From 5924277e05cca365532a1ae0b92f41529c4f6ff7 Mon Sep 17 00:00:00 2001 From: Manish Jain Date: Tue, 10 Feb 2015 22:26:26 +0000 Subject: [PATCH] Applied Security patch from Magento: PATCH_SUPEE-5344_CE --- app/code/core/Mage/Admin/Model/Observer.php | 11 +++++-- .../Mage/Core/Controller/Request/Http.php | 29 +++++++++++++++++++ .../Adminhtml/Oauth/AuthorizeController.php | 2 +- .../core/Mage/XmlConnect/Model/Observer.php | 4 +-- lib/Varien/Db/Adapter/Pdo/Mysql.php | 4 --- 5 files changed, 40 insertions(+), 10 deletions(-) diff --git a/app/code/core/Mage/Admin/Model/Observer.php b/app/code/core/Mage/Admin/Model/Observer.php index 74a914fe8c0..ac615259eb7 100644 --- a/app/code/core/Mage/Admin/Model/Observer.php +++ b/app/code/core/Mage/Admin/Model/Observer.php @@ -44,6 +44,10 @@ public function actionPreDispatchAdmin($observer) { $session = Mage::getSingleton('admin/session'); /** @var $session Mage_Admin_Model_Session */ + + /** + * @var $request Mage_Core_Controller_Request_Http + */ $request = Mage::app()->getRequest(); $user = $session->getUser(); @@ -58,7 +62,7 @@ public function actionPreDispatchAdmin($observer) if (in_array($requestedActionName, $openActions)) { $request->setDispatched(true); } else { - if($user) { + if ($user) { $user->reload(); } if (!$user || !$user->getId()) { @@ -69,13 +73,14 @@ public function actionPreDispatchAdmin($observer) $session->login($username, $password, $request); $request->setPost('login', null); } - if (!$request->getParam('forwarded')) { + if (!$request->getInternallyForwarded()) { + $request->setInternallyForwarded(); if ($request->getParam('isIframe')) { $request->setParam('forwarded', true) ->setControllerName('index') ->setActionName('deniedIframe') ->setDispatched(false); - } elseif($request->getParam('isAjax')) { + } elseif ($request->getParam('isAjax')) { $request->setParam('forwarded', true) ->setControllerName('index') ->setActionName('deniedJson') diff --git a/app/code/core/Mage/Core/Controller/Request/Http.php b/app/code/core/Mage/Core/Controller/Request/Http.php index 557e3a261c1..a6e6fd808d6 100644 --- a/app/code/core/Mage/Core/Controller/Request/Http.php +++ b/app/code/core/Mage/Core/Controller/Request/Http.php @@ -75,6 +75,13 @@ class Mage_Core_Controller_Request_Http extends Zend_Controller_Request_Http */ protected $_beforeForwardInfo = array(); + /** + * Flag for recognizing if request internally forwarded + * + * @var bool + */ + protected $_internallyForwarded = false; + /** * Returns ORIGINAL_PATH_INFO. * This value is calculated instead of reading PATH_INFO @@ -534,4 +541,26 @@ public function isAjax() } return false; } + + /** + * Define that request was forwarded internally + * + * @param boolean $flag + * @return Mage_Core_Controller_Request_Http + */ + public function setInternallyForwarded($flag = true) + { + $this->_internallyForwarded = (bool)$flag; + return $this; + } + + /** + * Checks if request was forwarded internally + * + * @return bool + */ + public function getInternallyForwarded() + { + return $this->_internallyForwarded; + } } diff --git a/app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php b/app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php index b8fd71497f8..8de9de59c46 100644 --- a/app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php +++ b/app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php @@ -55,7 +55,7 @@ class Mage_Oauth_Adminhtml_Oauth_AuthorizeController extends Mage_Adminhtml_Cont */ public function preDispatch() { - $this->getRequest()->setParam('forwarded', true); + Mage::app()->getRequest()->setInternallyForwarded(); // check login data before it set null in Mage_Admin_Model_Observer::actionPreDispatchAdmin $loginError = $this->_checkLoginIsEmpty(); diff --git a/app/code/core/Mage/XmlConnect/Model/Observer.php b/app/code/core/Mage/XmlConnect/Model/Observer.php index 656db7811be..33ff6dfa6d2 100644 --- a/app/code/core/Mage/XmlConnect/Model/Observer.php +++ b/app/code/core/Mage/XmlConnect/Model/Observer.php @@ -143,7 +143,7 @@ public function actionFrontPreDispatchXmlAdmin($event) /** @var $request Mage_Core_Controller_Request_Http */ $request = Mage::app()->getRequest(); if (true === $this->_checkAdminController($request, $event->getControllerAction())) { - $request->setParam('forwarded', true)->setDispatched(true); + $request->setInternallyForwarded()->setDispatched(true); } } @@ -160,7 +160,7 @@ public function actionPreDispatchXmlAdmin($event) if (false === $this->_checkAdminController($request, $event->getControllerAction()) && !Mage::getSingleton('admin/session')->isLoggedIn() ) { - $request->setParam('forwarded', true)->setRouteName('adminhtml')->setControllerName('connect_user') + $request->setInternallyForwarded()->setRouteName('adminhtml')->setControllerName('connect_user') ->setActionName('loginform')->setDispatched(false); } } diff --git a/lib/Varien/Db/Adapter/Pdo/Mysql.php b/lib/Varien/Db/Adapter/Pdo/Mysql.php index 79133ef7088..db2f605f6c0 100644 --- a/lib/Varien/Db/Adapter/Pdo/Mysql.php +++ b/lib/Varien/Db/Adapter/Pdo/Mysql.php @@ -2834,10 +2834,6 @@ public function prepareSqlCondition($fieldName, $condition) $query = ''; if (is_array($condition)) { - if (isset($condition['field_expr'])) { - $fieldName = str_replace('#?', $this->quoteIdentifier($fieldName), $condition['field_expr']); - unset($condition['field_expr']); - } $key = key(array_intersect_key($condition, $conditionKeyMap)); if (isset($condition['from']) || isset($condition['to'])) {