Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Applied Security patch from Magento: PATCH_SUPEE-5344_CE #9

Merged
merged 1 commit into from
Feb 10, 2015
Merged

Applied Security patch from Magento: PATCH_SUPEE-5344_CE #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions app/code/core/Mage/Admin/Model/Observer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,10 @@ public function actionPreDispatchAdmin($observer)
{
$session = Mage::getSingleton('admin/session');
/** @var $session Mage_Admin_Model_Session */

/**
* @var $request Mage_Core_Controller_Request_Http
*/
$request = Mage::app()->getRequest();
$user = $session->getUser();

Expand All @@ -58,7 +62,7 @@ public function actionPreDispatchAdmin($observer)
if (in_array($requestedActionName, $openActions)) {
$request->setDispatched(true);
} else {
if($user) {
if ($user) {
$user->reload();
}
if (!$user || !$user->getId()) {
Expand All @@ -69,13 +73,14 @@ public function actionPreDispatchAdmin($observer)
$session->login($username, $password, $request);
$request->setPost('login', null);
}
if (!$request->getParam('forwarded')) {
if (!$request->getInternallyForwarded()) {
$request->setInternallyForwarded();
if ($request->getParam('isIframe')) {
$request->setParam('forwarded', true)
->setControllerName('index')
->setActionName('deniedIframe')
->setDispatched(false);
} elseif($request->getParam('isAjax')) {
} elseif ($request->getParam('isAjax')) {
$request->setParam('forwarded', true)
->setControllerName('index')
->setActionName('deniedJson')
Expand Down
29 changes: 29 additions & 0 deletions app/code/core/Mage/Core/Controller/Request/Http.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,13 @@ class Mage_Core_Controller_Request_Http extends Zend_Controller_Request_Http
*/
protected $_beforeForwardInfo = array();

/**
* Flag for recognizing if request internally forwarded
*
* @var bool
*/
protected $_internallyForwarded = false;

/**
* Returns ORIGINAL_PATH_INFO.
* This value is calculated instead of reading PATH_INFO
Expand Down Expand Up @@ -534,4 +541,26 @@ public function isAjax()
}
return false;
}

/**
* Define that request was forwarded internally
*
* @param boolean $flag
* @return Mage_Core_Controller_Request_Http
*/
public function setInternallyForwarded($flag = true)
{
$this->_internallyForwarded = (bool)$flag;
return $this;
}

/**
* Checks if request was forwarded internally
*
* @return bool
*/
public function getInternallyForwarded()
{
return $this->_internallyForwarded;
}
}
2 changes: 1 addition & 1 deletion app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ class Mage_Oauth_Adminhtml_Oauth_AuthorizeController extends Mage_Adminhtml_Cont
*/
public function preDispatch()
{
$this->getRequest()->setParam('forwarded', true);
Mage::app()->getRequest()->setInternallyForwarded();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why on earth are they breaking the DI by calling out to the static object???


// check login data before it set null in Mage_Admin_Model_Observer::actionPreDispatchAdmin
$loginError = $this->_checkLoginIsEmpty();
Expand Down
4 changes: 2 additions & 2 deletions app/code/core/Mage/XmlConnect/Model/Observer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ public function actionFrontPreDispatchXmlAdmin($event)
/** @var $request Mage_Core_Controller_Request_Http */
$request = Mage::app()->getRequest();
if (true === $this->_checkAdminController($request, $event->getControllerAction())) {
$request->setParam('forwarded', true)->setDispatched(true);
$request->setInternallyForwarded()->setDispatched(true);
}
}

Expand All @@ -160,7 +160,7 @@ public function actionPreDispatchXmlAdmin($event)
if (false === $this->_checkAdminController($request, $event->getControllerAction())
&& !Mage::getSingleton('admin/session')->isLoggedIn()
) {
$request->setParam('forwarded', true)->setRouteName('adminhtml')->setControllerName('connect_user')
$request->setInternallyForwarded()->setRouteName('adminhtml')->setControllerName('connect_user')
->setActionName('loginform')->setDispatched(false);
}
}
Expand Down
4 changes: 0 additions & 4 deletions lib/Varien/Db/Adapter/Pdo/Mysql.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2834,10 +2834,6 @@ public function prepareSqlCondition($fieldName, $condition)

$query = '';
if (is_array($condition)) {
if (isset($condition['field_expr'])) {
$fieldName = str_replace('#?', $this->quoteIdentifier($fieldName), $condition['field_expr']);
unset($condition['field_expr']);
}
$key = key(array_intersect_key($condition, $conditionKeyMap));

if (isset($condition['from']) || isset($condition['to'])) {
Expand Down