Changeset 1125

Timestamp:

2008-07-25 15:22:23 (6 months ago)

Author:

gaspard

Message:

Added 'mode' parameter to [form] to redirect after update in a specific mode.
[security] fixed multiversion (added a 'safe_attribute?' method before calling send).

Files:

• trunk/app/controllers/nodes_controller.rb (modified) (1 diff)
• trunk/app/models/document_content.rb (modified) (1 diff)
• trunk/app/models/image.rb (modified) (1 diff)
• trunk/app/models/image_content.rb (modified) (1 diff)
• trunk/app/models/node.rb (modified) (3 diffs)
• trunk/app/models/template_content.rb (modified) (1 diff)
• trunk/lib/multiversion.rb (modified) (1 diff)
• trunk/lib/parser/lib/rules/zena.rb (modified) (7 diffs)
• trunk/test/helpers/zena_parser/basic.yml (modified) (1 diff)
• trunk/test/unit/multiversion_test.rb (modified) (1 diff)
• trunk/test/unit/node_test.rb (modified) (1 diff)
• trunk/test/unit/relation_proxy_test.rb (modified) (1 diff)

trunk/app/controllers/nodes_controller.rb

@@ -224 +224 @@
-          redirect_to edit_version_url(:node_id => @node[:zip], :id=>(@node.v_number || 0)) 
-        else
-
+, :mode => params[:mode]
-        end
-      end

trunk/app/models/document_content.rb

@@ -14 +14 @@
-
-  zafu_readable         :size, :name, :content_type, :ext
+  safe_attribute        :file
-
-  belongs_to            :site

trunk/app/models/image.rb

@@ -54 +54 @@
-=end
-class Image < Document
-  
-  class << self
-    def accept_content_type?(content_type)

trunk/app/models/image_content.rb

@@ -18 +18 @@
-  
-  zafu_readable    :width, :height
+  safe_attribute   :crop
-  
-  # Return a cropped image using the 'crop' hash with the top left corner position (:x, :y) and the width and height (:width, :heigt).

trunk/app/models/node.rb

@@ -132 +132 @@
-                     :section_zip, :skin, :ref_lang, :fullpath, :rootpath, :position, :publish_from, :max_status, :rgroup_id, 
-                     :wgroup_id, :pgroup_id, :basepath, :custom_base, :klass, :zip, :score, :comments_count, :l_status, :l_comment,
-
+
+
-  zafu_context       :author => "Contact", :parent => "Node", 
-                     :project => "Project", :section => "Section", 
@@ -728 +729 @@
-    return @visitor if @visitor
-    raise Zena::RecordNotSecured.new("Visitor not set, record not secured.")
+  end
+  
+  # Return true if the attribute can be read (is zafu_readable)
+  def safe_attribute?(att)
+    # FIXME: SECURITY: is there any risk here ? (k can be anything)
+    attribute = att.to_s
+    case attribute[0..1]
+    when 'v_'
+      version.class.safe_attribute?(attribute[2..-1])
+    when 'c_'
+      c = version.content
+      c ? c.class.safe_attribute?(attribute[2..-1]) : false
+    when 'd_'
+      true
+    else
+      if attribute =~ /_(id|zip|status|comment)s?\Z/
+        true
+      else
+        self.class.safe_attribute?(attribute)
+      end
+    end
-  end
-  
@@ -1129 +1151 @@
-  end
-  
+  # attributes are set only but we need dummy values for multiversion's remove_attributes_with_same_value
+  def m_text; nil end
+  def m_title; nil end
+  def m_author; nil end
+  
-  def m_title=(str)
-    @add_comment ||= {}

trunk/app/models/template_content.rb

@@ -1 +1 @@
-class TemplateContent < ActiveRecord::Base
-  zafu_readable   :tkpath, :ext, :format, :content_type, :filename, :mode, :klass, :skin_name
+  safe_attribute  :file
-  
-  attr_protected :tkpath

trunk/lib/multiversion.rb

@@ -335 +335 @@
-              next
-            end
-
+
+
+
+
+
+
+
-            case current_value.class.to_s
-            when 'NilClass'

trunk/lib/parser/lib/rules/zena.rb

@@ -42 +42 @@
-  # FIXME: zafu_readable should belong to core_ext.
-  class ActiveRecord::Base
-
-
+
+
+
-    @@_zafu_readable_attributes ||= {} # full list with inherited attributes
+    @@_safe_attribute_list      ||= {} # full list with inherited attributes
-    @@_zafu_known_contexts      ||= {} # full list with inherited attributes
-  
@@ -52 +54 @@
-    end
-    
+    def self.safe_attribute(*list)
+      @@_safe_attribute[self] ||= []
+      @@_safe_attribute[self] = (@@_safe_attribute[self] + list.map{|l| l.to_s}).uniq
+    end
+    
-    def self.zafu_context(hash)
-      @@_zafu_context[self] ||= {}
@@ -62 +69 @@
-      else
-        (superclass.zafu_readable_attributes + (@@_zafu_readable[self] || [])).uniq.sort
+      end
+    end
+    
+    def self.safe_attribute_list
+      @@_safe_attribute_list[self] ||= if superclass == ActiveRecord::Base
+        @@_safe_attribute[self] || []
+      else
+        (superclass.safe_attribute_list + (@@_safe_attribute[self] || [])).uniq.sort
-      end
-    end
@@ -98 +113 @@
-      end
-    end
-
+
+
+
+
+
-    def self.zafu_readable?(sym)
-      if sym.to_s =~ /(.*)_zips?$/
@@ -1003 +1022 @@
-        form = "<form method='post' action='/nodes/#{erb_node_id}'><div style='margin:0;padding:0'><input name='_method' type='hidden' value='put' /></div>"
-      end
-
+
+
+
+
+
+
+
+
+
-      hidden_fields['node[v_status]'] = Zena::Status[:pub] if @context[:publish_after_save] || (@params[:publish] == 'true')
-      
@@ -1053 +1080 @@
-    # TODO: implement checkbox in the same spirit as 'r_select'
-    def r_checkbox
-values'") unless values = @params[:valu
+nodes'") unless values = @params[:values] || @params[:nod
-      return parser_error("missing 'role'")   unless   role = (@params[:role] || @params[:name])
+      attribute = @params[:attr] || 'name'
+      if role =~ /(.*)_ids?\Z/
+        role = $1
+      end
-      meth = role.singularize
-
+
-      if values =~ /^\d+\s*($|,)/
-        # ids
@@ -1083 +1114 @@
-      out "<span><input type='checkbox' name='node[#{meth}_ids][]' value='#{erb_node_id(var)}'<%= #{list_var}_ids.include?(#{var}[:id]) ? \" checked='checked'\" : '' %>/> <%= #{node_attribute(attribute, :node=>var)} %></span> "
-      out "<% end -%></div>"
-
+[]
-
-      out "<% end -%><% end -%>"

trunk/test/helpers/zena_parser/basic.yml

@@ -886 +886 @@
-    node: 'opening'
-  src: "<r:checkbox role='calendar' values='11'/>"
-
+\[\]
-
-input_set_value:

trunk/test/unit/multiversion_test.rb

@@ -82 +82 @@
-    assert_equal Hash[:v_title=>'hey', :d_what=>'ever', :v_publish_from=>nil], node.remove_attributes_with_same_value(current.merge(:v_title=>'hey', :d_what=>'ever', :v_publish_from=>nil))  
-    assert_equal Hash[:v_title=>'hey', :d_what=>'ever', :v_publish_from=>''], node.remove_attributes_with_same_value(current.merge(:v_title=>'hey', :d_what=>'ever', :v_publish_from=>''))
+  end
+  
+  def test_remove_attributes_with_same_value_bad_attribute
+    # should not call the method if unsafe !
+    login(:ant)
+    node = secure!(Node) { nodes(:status) }
+    current = { :name => "status",
+      :position => "0",
+      :v_publish_from => "2006-03-10",
+      :v_summary => "status summary",
+      :v_text => "status text",
+      :v_title => "Etat des travaux"}
+    res = {}
+    assert_nothing_raised { res = node.remove_attributes_with_same_value(current.merge(:raise=>'mean idea')) }
+    assert_equal Hash[], res
-  end
-  

trunk/test/unit/node_test.rb

@@ -1313 +1313 @@
-  end
-  
+  def test_safe_attribute
+    login(:ant)
+    node = secure(Node) { nodes(:ant) }
+    ['v_puts', 'c_file', :raise, :blah, 'c_blah', 'c_system', 'system', 'v_system'].each do |k|
+      assert ! node.safe_attribute?(k), "#{k} should not be readable"
+    end
+    
+    ['v_status', 'id', :c_first_name, :c_name, 'parent_id', :m_text, :inherit, :v_title, 'd_blah', 'l_status', 'l_comment', 'hot_status', 'blah_comment', 'blah_zips', 'blah_id', 'blah_ids'].each do |k|
+      assert node.safe_attribute?(k), "#{k} should be safe"
+    end
+    
+    node = secure(Node) { nodes(:bird_jpg)}
+    
+    ['c_file'].each do |k|
+      assert node.safe_attribute?(k), "#{k} should be safe"
+    end
+  end
+  
-  # FIXME: write test
-  def test_assets

trunk/test/unit/relation_proxy_test.rb

@@ -106 +106 @@
-    assert_nothing_raised (NoMethodError) { node.update_attributes( 'tralala_ids' => ['33'])}
-    assert node.errors['tralala']
-
-
+
-  end
-