Skip to content

Commit 7dc2ece

Browse files
kenjiskenjis
authored
Merge pull request #5747 from kenjis/merge-419-master-into-develop
Merge v4.1.9 master into develop
2 parents 21c45ae + 257392b commit 7dc2ece

File tree

11 files changed

+107
-84
lines changed

11 files changed

+107
-84
lines changed

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,14 @@
11
# Changelog
22

3+
## [v4.1.9](https://github.com/codeigniter4/CodeIgniter4/tree/v4.1.9) (2022-02-25)
4+
5+
[Full Changelog](https://github.com/codeigniter4/CodeIgniter4/compare/v4.1.8...v4.1.9)
6+
7+
**SECURITY**
8+
9+
* *Remote CLI Command Execution Vulnerability* was fixed. See the [Security advisory](https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-xjp4-6w75-qrj7) for more information.
10+
* *Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability* was fixed. See the [Security advisory](https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4v37-24gm-h554) for more information.
11+
312
## [v4.1.8](https://github.com/codeigniter4/CodeIgniter4/tree/v4.1.8) (2022-01-24)
413

514
[Full Changelog](https://github.com/codeigniter4/CodeIgniter4/compare/v4.1.7...v4.1.8)

‎phpstan-baseline.neon.dist‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -110,11 +110,6 @@ parameters:
110110
count: 1
111111
path: system/CodeIgniter.php
112112

113-
-
114-
message: "#^Dead catch \\- CodeIgniter\\\\Exceptions\\\\PageNotFoundException is never thrown in the try block\\.$#"
115-
count: 1
116-
path: system/CodeIgniter.php
117-
118113
-
119114
message: "#^Property Config\\\\App\\:\\:\\$appTimezone \\(string\\) on left side of \\?\\? is not nullable\\.$#"
120115
count: 1

‎system/CodeIgniter.php‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ class CodeIgniter
4545
/**
4646
* The current version of CodeIgniter Framework
4747
*/
48-
public const CI_VERSION = '4.1.8';
48+
public const CI_VERSION = '4.1.9';
4949

5050
private const MIN_PHP_VERSION = '7.4';
5151

@@ -318,6 +318,12 @@ public function run(?RouteCollectionInterface $routes = null, bool $returnRespon
318318

319319
$this->spoofRequestMethod();
320320

321+
if ($this->request instanceof IncomingRequest && $this->request->getMethod() === 'cli') {
322+
$this->response->setStatusCode(405)->setBody('Method Not Allowed');
323+
324+
return $this->sendResponse();
325+
}
326+
321327
Events::trigger('pre_system');
322328

323329
// Check for a cached page. Execution will stop
@@ -400,6 +406,7 @@ private function isWeb(): bool
400406
/**
401407
* Handles the main request logic and fires the controller.
402408
*
409+
* @throws PageNotFoundException
403410
* @throws RedirectException
404411
*
405412
* @return mixed|RequestInterface|ResponseInterface
@@ -1046,7 +1053,10 @@ public function spoofRequestMethod()
10461053
return;
10471054
}
10481055

1049-
$this->request = $this->request->setMethod($method);
1056+
// Only allows PUT, PATCH, DELETE
1057+
if (in_array(strtoupper($method), ['PUT', 'PATCH', 'DELETE'], true)) {
1058+
$this->request = $this->request->setMethod($method);
1059+
}
10501060
}
10511061

10521062
/**

‎tests/system/CodeIgniterTest.php‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -441,4 +441,59 @@ public function testRunDefaultRoute()
441441

442442
$this->assertStringContainsString('Welcome to CodeIgniter', $output);
443443
}
444+
445+
public function testRunCLIRoute()
446+
{
447+
$_SERVER['argv'] = ['index.php', 'cli'];
448+
$_SERVER['argc'] = 2;
449+
450+
$_SERVER['REQUEST_URI'] = '/cli';
451+
$_SERVER['SERVER_PROTOCOL'] = 'HTTP/1.1';
452+
$_SERVER['REQUEST_METHOD'] = 'CLI';
453+
454+
$routes = Services::routes();
455+
$routes->cli('cli', '\Tests\Support\Controllers\Popcorn::index');
456+
457+
ob_start();
458+
$this->codeigniter->useSafeOutput(true)->run();
459+
$output = ob_get_clean();
460+
461+
$this->assertStringContainsString('Method Not Allowed', $output);
462+
}
463+
464+
public function testSpoofRequestMethodCanUsePUT()
465+
{
466+
$_SERVER['argv'] = ['index.php'];
467+
$_SERVER['argc'] = 1;
468+
469+
$_SERVER['REQUEST_URI'] = '/';
470+
$_SERVER['SERVER_PROTOCOL'] = 'HTTP/1.1';
471+
$_SERVER['REQUEST_METHOD'] = 'POST';
472+
473+
$_POST['_method'] = 'PUT';
474+
475+
ob_start();
476+
$this->codeigniter->useSafeOutput(true)->run();
477+
ob_get_clean();
478+
479+
$this->assertSame('put', Services::request()->getMethod());
480+
}
481+
482+
public function testSpoofRequestMethodCannotUseGET()
483+
{
484+
$_SERVER['argv'] = ['index.php'];
485+
$_SERVER['argc'] = 1;
486+
487+
$_SERVER['REQUEST_URI'] = '/';
488+
$_SERVER['SERVER_PROTOCOL'] = 'HTTP/1.1';
489+
$_SERVER['REQUEST_METHOD'] = 'POST';
490+
491+
$_POST['_method'] = 'GET';
492+
493+
ob_start();
494+
$this->codeigniter->useSafeOutput(true)->run();
495+
ob_get_clean();
496+
497+
$this->assertSame('post', Services::request()->getMethod());
498+
}
444499
}

‎tests/system/Commands/CommandTest.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ final class CommandTest extends CIUnitTestCase
2727

2828
protected function setUp(): void
2929
{
30+
$this->resetServices();
31+
3032
parent::setUp();
3133

3234
CITestStreamFilter::$buffer = '';

‎tests/system/Commands/RoutesTest.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ final class RoutesTest extends CIUnitTestCase
2626

2727
protected function setUp(): void
2828
{
29+
$this->resetServices();
30+
2931
parent::setUp();
3032

3133
CITestStreamFilter::$buffer = '';
@@ -40,6 +42,8 @@ protected function setUp(): void
4042
protected function tearDown(): void
4143
{
4244
stream_filter_remove($this->streamFilter);
45+
46+
$this->resetServices();
4347
}
4448

4549
protected function getBuffer()
@@ -60,6 +64,7 @@ public function testRoutesCommand()
6064
public function testRoutesCommandRouteFilterAndAutoRoute()
6165
{
6266
$routes = Services::routes();
67+
$routes->setDefaultNamespace('App\Controllers');
6368
$routes->resetRoutes();
6469
$routes->get('/', 'Home::index', ['filter' => 'csrf']);
6570

‎tests/system/Commands/ScaffoldGeneratorTest.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
use CodeIgniter\Test\CIUnitTestCase;
1515
use CodeIgniter\Test\Filters\CITestStreamFilter;
16+
use Config\Autoload;
17+
use Config\Modules;
18+
use Config\Services;
1619

1720
/**
1821
* @internal
@@ -23,6 +26,9 @@ final class ScaffoldGeneratorTest extends CIUnitTestCase
2326

2427
protected function setUp(): void
2528
{
29+
$this->resetServices();
30+
Services::autoloader()->initialize(new Autoload(), new Modules());
31+
2632
CITestStreamFilter::$buffer = '';
2733

2834
$this->streamFilter = stream_filter_append(STDOUT, 'CITestStreamFilter');

‎tests/system/Commands/SessionsCommandsTest.php‎

Lines changed: 0 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,76 +0,0 @@
1-
<?php
2-
3-
/**
4-
* This file is part of CodeIgniter 4 framework.
5-
*
6-
* (c) CodeIgniter Foundation <admin@codeigniter.com>
7-
*
8-
* For the full copyright and license information, please view
9-
* the LICENSE file that was distributed with this source code.
10-
*/
11-
12-
namespace CodeIgniter\Commands;
13-
14-
use CodeIgniter\Test\CIUnitTestCase;
15-
use CodeIgniter\Test\Filters\CITestStreamFilter;
16-
17-
/**
18-
* @internal
19-
*/
20-
final class SessionsCommandsTest extends CIUnitTestCase
21-
{
22-
private $streamFilter;
23-
24-
protected function setUp(): void
25-
{
26-
parent::setUp();
27-
28-
CITestStreamFilter::$buffer = '';
29-
30-
$this->streamFilter = stream_filter_append(STDOUT, 'CITestStreamFilter');
31-
$this->streamFilter = stream_filter_append(STDERR, 'CITestStreamFilter');
32-
}
33-
34-
protected function tearDown(): void
35-
{
36-
stream_filter_remove($this->streamFilter);
37-
38-
$result = str_replace(["\033[0;32m", "\033[0m", "\n"], '', CITestStreamFilter::$buffer);
39-
$file = str_replace('APPPATH' . DIRECTORY_SEPARATOR, APPPATH, trim(substr($result, 14)));
40-
if (file_exists($file)) {
41-
unlink($file);
42-
}
43-
}
44-
45-
public function testCreateMigrationCommand()
46-
{
47-
command('session:migration');
48-
49-
// make sure we end up with a migration class in the right place
50-
// or at least that we claim to have done so
51-
// separate assertions avoid console color codes
52-
$this->assertStringContainsString('_CreateCiSessionsTable.php', CITestStreamFilter::$buffer);
53-
}
54-
55-
public function testOverriddenCreateMigrationCommand()
56-
{
57-
command('session:migration -t mygoodies');
58-
59-
// make sure we end up with a migration class in the right place
60-
$this->assertStringContainsString('_CreateMygoodiesTable.php', CITestStreamFilter::$buffer);
61-
}
62-
63-
public function testCannotWriteFileOnCreateMigrationCommand()
64-
{
65-
if ('\\' === DIRECTORY_SEPARATOR) {
66-
$this->markTestSkipped('chmod does not work as expected on Windows');
67-
}
68-
69-
chmod(APPPATH . 'Database/Migrations', 0444);
70-
71-
command('session:migration');
72-
$this->assertStringContainsString('Error while creating file:', CITestStreamFilter::$buffer);
73-
74-
chmod(APPPATH . 'Database/Migrations', 0755);
75-
}
76-
}

‎user_guide_src/source/changelogs/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ See all the changes.
1313
:titlesonly:
1414

1515
v4.2.0
16+
v4.1.9
1617
v4.1.8
1718
v4.1.7
1819
v4.1.6

‎user_guide_src/source/changelogs/v4.1.9.rst‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
Version 4.1.9
2+
#############
3+
4+
Release Date: February 25, 2022
5+
6+
**4.1.9 release of CodeIgniter4**
7+
8+
.. contents::
9+
:local:
10+
:depth: 2
11+
12+
SECURITY
13+
********
14+
15+
- *Remote CLI Command Execution Vulnerability* was fixed. See the `Security advisory GHSA-xjp4-6w75-qrj7 <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-xjp4-6w75-qrj7>`_ for more information.
16+
- *Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability* was fixed. See the `Security advisory GHSA-4v37-24gm-h554 <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4v37-24gm-h554>`_ for more information.

0 commit comments

Comments
 (0)