Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Fix being unable to sort on custom synthetic columns.

If a sort field whitelist is used we should trust its data and also
trust that the developer wanted what they asked for. This solves issues
where it was impossible to sort on synthetic columns added in custom
find types.

Fixes #3919
  • Loading branch information...
commit b87318646838ecce07d342b8512bee9b1066a113 1 parent 4d6258a
@markstory markstory authored
View
12 lib/Cake/Controller/Component/PaginatorComponent.php
@@ -121,7 +121,8 @@ public function __construct(ComponentCollection $collection, $settings = array()
* @param Model|string $object Model to paginate (e.g: model instance, or 'Model', or 'Model.InnerModel')
* @param string|array $scope Additional find conditions to use while paginating
* @param array $whitelist List of allowed fields for ordering. This allows you to prevent ordering
- * on non-indexed, or undesirable columns.
+ * on non-indexed, or undesirable columns. See PaginatorComponent::validateSort() for additional details
+ * on how the whitelisting and sort field validation works.
* @return array Model query results
* @throws MissingModelException
* @throws NotFoundException
@@ -351,6 +352,9 @@ public function getDefaults($alias) {
* You can use the whitelist parameter to control which columns/fields are available for sorting.
* This helps prevent users from ordering large result sets on un-indexed values.
*
+ * Any columns listed in the sort whitelist will be implicitly trusted. You can use this to sort
+ * on synthetic columns, or columns added in custom find operations that may not exist in the schema.
+ *
* @param Model $object The model being paginated.
* @param array $options The pagination options being used for this request.
* @param array $whitelist The list of columns that can be used for sorting. If empty all keys are allowed.
@@ -370,10 +374,14 @@ public function validateSort(Model $object, array $options, array $whitelist = a
if (!empty($whitelist) && isset($options['order']) && is_array($options['order'])) {
$field = key($options['order']);
- if (!in_array($field, $whitelist)) {
+ $inWhitelist = in_array($field, $whitelist, true);
+ if (!$inWhitelist) {
$options['order'] = null;
return $options;
}
+ if ($inWhitelist) {
+ return $options;
+ }
}
if (!empty($options['order']) && is_array($options['order'])) {
View
17 lib/Cake/Test/Case/Controller/Component/PaginatorComponentTest.php
@@ -934,6 +934,23 @@ public function testValidateSortWhitelistFailure() {
}
/**
+ * test that fields in the whitelist are not validated
+ *
+ * @return void
+ */
+ public function testValidateSortWhitelistTrusted() {
+ $model = $this->getMock('Model');
+ $model->alias = 'model';
+ $model->expects($this->never())->method('hasField');
+
+ $options = array('sort' => 'body', 'direction' => 'asc');
+ $result = $this->Paginator->validateSort($model, $options, array('body'));
+
+ $expected = array('body' => 'asc');
+ $this->assertEquals($expected, $result['order']);
+ }
+
+/**
* test that virtual fields work.
*
* @return void
Please sign in to comment.
Something went wrong with that request. Please try again.