Commit Graph

343 Commits

Author SHA1 Message Date
Damian Mooyman
a89dbd29e1 Revert #3345 #3323 2014-07-31 17:05:57 +12:00
Daniel Hensby
419f308544 FIX Handle empty URLs that are made absolute
When the email sender makes the links absolute, it can't handle empty `href` or `src` attributes as there's no expectation that the string length could be 0
2014-07-25 13:09:47 +01:00
Damian Mooyman
0433ba1642 BUG Revert some changes to ManyManyList
BUG Fix incompatibility in Member_GroupList
Fix regressions in merges from 3.1
BUG Fix Security failing on test classes
BUG Fix postgresql compatibility
Clarify sql encoding of table names
2014-07-23 12:38:41 +12:00
Simon Welsh
c14d58f585 Merge branch '3.1'
Conflicts:
	.travis.yml
	model/ManyManyList.php
	model/fieldtypes/DBField.php
2014-07-16 21:24:02 +10:00
Damian Mooyman
d8e9af8af8 API New Database abstraction layer. Ticket #7429
Database abstraction broken up into controller, connector, query builder, and schema manager, each independently configurable via YAML / Injector
Creation of new DBQueryGenerator for database specific generation of SQL
Support for parameterised queries, move of code base to use these over escaped conditions
Refactor of SQLQuery into separate query classes for each of INSERT UPDATE DELETE and SELECT
Support for PDO
Installation process upgraded to use new ORM
SS_DatabaseException created to handle database errors, maintaining details of raw sql and parameter details for user code designed interested in that data.
Renamed DB static methods to conform correctly to naming conventions (e.g. DB::getConn -> DB::get_conn)
3.2 upgrade docs
Performance Optimisation and simplification of code to use more concise API
API Ability for database adapters to register extensions to ConfigureFromEnv.php
2014-07-09 18:04:05 +12:00
Damian Mooyman
d3c7e41419 BUG using isDev or isTest query string no longer triggers basic auth 2014-07-02 11:51:51 +12:00
Sean Harvey
0ee3a683a5 Better support for overloading start and destroy methods in Session
Move functionality from static start and destroy functions into instance
methods, allowing these to be overloaded. This works the same way as
calling Session::set() which then in turn calls inst_set()

Additionally use Injector to create the default Session instance to
allow the class to be swapped out.
2014-06-20 10:35:53 +12:00
Ingo Schommer
bb03f6ba2f Merge remote-tracking branch 'origin/3.1'
Conflicts:
	forms/HtmlEditorField.php
2014-06-15 22:50:20 +12:00
Damian Mooyman
d516063db7 BUG fix dependency injection stumbling over ViewableData's __isset 2014-06-12 10:08:59 +12:00
Ingo Schommer
ec325a3c7f API Fix HTTPS proxy header detection
Didn't use the de facto standard HTTP_X_FORWARDED_PROTO or the less standard HTTP_FRONT_END_HTTPS.
Removed the 'X-Forwarded-Proto', since PHP should prefix/underscore all HTTP headers before it hits $_SERVER.

References:
- https://docs.djangoproject.com/en/1.4/ref/settings/#secure-proxy-ssl-header
- https://drupal.org/node/1859252
- https://drupal.org/node/313145
- http://scottwb.com/blog/2013/02/06/always-on-https-with-rails-behind-an-elb/
2014-05-22 18:34:15 +12:00
Damian Mooyman
ec578e5c8a Merge remote-tracking branch 'origin/3.1' 2014-05-12 11:32:22 +12:00
Ingo Schommer
6d3f7887a6 Merge pull request #3018 from willmorgan/patch-3
FIX change action variable source to getViewer
2014-05-07 08:38:33 +12:00
Damian Mooyman
ae573f829f BUG Fix Versioned stage not persisting in Session. Fixes #962
BUG Disabled disruptive test case in DirectorTest
API RequestProcessor and VersionedRequestFilter now both correctly implement RequestFilter
Better PHPDoc on RequestFilter and implementations
2014-05-06 14:11:44 +12:00
Hamish Friedlander
bbd7bba11f Merge pull request #3058 from tractorcow/pulls/injector-stack-tests
API Injector supports nesting
2014-05-06 11:35:32 +12:00
Damian Mooyman
e9c3ff933f Merge remote-tracking branch 'origin/3.1'
Conflicts:
	.travis.yml
	composer.json
2014-05-06 10:22:09 +12:00
Damian Mooyman
d06d5c113b API Injector supports nesting
BUG Resolve issue with DirectorTest breaking RequestProcessor
Injector::nest and Injector::unnest are introduced to better support sandboxing of testings.
Injector and Config ::nest and ::unnest support chaining
Test cases for both Injector::nest and Config::nest
2014-04-29 08:59:33 +12:00
Damian Mooyman
5e9ae578c3 BUG Fix edge case IE8 / dev / ssl / download file crash
Prevents issue at http://support.microsoft.com/kb/323308 appearing on dev
2014-04-28 09:17:35 +12:00
Damian Mooyman
982ad569b9 Merge remote-tracking branch 'origin/3.1' 2014-04-22 12:09:51 +12:00
Damian Mooyman
a6017a0506 API HTTP 429 Allowed for use with rate limiting methods 2014-04-17 16:35:09 +12:00
Will Morgan
438fe02116 FIX change action variable source to getViewer
Previously we were using the request to get the action parameter. However for custom URL structures and nested controllers, this won't work and causes template selection to break.
2014-04-08 12:55:57 +01:00
Damian Mooyman
d8836fd488 Merge remote-tracking branch 'origin/3.0' into 3.1 2014-04-08 17:10:07 +12:00
Simon Welsh
2566795b59 Merge branch '3.1'
Conflicts:
	view/SSViewer.php
2014-03-30 19:39:18 +13:00
Simon Welsh
c59cf624df Merge branch '3.0' into 3.1 2014-03-30 18:32:54 +13:00
Simon Welsh
241583858a Correct line length 2014-03-30 18:32:40 +13:00
Simon Welsh
fe8dc50ffc Merge branch '3.1'
Conflicts:
	tests/view/SSViewerTest.php
2014-03-30 18:17:24 +13:00
Simon Welsh
f9c44e4ceb Merge branch '3.0' into 3.1
Conflicts:
	model/Versioned.php
	view/SSTemplateParser.php
	view/SSViewer.php
2014-03-30 18:15:12 +13:00
Damian Mooyman
f8e3bbe3ae BUG Fix encoding of JS redirection script 2014-03-27 14:35:14 +13:00
Simon Welsh
ff9d40a60d FIX Escape the redirect URL before outputting
Signed-off-by: Stephen Shkardoon <stephen@silverstripe.com>
2014-03-19 21:34:49 +13:00
Simon Welsh
8f31352039 Merge remote-tracking branch 'origin/3.1'
Conflicts:
	.travis.yml
2014-03-16 09:36:48 +13:00
Simon Welsh
6e7195bac5 Merge pull request #2923 from IgorNadj/patch-1
updating comments for HTTPRequest - immutability
2014-03-15 21:48:20 +13:00
Simon Welsh
d1befdd37c Merge pull request #2901 from dhensby/director-test
Making Director::test() ignore URL Anchors
2014-03-15 00:09:06 +13:00
Simon Welsh
d431e98ecf Merge branch '3.1'
Conflicts:
	forms/Form.php
	forms/FormField.php
	security/Member.php
	security/MemberLoginForm.php
2014-03-10 22:58:49 +13:00
Damian Mooyman
0cbad41d3b Rewrote usages of error suppression operator 2014-03-05 15:48:55 +13:00
Damian Mooyman
6d5d3d8cb7 Rewrote usages of error suppression operator 2014-03-05 14:22:19 +13:00
Igor
7f39fb50a6 updating comments for HTTPRequest - immutability
SS_HTTPRequest can be read like an array, e.g. echo $request['a'], but cannot be written like an array, e.g. $request['a'] = 5; Added comment to caution people.

See line 375:
==================================================================
	/**
	 * @ignore
	 */
	public function offsetSet($offset, $value) {}
	
	/**
	 * @ignore
	 */
	public function offsetUnset($offset) {}
==================================================================

Might be good to write something about how you are supposed to modify a request, or what you are supposed to do instead (a redirect?).
2014-03-05 13:21:54 +13:00
Daniel Hensby
5e6c1b902b Making Director::test() ignore URL Anchors
Anchors should never make it to the server when they are in the browser URL bar, however tests are slightly different and some `Link()` functions may return a URL anchor. Instead of every test checking a link and stripping the anchor, I feel the Director::test() function should strip them off.
2014-02-26 12:04:47 +00:00
Ingo Schommer
d8361f9d3f Merge remote-tracking branch 'origin/3.1' 2014-02-18 22:06:59 +13:00
Stig Lindqvist
0077e25352 BUG: Director::test() don't respect port settings in $_FILE_TO_URL_MAPPING
Director::test() don't set the HTTP_HOST with the port number if that has been set.
Later call to Director::makeRelative() will return wrong value because of the strict string matching
(http://localhost/ != http://localhost:8000)

This bug affects all modules that are using Director::test in CLI where the $_FILE_TO_URL_MAPPING
have been set to use a domain with a port in it, i.e. static publishers.
2014-02-17 11:54:10 +13:00
Sean Harvey
9048eab4a2 Merge branch '3.1' 2014-02-12 11:06:54 +13:00
Ingo Schommer
71f6f8afc9 Injector updateSpec() instanciation (fixes #2829) 2014-02-07 17:00:27 +13:00
Ingo Schommer
4af9143d3b Merge remote-tracking branch 'origin/3.1'
Conflicts:
	docs/en/misc/contributing/code.md
2014-02-07 16:43:22 +13:00
Ingo Schommer
457ec9446b Merge pull request #2700 from ajshort/injector-factory
Injector Factory
2014-02-03 16:50:15 -08:00
Ingo Schommer
0d7e9a9692 Merge remote-tracking branch 'origin/3.1'
Conflicts:
	_config/routes.yml
	docs/en/topics/datamodel.md
	forms/DropdownField.php
2014-02-04 08:19:04 +13:00
Andrew Short
2f817ba177 NEW: Allow specifying a factory to use for creating services.
A service factory can be used for creating instances where a non-trivial
construction process is required. This is done by adding a `factory`
key to the service definition.
2014-02-03 11:30:22 +11:00
Ingo Schommer
ab070944d5 Merge branch 'pulls/apidocs-package-list' of https://github.com/madmatt/silverstripe-framework into madmatt-pulls/apidocs-package-list
Conflicts:
	view/SSTemplateParser.php
	view/SSTemplateParser.php.inc
2014-01-31 15:15:59 +13:00
Marcus Dalgren
9934230ad8 Fix Session::set_cookie_domain 2014-01-17 15:27:51 +01:00
Will Rossiter
c61f6540fb BUG Add support for X-Forwarded-Proto checking SSL (Fixes #1416)
De-facto standard for identifying the originating protocol of an HTTP request through a reverse proxy or load balancer.

http://www.geekisp.com/faq/6_65_en.html
2014-01-12 18:05:09 +13:00
Ingo Schommer
6176d65bd2 Merge remote-tracking branch 'origin/3.1'
Conflicts:
	forms/gridfield/GridFieldSortableHeader.php
	model/DataList.php
	model/fieldtypes/Enum.php
2013-12-02 20:49:34 +01:00
Andrew Short
aeb8814ddc Don't set all injector instances to the global instance. 2013-12-01 22:24:40 +11:00
madmatt
bebe0f6e37 Updating @package and @subpackage doc tags 2013-11-29 17:49:30 +13:00
Loz Calver
c8caeb8154 Add X-Backurl header to CMS ajax requests 2013-11-15 09:20:53 +00:00
Andrew Short
bedf292612 Merge branch '3.1'
Conflicts:
	docs/en/reference/execution-pipeline.md
	lang/nl.yml
2013-11-11 18:18:25 +11:00
Ingo Schommer
9d550f8938 Fixed merge error 2013-11-06 09:46:30 +01:00
Ingo Schommer
91f6039eed Merge remote-tracking branch 'origin/3.0' into 3.1
Conflicts:
	control/Director.php
2013-11-05 10:15:40 +01:00
Sean Harvey
d8f29fcc04 Merge pull request #2236 from chillu/pulls/isdev-infinite-loop
FIX Avoid infinite loops on ?isDev=1 and Deprecation class
2013-10-31 15:59:31 -07:00
Ingo Schommer
b56ca812dc Merge remote-tracking branch 'origin/3.1'
Conflicts:
	tests/security/MemberTest.php
2013-10-23 14:53:29 +02:00
Andrew Short
156bb87d57 FIX: Move stage choosing into a pre-request filter.
This ensures that the correct stage is selected, even if the request
does not come through the model as controller system. This fixes an
issue where custom controllers would always be on the "Stage" stage.
2013-10-23 18:29:13 +13:00
Andrew Short
e7c8fed6ab FIX: Move stage choosing into a pre-request filter.
This ensures that the correct stage is selected, even if the request
does not come through the model as controller system. This fixes an
issue where custom controllers would always be on the "Stage" stage.
2013-10-23 18:22:15 +13:00
Devlin
112e08e5f2 FIX Session::get_timeout 2013-10-22 14:20:18 +02:00
Ingo Schommer
25b6175e67 Merge remote-tracking branch 'origin/3.1'
Conflicts:
	.travis.yml
	forms/FormField.php
2013-10-20 13:52:56 +02:00
Hamish Friedlander
8801a50704 FIX oembed to avoid mixed media issues 2013-10-17 17:06:40 +13:00
Marcus Nyeholt
7bcb180f27 BUG Director::test now calls RequestProcessor
This fixes https://github.com/silverstripe/silverstripe-framework/issues/2517
and provides some testing around the use of RequestProcessor in general.
2013-10-15 07:53:34 +11:00
Ingo Schommer
b367dd6237 API Removed Member.LastVisited and Member.NumVisits 2013-10-10 12:35:07 +02:00
Ingo Schommer
f6035505c1 Removed accidental artifacts 2013-10-10 12:11:26 +02:00
Ingo Schommer
cd225f0fa4 No HTML entities in "Groups" ListboxField (fixes #2513) 2013-10-10 12:08:16 +02:00
Ingo Schommer
60fc7e5346 Merge remote-tracking branch 'origin/3.1' 2013-10-06 19:07:39 +02:00
Ingo Schommer
37ada61282 Merge pull request #2448 from g4b0/content-negotiator-object
BUGFIX: added <param> tag to ContentNegotiator filtering
2013-10-02 06:22:37 -07:00
Ingo Schommer
c7f656cd00 API Removed "PastMember" cookie and template getter
The functionality is easy to replicate in custom controllers,
and is too rarely used to be placed in core.

This also removes the `Member::is_repeat_member()` getter
and the `PastMember`/`IsRepeatMember` template globals.

See https://groups.google.com/forum/#!topic/silverstripe-dev/b8K3wU64TXg
2013-09-27 20:06:25 +02:00
Ingo Schommer
455e550d9a Merge remote-tracking branch 'origin/3.1'
Conflicts:
	docs/en/topics/testing/create-silverstripe-test.md
	forms/Form.php
	i18n/i18n.php
	model/Image.php
2013-09-27 19:22:14 +02:00
Sean Harvey
f8eaf81ae2 Merge branch '3.1.0' into 3.1 2013-09-23 17:13:09 +12:00
Damian Mooyman
477c3c9de6 BUG Fix regression introduced in #2356 (method call on non-object) 2013-09-23 13:32:55 +12:00
Ingo Schommer
5b3f8bc04d Merge pull request #2435 from hafriedlander/fix/join_links_query_params
FIX Use last of duplicate query params in join_links
2013-09-20 02:27:49 -07:00
Hamish Friedlander
a8c1dd7f53 FIX Use last of duplicate query params in join_links
When using Controller::join_links to join two links with identical query
params, both query params would be used in the result, ending up with
links that look like `../edit/show/14?locale=en_NZ&locale=mi_NZ`

This patch eliminates duplicate query params, so only the last one
for any key is present in the output.
2013-09-20 11:33:03 +12:00
g4b0
de10471c7e BUGFIX: added <param> tag to ContentNegotiator filtering 2013-09-19 17:30:36 +02:00
Will Rossiter
63778550e5 FIX: Follow internal redirections for cli operations. 2013-09-16 20:11:28 +12:00
Will Rossiter
2c11710832 Fix for duplicate class definition introduced in ddcfcf7. 2013-09-13 19:26:06 +12:00
Mateusz Uzdowski
1461ae9e4c BUG Fix regression in IE no-cache https file downloads.
Currently IE6-8 will refuse to download files over HTTPS with default
Framework settings.

Currently the HTTP::add_cache_headers competely overrides Cache-Control
headers on each request, so there is no way to inject custom headers
from the API-consuning methods.

Also of note: adding no-store header also fixes the issue but will
prevent proxies from caching the request body (which they do when using
no-cache). So the setting max-age to some low number is a better choice
here.
2013-08-26 17:15:58 +12:00
Ingo Schommer
9d764d6794 FIX Avoid infinite loops on ?isDev=1 and Deprecation class
If any of the functionality triggered by Director::isDev()
was causing deprecation errors, the system would go into
an infinite loop. Since the only way to cause this is the DB
checking functionality, we disable that for Deprecation.
Side effect of this change: You can't show deprecation notices
on a live site by forcing the session into dev mode.
2013-07-17 11:55:19 +02:00
Andrew Short
bfdf14fafa Merge branch '3.1' 2013-07-09 13:42:32 +10:00
Sam Minnée
ecf8f273c0 Merge pull request #2201 from hafriedlander/fix/session
Fixes to session, primarily around cookie_secure
2013-07-06 18:59:07 -07:00
Hamish Friedlander
d629d9422f FIX Session::$cookie_secure so Sessions still work via HTTP
Session::$cookie_secure adds the secure property to the session Set-Cookie
command, so that the browser wouldnt send it to the server over an unencrypted
link. However the server would still send the cookie to the browser
unencrypted. Also Sessions would stop working properly in HTTP,
but SilverStripe needs them for several things, such as form validation

This patch effectively causes HTTP and HTTPS requests to each have
their own session when cookie_secure is true. The two sessions are
independant from each other, so information set in the session via
HTTPS is safe from attacks on the session via HTTP, but parts
of the site that use HTTP and the session will still work
2013-07-07 09:12:10 +12:00
Hamish Friedlander
2886f6ee14 FIX Session was started every time, even if no data set
Session tracks the user agent in the session, to add some detection of
stolen session IDs. However this was causing a session to always be
created, even if this request didnt store any data in the session.
2013-07-07 09:12:10 +12:00
Hamish Friedlander
c6b4d993cc FIX Director::forceSSL and forceWWW not setting Vary header
If you have a Varnish box in front of a SilverStripe install, and
you call forceSSL, the Vary header wouldnt get sent. As a result
Varnish would respond with the same redirect reponse after the
redirect, leading to an infinite loop
2013-07-06 15:24:01 +12:00
Simon Welsh
fbce9fd7cd Merge branch '3.1'
Conflicts:
	.travis.yml
	docs/en/misc/contributing/code.md
	javascript/HtmlEditorField.js
2013-07-05 10:22:58 +12:00
Damian Mooyman
11f4b2c620 API HTTP::urlRewriter with (string)$code deprecated in 3.1. Fixed regressions and CSS urls.
urlRewriter will expect a callable as a second parameter,
but will work with the current api and simply raise a deprecation error.

HTTP::absoluteURLs now correctly rewrites urls into absolute urls. Resolves introduced in c56a80d6ce

HTTP::absoluteURLs now handles additional cases where urls were not translated.

Test cases for HTTP::absoluteURLs added for both css and attribute links.

Cleaned up replacement expression and improved documentation.
2013-07-05 09:08:58 +12:00
Simon Welsh
9deb11f9a0 Use preg_replace_callback over preg_replace with e modifier 2013-07-05 09:08:58 +12:00
Sean Harvey
7349682d44 Merge pull request #2145 from tractorcow/3.1-controller-redirect
Controller::redirect now returns the resulting SS_HTTPResponse
2013-06-24 14:16:18 -07:00
Ingo Schommer
fb784af738 API Enforce $allowed_actions in RequestHandler->checkAccessAction()
See discussion at https://groups.google.com/forum/?fromgroups#!topic/silverstripe-dev/Dodomh9QZjk

Fixes an access issue where all public methods on FormField were allowed,
and not checked for $allowed_actions. Before this patch you could e.g.
call FormField->Value() on the first field by using action_Value.

Removes the following assertion because it only worked due to RequestHandlingTest_AllowedControllerExtension
*not* having $allowed_extensions declared: "Actions on magic methods are only accessible if explicitly allowed on the controller."
2013-06-24 14:50:40 +02:00
Damian Mooyman
7340da03a7 Controller::redirect now returns the resulting SS_HTTPResponse, allowing the function to better support chaining 2013-06-24 13:39:05 +12:00
Mateusz Uzdowski
53a2dbd207 Add a note on the unit of the Session.timeout. 2013-06-21 10:56:00 +12:00
Kirk Mayo
dff5447cbc BUG: Fix for Cookie expiry timeout being passed as a large number on 64 bit machines 2013-06-20 12:30:48 +12:00
Ingo Schommer
94b4237372 Merge remote-tracking branch 'origin/3.1' 2013-06-19 11:17:33 +02:00
Sam Minnee
526b40414a FIX: Ensure that actions inferred from templates with the "_action" suffix also respect allowed_actions.
FIX: Ensure SSViewer::hasTemplate() is aware of themes.

To do this, RequestHandler::definingClassForAction() has been created, splitting out the code that looks up the class that defines a given action into its own method.  This is then overridden in Controller to look at templates.
2013-06-19 20:11:50 +12:00
Ingo Schommer
4ef83a2895 Using Cookie class in Session::destroy()
It allows us to suppress "headers sent" errors, which is particularly
important in phpunit test runs.
2013-06-18 23:06:22 +02:00
Sam Minnee
a6bd8f8f43 Ensure Cookie::get() will immediately return results.
Without this change, a call to Cookie::get() immediately after Cookie::set()
won't return the value provided.  This creates some unintuitive edge-cases,
although to date it looks like they have been worked around.

The patch doesn't have a test because our testing framework doesn't deal
with cookies well.
2013-06-07 11:27:15 +12:00
Ingo Schommer
88536998b9 Merge remote-tracking branch 'origin/3.1'
Conflicts:
	.travis.yml
2013-05-31 18:08:59 +02:00
Sam Minnee
f2c918dc45 FIX: Make session timeout inactive-time only.
By default, the Session.timeout configuration option specifies the total
session time, regardless of the amount of activity.  This change means
that the timeout specifies how long without any further dynamic requests
before the session cookie expires.

The way it does this is to re-set the session cookie expiry with a
subsequent Set-Cookie command each time a request that necessitates
a session is called.

Strictly speaking, it's a change in session timeout semantics, but I think
it's a good one, because total-session-time-regardless-of-activity is a
stupid timeout to include, and has more to do with the mechanics of the
internet than with application security requirements.
2013-05-31 16:26:04 +12:00
Stephen Shkardoon
d6c2c2e07f Fixes #1892 - Stop session hijacking with UA check 2013-05-25 19:29:08 +12:00
Sam Minnée
83be513f91 Merge pull request #1816 from silverstripe-rebelalliance/bug/emptyrules
FIX Allow Director::$rules like //$Action
2013-05-24 20:38:43 -07:00
Sam Minnee
d97ca43cd0 Merge branch '3.1'
Conflicts:
	README.md
	dev/install/install.php5
	forms/ConfirmedPasswordField.php
	tests/forms/FormTest.php
2013-05-23 19:01:58 +12:00