with two or more slashes (as browsers interpret this as a valid URL)

More solid URL checks in Director::is_site_url(), using a conservative parse_url() hostname comparison rather than Director::makeRelative(), which is not designed for security purposes
2012-10-16 10:17:07 +02:00
Ingo Schommer
2034927d31 Merge pull request #850 from willmorgan/patch-2
Fixed grammatical error for Form.FIELDISREQUIRED
2012-10-05 10:28:07 -07:00
Will Morgan
1c7b7d0ab5 Fixed grammatical error for Form.FIELDISREQUIRED 2012-10-05 18:04:38 +02:00
Ingo Schommer
201fb485a9 Merge pull request #797 from stozze/2.4-bugfix
BUGFIX Fix to prevent unintended results from getComponentsQuery(...)
2012-09-17 17:04:13 -07:00