PWC identified an issue with the subsites module that would allow someone with authenticated access to attack other CMS users, such as "stealing the session ID and hijacking an authenticated user's session".
I can't imagine a case where HTML would ever be allowed in the subdomain of a website, so it's a good practice to strip it out anyway.
Steps to reproduce the original issue:
1. Enter a subsite name and mark as the default site.
2. Add a new domain named <script>alert(2)</script> and mark it as primary
3. Switch to the new subsite.
4. Make a new Page. This will execute a javascript alert containing "2".
MINOR update documentation for onBeforeWrite()
MINOR add @property attributes into docblock
When trying to switch to a different subsite from a page's editing view, it wouldn't switch. This was partly due to a $record always existing due to the homepage fallback on currentPageID : https://github.com/silverstripe/silverstripe-cms/blob/3.1/code/controllers/CMSMain.php#L816
So as currentPage() couldn't actually be used to test for the existance of a current page, I've added in a check for isset($this->owner->urlParams['ID']).
I've also moved the check for $_GET['SubsiteID’] which indicated a forced subsite switch (eg. via the dropdown switcher) above the check for a current page, as it should take precedence, and it wasn't being run when both conditions matched causing the subsite not to change.
Tested changing subsites from /admin/pages, from page edit view, from a page edit URL, and from other CMS sections such as Files and Security, and all seems to be working perfectly now.
This problem manifests when a GridField-managed relationship tries to
create an object that references the container from canEdit - the
container in this case has empty fields.
An example of that is a HomePage with CarouselItem - if the
CarouselItem::canEdit tries to call $this->Page()->canEdit(), the "Page"
will be a dummy object, not the actual instance of the HomePage that's
doing the manipulation.
This is similar to the behaviour of SiteTree::canEdit, which solves
this situation by falling back to "return
$this->getSiteConfig()->canEdit($member);"
‘CMS_ACCESS_LeftAndMain’ is used by the PermissionCheckboxSetField to allow
applicable Members to access all CMS sections. There are then further
permissions to restrict the Members (e.g. ‘CMS_ACCESS_LeftAndMain’ will give you
access to the ‘Pages’ section, but you still need the ‘Edit any page’ permission
to actually edit anything).
This patch ensures that the subsites module follows those permissions, and
doesn’t unnecessarily deny permission to legitimate users.
Previously, only the global ‘ADMIN’ permission was allowing users to bypass the
stricter Permission check. We also need to allow the ‘CMS_ACCESS_LeftAndMain’
permission to bypass this check, as otherwise a user who is in a Group with the
‘Access to all CMS sections’ permission set (which only sets the
CMS_ACCESS_LeftAndMain permission code and no others) would be denied access to
the CMS for that sub site.
Remove the special AJAX handling to simplify the code. Now redirection
will be forced on any request that changes the subsite to re-synchronise
with the frontend.
Introduce canAccess method, and add it to alternateAccessCheck to make
sure this subsite-specific chceck is also done in situations that are
not captured by onBeforeInit.
This causes issues with Security::findAnAdmistrator which incorrectly
forces the current session-stored subsite to 0 - it uses
Subsite::currentSubsiteID before the session support is enabled, and
hence obtains wrong value.
Disables transparent subsite switch on AJAX requests.
Makes sure the subsite is appropriately set up when opening up the CMS
with a link to subsited object.
Tries to find an accessible section in the current site, falls back to
searching across all sites and all sections.
Also adds more powerful and generic functionss:
Subsites::all_sites - get the full list
Subsites::all_accessible_sites - get Member accessible list
LeftAndMainExtension::sectionSites - get section-specific list
* Hide admins without subsite support from subsites menu
* Add subsite support to default site areas
* Enable reloading of subsites switcher dropdown when navigating the
site, and when editing subsite areas
API Fix parallel pjax menu fetching for subsites.
- thanks Mateusz!
Delint LeftAndMain_Subsites.js
Users with non-ADMIN permissions won't see the dropdown of available
subsites, because LeftAndMainSubsites::Subsites() will check if
the user has a non-existent code CMS_ACCESS_CMSPagesController.
Fallback to checking required_permission_codes first, and failing
that, check for CMS_ACCESS_LeftAndMain
Tries to access i18n::$likely_subtags directly. Config changes in
3.1 now prevent this from happening and fails.
i18n::get_locale_from_lang() is used instead to provide the locale.
Currently, using the Subsites dropdown in the admin interface causes the CMS to reload to admin/pages. This can cause issues if you have set another interface as your default (other than CMSMain).
This is also the only UI-facing way to set a master page
after the initial copy action when creating a new subsite.
Shows "edit" link when master page is already set.
This fixes the bug where creating the top level pages is broken whenever
subsites module is installed. This is because the SubsiteID is
explicitly specified on AddForm POST submission, which incorrectly
triggers a redirect from LeftAndMainSubsites::init and the form action
never has a chance to execute.
Also do not look at POST when checking for the current subsite ID.
Fixed a few missed strict errors
Applied patch from kmayo to fix issues with SubsiteAdminTest.php
Fixed issue causing the url segments of subsites created from a template to add -2 to the end
Fixed undefined method TotalItems() on datalist for the SubsiteTest
Fixed failure on SubsiteTest because DataObject::get_one() now returns boolean false instead of null when no result is found
Fixed failure on SubsitesVirtualPageTest caused by Versioned::get_one_by_stage() returning null instead of false
Fixed failure caused by the contact-us page existing on subsite 2
Merged another patch from kmayo
Force main site to be on, for some reason it gets hidden in some cases i.e. refreshing the cms while editing a page
Fixes for SS 3.0 beta 3
Fixed compatibility issues with ss3.0 rc1
fixed potential issue caused by the from array format changing in 3.0
Fixed strict standards warnings
Fixed strict notice "Only variables should be passed by reference"
Fixed strict notice "Only variables should be passed by reference"
Fixed strict notice caused by SubsiteAdmin not declaring all of the properties for getCMSFields()
Made Subsite::accessible_sites() static
Fixed issue caused when trying to add a domain before saving for the first time
Fixed undefined property ParentID
BUGFIX: Fixed issue caused by ManyManyList remove all removing the File table from the FROM statement when removing all records from SiteTree_ImageTracking for a given page
Replaced deprecated DataObjectDecorator with DataExtension
Fixed hard crashes in the cms
Updated to support new LeftAndMain template structure
Made the subsites model admin functional
Moved the LeftAndMain_Menu template up a directory so it overrides the core
Fixed some errors caused by changes to the framework
Re-organized the code folder
Fixed permission issue causing to default to first subsite regardless if it is the default or not
Fixed crashes on the subsite virtual page when creating/editing
Removed toDropdownMap() calls replacing with map()
Fixed the URLSegment field on subsites
Fixed error when detecting subsite for a domain
Improved styles on the subsite dropdown
Updated LeftAndMain_Subsites.js to work with jQuery entwine
Started porting the SubsitesTreeDropdownField.js to use jQuery entwine and work with the new TreeDropdownField.js
Fixed issue causing crash when viewing a page who is linked to by a subsite virtual page
Removed unused methods on SubsitesTreeDropdownField.js
Re-added classes that were moved
Fixed hard crash after saving caused by the many_many definition on SiteTreeSubsites
Replaced deprecated DataObjectSet creation with ArrayList
Compatibility fixes with SS 3.0 beta 2
Fixed crash in cms caused by no parameter being passed to the SubsiteReportWrapper constructor
Proper fix for report wrapper
Removed table list field in favor of a basic grid field
Fixed updateCMSFields() for file subsites
Migrated translations to yml
Fixed issue causing the current page to not get cleared when changing subsites in the cms
Fixed virtual page icon
Fixed language files issue
