Development

Changeset 8905

You must first sign up to be able to contribute.

Changeset 8905

Show
Ignore:
Timestamp:
05/10/08 23:23:51 (5 months ago)
Author:
chrisk
Message:

[ckWebServicePlugin] changed configuration model for modules/actions, added code to prevent malicious calls to actions, which are not part of the webservice api, through manipulated soap requests

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • plugins/ckWebServicePlugin/trunk/lib/ckSoapParameterFilter.class.php

    r8064 r8905  
    3030      $request = $this->getContext()->getRequest(); 
    3131      $param   = $request->getParameter('param', null, 'ckWebServicePlugin'); 
    32       $map     = sfConfig::get('mod_'.$this->getContext()->getModuleName().'_soap_parameter_map_'.$this->getContext()->getActionName()); 
     32      $map     = sfConfig::get(sprintf('mod_%s_%s_parameter', $this->getContext()->getModuleName(), $this->getContext()->getActionName())); 
    3333 
    3434      if(is_array($param) && is_array($map)) 

  • plugins/ckWebServicePlugin/trunk/lib/controller/ckWebServiceController.class.php

    r8900 r8905  
    3131  { 
    3232    parent::initialize($context); 
     33    $this->dispatcher->connect('controller.change_action', array($this, 'listenToControllerChangeActionEvent')); 
    3334  } 
    3435 
    …… 
    5455    $result = sfConfig::get('app_ck_web_service_plugin_render', false); 
    5556 
    56     $result = sfConfig::get('mod_'.$this->context->getModuleName().'_soap_render_map_'.$this->context->getActionName(), $result); 
     57    $result = sfConfig::get(sprintf('mod_%s_%s_render', $this->context->getModuleName(), $this->context->getActionName()), $result); 
    5758 
    5859    return $result; 
    …… 
    195196   * Implements the default behavior to get the result of a soap action. 
    196197   * 
    197    * @param sfAction $actionInstance The hooked sfAction instance 
    198    * 
    199    * @return mixed The result of the hooked sfAction instance 
     198   * @param sfAction $actionInstance A sfAction instance 
     199   * 
     200   * @return mixed The result of the sfAction instance 
    200201   */ 
    201202  public function defaultResultCallback($actionInstance) 
    …… 
    207208    { 
    208209      // get the default result array key 
    209       $default_key = sfConfig::get('mod_'.$actionInstance->getModuleName().'_soap_return_key_'.$actionInstance->getActionName(), 'result'); 
     210      $default_key = sfConfig::get(sprintf('mod_%s_%s_result', $actionInstance->getModuleName(), $actionInstance->getActionName()), 'result'); 
    210211 
    211212      // if there is only one var stored we return it 
    …… 
    251252    } 
    252253  } 
     254   
     255  /** 
     256   * Listens to the controller.change_action event. 
     257   * 
     258   * @param sfEvent $event An sfEvent instance 
     259   */ 
     260  public function listenToControllerChangeActionEvent(sfEvent $event) 
     261  { 
     262    if($event->getSubject() === $this && !sfConfig::get(sprintf('mod_%s_%s_enable', $event['module'], $event['action']), false)) 
     263    { 
     264      throw new sfError404Exception(sprintf('{%s} SoapFunction \'%s_%s\' not found.', __CLASS__, $event['module'], $event['action'])); 
     265    } 
     266  } 
    253267} 

  • plugins/ckWebServicePlugin/trunk/lib/task/ckWebServiceGenerateWsdlTask.class.php

    r8895 r8905  
    143143          $yml[$env] = array(); 
    144144        } 
    145  
    146         $yml[$env]['soap_parameter_map'] = array(); 
    147  
     145         
    148146        foreach($class->getMethods() as $method) 
    149147        { 
    …… 
    159157            if($param_return == null) 
    160158            { 
     159              $yml[$env][$action] = array('enable'=>false); 
     160               
    161161              continue; 
    162162            } 
    163163 
    164             $yml[$env]['soap_parameter_map'][$action] = array(); 
     164            $yml[$env][$action] = array('enable'=>true, 'parameter'=>array(), 'result'=>null, 'render'=>false); 
    165165 
    166166            $ws_method = new WsdlMethod(); 
    …… 
    174174            foreach($param_return['param'] as $param) 
    175175            { 
    176               $yml[$env]['soap_parameter_map'][$action][] = $param['name']; 
     176              $yml[$env][$action]['parameter'][] = $param['name']; 
    177177 
    178178              $ws_method->addParameter($param['type'], $param['name'], $param['desc']); 
    …… 
    186186 
    187187        // only save if we added something to the configuration 
    188         if(!empty($yml[$env]['soap_parameter_map'])) 
     188        if(!empty($yml[$env])) 
    189189        { 
    190190          file_put_contents($module_config, sfYaml::dump($yml));