tonyair
/
silverstripe-subsites
mirror of https://github.com/silverstripe/silverstripe-subsites
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix subsites to use correct permissions 

See http://www.silverstripe.org/software/download/security-releases/ss-2015-008-sitetree-creation-permission-vulnerability
This commit is contained in:
Damian Mooyman 2015-03-23 14:35:52 +13:00
parent 73e0202dec
commit 2595d655cb
1 changed files with 16 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
tests/SiteTreeSubsitesTest.php
View File

@ -8,6 +8,10 @@ class SiteTreeSubsitesTest extends BaseSubsiteTest {
'SiteTreeSubsitesTest_ClassA',
'SiteTreeSubsitesTest_ClassB'
);
protected $illegalExtensions = array(
'SiteTree' => array('Translatable')
);
function testPagesInDifferentSubsitesCanShareURLSegment() {
$subsiteMain = $this->objFromFixture('Subsite', 'main');
@ -129,7 +133,7 @@ class SiteTreeSubsitesTest extends BaseSubsiteTest {
}
function testPageTypesBlacklistInClassDropdown() {
Session::set("loggedInAs", null);
$this->logInWithPermission('CMS_ACCESS_CMSMain');
$s1 = $this->objFromFixture('Subsite','domaintest1');
$s2 = $this->objFromFixture('Subsite','domaintest2');
@ -164,7 +168,7 @@ class SiteTreeSubsitesTest extends BaseSubsiteTest {
}
function testPageTypesBlacklistInCMSMain() {
Session::set("loggedInAs", null);
$this->logInWithPermission('CMS_ACCESS_CMSMain');
$cmsmain = new CMSMain();
@ -175,16 +179,18 @@ class SiteTreeSubsitesTest extends BaseSubsiteTest {
$s1->write();
Subsite::changeSubsite($s1);
$classes = $cmsmain->PageTypes()->column('ClassName');
$this->assertNotContains('ErrorPage', $classes);
$this->assertNotContains('SiteTreeSubsitesTest_ClassA', $classes);
$this->assertContains('SiteTreeSubsitesTest_ClassB', $classes);
Subsite::changeSubsite($s2);
$classes = $cmsmain->PageTypes()->column("ClassName");
$hints = Convert::json2array($cmsmain->SiteTreeHints());
$classes = $hints['Root']['disallowedChildren'];
$this->assertContains('ErrorPage', $classes);
$this->assertContains('SiteTreeSubsitesTest_ClassA', $classes);
$this->assertContains('SiteTreeSubsitesTest_ClassB', $classes);
$this->assertNotContains('SiteTreeSubsitesTest_ClassB', $classes);
Subsite::changeSubsite($s2);
$hints = Convert::json2array($cmsmain->SiteTreeHints());
$classes = $hints['Root']['disallowedChildren'];
$this->assertNotContains('ErrorPage', $classes);
$this->assertNotContains('SiteTreeSubsitesTest_ClassA', $classes);
$this->assertNotContains('SiteTreeSubsitesTest_ClassB', $classes);
}
}