Skip to content

Secure routable controller methods#1850

Merged
lonnieezell merged 3 commits intocodeigniter4:developfrom
MGatner:secure-routable-controller-methods
Mar 26, 2019
Merged

Secure routable controller methods#1850
lonnieezell merged 3 commits intocodeigniter4:developfrom
MGatner:secure-routable-controller-methods

Conversation

@MGatner
Copy link
Copy Markdown
Member

@MGatner MGatner commented Mar 21, 2019

Description
Fix for #1849 - changes system/Controller.php methods to protected and adds a 404 route for initController method

Checklist:

  • Securely signed commits
  • Component(s) with PHPdocs
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

@lonnieezell
Copy link
Copy Markdown
Member

Could you check out the breaking tests? I think this is the first place I saw those erroring out.

@MGatner
Copy link
Copy Markdown
Member Author

MGatner commented Mar 22, 2019

Error 1 of 3 is caused by CLI's routes attempting to parse callbacks as a string - see #1847 (comment).
This will be fixed by #1859

@MGatner
Copy link
Copy Markdown
Member Author

MGatner commented Mar 22, 2019

Errors 2 & 3 are both from system tests trying to call the now-protected methods directly. I believe this can be resolved by rewriting the test to use getPrivateMethodInvoker. The earliest I could look at doing this would be late next week, but I think it is a relatively easy change.
Relevant Travis CI logs:

2) CodeIgniter\ControllerTest::testCachePage
Error: Call to protected method CodeIgniter\Controller::cachePage() from context 'CodeIgniter\ControllerTest'
/home/travis/build/codeigniter4/CodeIgniter4/tests/system/ControllerTest.php:90
3) CodeIgniter\ControllerTest::testValidate
Error: Call to protected method CodeIgniter\Controller::validate() from context 'CodeIgniter\ControllerTest'
/home/travis/build/codeigniter4/CodeIgniter4/tests/system/ControllerTest.php:100

@MGatner
Copy link
Copy Markdown
Member Author

MGatner commented Mar 25, 2019

I believe this is ready now - test failures were resolved by using getPrivateMethodInvoker() as expected.

@lonnieezell
Copy link
Copy Markdown
Member

Looks good. Thanks!

@lonnieezell lonnieezell merged commit b5c3f18 into codeigniter4:develop Mar 26, 2019
@MGatner MGatner deleted the secure-routable-controller-methods branch March 26, 2019 10:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants