Commit Graph

255 Commits

Author SHA1 Message Date
Sean Harvey
0ee3a683a5 Better support for overloading start and destroy methods in Session
Move functionality from static start and destroy functions into instance
methods, allowing these to be overloaded. This works the same way as
calling Session::set() which then in turn calls inst_set()

Additionally use Injector to create the default Session instance to
allow the class to be swapped out.
2014-06-20 10:35:53 +12:00
Damian Mooyman
d516063db7 BUG fix dependency injection stumbling over ViewableData's __isset 2014-06-12 10:08:59 +12:00
Ingo Schommer
ec325a3c7f API Fix HTTPS proxy header detection
Didn't use the de facto standard HTTP_X_FORWARDED_PROTO or the less standard HTTP_FRONT_END_HTTPS.
Removed the 'X-Forwarded-Proto', since PHP should prefix/underscore all HTTP headers before it hits $_SERVER.

References:
- https://docs.djangoproject.com/en/1.4/ref/settings/#secure-proxy-ssl-header
- https://drupal.org/node/1859252
- https://drupal.org/node/313145
- http://scottwb.com/blog/2013/02/06/always-on-https-with-rails-behind-an-elb/
2014-05-22 18:34:15 +12:00
Damian Mooyman
ae573f829f BUG Fix Versioned stage not persisting in Session. Fixes #962
BUG Disabled disruptive test case in DirectorTest
API RequestProcessor and VersionedRequestFilter now both correctly implement RequestFilter
Better PHPDoc on RequestFilter and implementations
2014-05-06 14:11:44 +12:00
Hamish Friedlander
bbd7bba11f Merge pull request #3058 from tractorcow/pulls/injector-stack-tests
API Injector supports nesting
2014-05-06 11:35:32 +12:00
Damian Mooyman
d06d5c113b API Injector supports nesting
BUG Resolve issue with DirectorTest breaking RequestProcessor
Injector::nest and Injector::unnest are introduced to better support sandboxing of testings.
Injector and Config ::nest and ::unnest support chaining
Test cases for both Injector::nest and Config::nest
2014-04-29 08:59:33 +12:00
Damian Mooyman
5e9ae578c3 BUG Fix edge case IE8 / dev / ssl / download file crash
Prevents issue at http://support.microsoft.com/kb/323308 appearing on dev
2014-04-28 09:17:35 +12:00
Damian Mooyman
a6017a0506 API HTTP 429 Allowed for use with rate limiting methods 2014-04-17 16:35:09 +12:00
Damian Mooyman
d8836fd488 Merge remote-tracking branch 'origin/3.0' into 3.1 2014-04-08 17:10:07 +12:00
Simon Welsh
c59cf624df Merge branch '3.0' into 3.1 2014-03-30 18:32:54 +13:00
Simon Welsh
241583858a Correct line length 2014-03-30 18:32:40 +13:00
Simon Welsh
f9c44e4ceb Merge branch '3.0' into 3.1
Conflicts:
	model/Versioned.php
	view/SSTemplateParser.php
	view/SSViewer.php
2014-03-30 18:15:12 +13:00
Damian Mooyman
f8e3bbe3ae BUG Fix encoding of JS redirection script 2014-03-27 14:35:14 +13:00
Simon Welsh
ff9d40a60d FIX Escape the redirect URL before outputting
Signed-off-by: Stephen Shkardoon <stephen@silverstripe.com>
2014-03-19 21:34:49 +13:00
Simon Welsh
6e7195bac5 Merge pull request #2923 from IgorNadj/patch-1
updating comments for HTTPRequest - immutability
2014-03-15 21:48:20 +13:00
Damian Mooyman
0cbad41d3b Rewrote usages of error suppression operator 2014-03-05 15:48:55 +13:00
Damian Mooyman
6d5d3d8cb7 Rewrote usages of error suppression operator 2014-03-05 14:22:19 +13:00
Igor
7f39fb50a6 updating comments for HTTPRequest - immutability
SS_HTTPRequest can be read like an array, e.g. echo $request['a'], but cannot be written like an array, e.g. $request['a'] = 5; Added comment to caution people.

See line 375:
==================================================================
	/**
	 * @ignore
	 */
	public function offsetSet($offset, $value) {}
	
	/**
	 * @ignore
	 */
	public function offsetUnset($offset) {}
==================================================================

Might be good to write something about how you are supposed to modify a request, or what you are supposed to do instead (a redirect?).
2014-03-05 13:21:54 +13:00
Stig Lindqvist
0077e25352 BUG: Director::test() don't respect port settings in $_FILE_TO_URL_MAPPING
Director::test() don't set the HTTP_HOST with the port number if that has been set.
Later call to Director::makeRelative() will return wrong value because of the strict string matching
(http://localhost/ != http://localhost:8000)

This bug affects all modules that are using Director::test in CLI where the $_FILE_TO_URL_MAPPING
have been set to use a domain with a port in it, i.e. static publishers.
2014-02-17 11:54:10 +13:00
Ingo Schommer
71f6f8afc9 Injector updateSpec() instanciation (fixes #2829) 2014-02-07 17:00:27 +13:00
Ingo Schommer
457ec9446b Merge pull request #2700 from ajshort/injector-factory
Injector Factory
2014-02-03 16:50:15 -08:00
Andrew Short
2f817ba177 NEW: Allow specifying a factory to use for creating services.
A service factory can be used for creating instances where a non-trivial
construction process is required. This is done by adding a `factory`
key to the service definition.
2014-02-03 11:30:22 +11:00
Ingo Schommer
ab070944d5 Merge branch 'pulls/apidocs-package-list' of https://github.com/madmatt/silverstripe-framework into madmatt-pulls/apidocs-package-list
Conflicts:
	view/SSTemplateParser.php
	view/SSTemplateParser.php.inc
2014-01-31 15:15:59 +13:00
Marcus Dalgren
9934230ad8 Fix Session::set_cookie_domain 2014-01-17 15:27:51 +01:00
Will Rossiter
c61f6540fb BUG Add support for X-Forwarded-Proto checking SSL (Fixes #1416)
De-facto standard for identifying the originating protocol of an HTTP request through a reverse proxy or load balancer.

http://www.geekisp.com/faq/6_65_en.html
2014-01-12 18:05:09 +13:00
Andrew Short
aeb8814ddc Don't set all injector instances to the global instance. 2013-12-01 22:24:40 +11:00
madmatt
bebe0f6e37 Updating @package and @subpackage doc tags 2013-11-29 17:49:30 +13:00
Loz Calver
c8caeb8154 Add X-Backurl header to CMS ajax requests 2013-11-15 09:20:53 +00:00
Ingo Schommer
9d550f8938 Fixed merge error 2013-11-06 09:46:30 +01:00
Ingo Schommer
91f6039eed Merge remote-tracking branch 'origin/3.0' into 3.1
Conflicts:
	control/Director.php
2013-11-05 10:15:40 +01:00
Sean Harvey
d8f29fcc04 Merge pull request #2236 from chillu/pulls/isdev-infinite-loop
FIX Avoid infinite loops on ?isDev=1 and Deprecation class
2013-10-31 15:59:31 -07:00
Andrew Short
156bb87d57 FIX: Move stage choosing into a pre-request filter.
This ensures that the correct stage is selected, even if the request
does not come through the model as controller system. This fixes an
issue where custom controllers would always be on the "Stage" stage.
2013-10-23 18:29:13 +13:00
Andrew Short
e7c8fed6ab FIX: Move stage choosing into a pre-request filter.
This ensures that the correct stage is selected, even if the request
does not come through the model as controller system. This fixes an
issue where custom controllers would always be on the "Stage" stage.
2013-10-23 18:22:15 +13:00
Devlin
112e08e5f2 FIX Session::get_timeout 2013-10-22 14:20:18 +02:00
Hamish Friedlander
8801a50704 FIX oembed to avoid mixed media issues 2013-10-17 17:06:40 +13:00
Marcus Nyeholt
7bcb180f27 BUG Director::test now calls RequestProcessor
This fixes https://github.com/silverstripe/silverstripe-framework/issues/2517
and provides some testing around the use of RequestProcessor in general.
2013-10-15 07:53:34 +11:00
Ingo Schommer
f6035505c1 Removed accidental artifacts 2013-10-10 12:11:26 +02:00
Ingo Schommer
cd225f0fa4 No HTML entities in "Groups" ListboxField (fixes #2513) 2013-10-10 12:08:16 +02:00
Ingo Schommer
37ada61282 Merge pull request #2448 from g4b0/content-negotiator-object
BUGFIX: added <param> tag to ContentNegotiator filtering
2013-10-02 06:22:37 -07:00
Sean Harvey
f8eaf81ae2 Merge branch '3.1.0' into 3.1 2013-09-23 17:13:09 +12:00
Damian Mooyman
477c3c9de6 BUG Fix regression introduced in #2356 (method call on non-object) 2013-09-23 13:32:55 +12:00
Ingo Schommer
5b3f8bc04d Merge pull request #2435 from hafriedlander/fix/join_links_query_params
FIX Use last of duplicate query params in join_links
2013-09-20 02:27:49 -07:00
Hamish Friedlander
a8c1dd7f53 FIX Use last of duplicate query params in join_links
When using Controller::join_links to join two links with identical query
params, both query params would be used in the result, ending up with
links that look like `../edit/show/14?locale=en_NZ&locale=mi_NZ`

This patch eliminates duplicate query params, so only the last one
for any key is present in the output.
2013-09-20 11:33:03 +12:00
g4b0
de10471c7e BUGFIX: added <param> tag to ContentNegotiator filtering 2013-09-19 17:30:36 +02:00
Will Rossiter
63778550e5 FIX: Follow internal redirections for cli operations. 2013-09-16 20:11:28 +12:00
Will Rossiter
2c11710832 Fix for duplicate class definition introduced in ddcfcf7. 2013-09-13 19:26:06 +12:00
Mateusz Uzdowski
1461ae9e4c BUG Fix regression in IE no-cache https file downloads.
Currently IE6-8 will refuse to download files over HTTPS with default
Framework settings.

Currently the HTTP::add_cache_headers competely overrides Cache-Control
headers on each request, so there is no way to inject custom headers
from the API-consuning methods.

Also of note: adding no-store header also fixes the issue but will
prevent proxies from caching the request body (which they do when using
no-cache). So the setting max-age to some low number is a better choice
here.
2013-08-26 17:15:58 +12:00
Ingo Schommer
9d764d6794 FIX Avoid infinite loops on ?isDev=1 and Deprecation class
If any of the functionality triggered by Director::isDev()
was causing deprecation errors, the system would go into
an infinite loop. Since the only way to cause this is the DB
checking functionality, we disable that for Deprecation.
Side effect of this change: You can't show deprecation notices
on a live site by forcing the session into dev mode.
2013-07-17 11:55:19 +02:00
Sam Minnée
ecf8f273c0 Merge pull request #2201 from hafriedlander/fix/session
Fixes to session, primarily around cookie_secure
2013-07-06 18:59:07 -07:00
Hamish Friedlander
d629d9422f FIX Session::$cookie_secure so Sessions still work via HTTP
Session::$cookie_secure adds the secure property to the session Set-Cookie
command, so that the browser wouldnt send it to the server over an unencrypted
link. However the server would still send the cookie to the browser
unencrypted. Also Sessions would stop working properly in HTTP,
but SilverStripe needs them for several things, such as form validation

This patch effectively causes HTTP and HTTPS requests to each have
their own session when cookie_secure is true. The two sessions are
independant from each other, so information set in the session via
HTTPS is safe from attacks on the session via HTTP, but parts
of the site that use HTTP and the session will still work
2013-07-07 09:12:10 +12:00