dualfroz
23bbaa8c60
The calendar_project_tasks and calendar_user_tasks settings were used as a column name in the iCal query, and escapeIdentifier() leaves values with a space or a dot untouched. A stored value like "1 OR 1=1 OR 1" made the public project feed return tasks from every project. Only date_creation and date_started are accepted now, anything else falls back to date_started. The currency form also stops saving keys other than application_currency, which is how the value could be written in the first place. Fixes #5904
42 lines
1.3 KiB
PHP
42 lines
1.3 KiB
PHP
<?php
|
|
|
|
namespace KanboardTests\units\Controller;
|
|
|
|
use Kanboard\Controller\CurrencyController;
|
|
use Kanboard\Core\Http\Request;
|
|
use Kanboard\Core\Http\Response;
|
|
use KanboardTests\units\Base;
|
|
|
|
class CurrencyControllerTest extends Base
|
|
{
|
|
public function testChangingTheCurrencyDoesNotSaveOtherSettings()
|
|
{
|
|
$this->container['request'] = new Request(
|
|
$this->container,
|
|
array('REQUEST_METHOD' => 'POST'),
|
|
array(),
|
|
array(
|
|
'csrf_token' => $this->container['token']->getCSRFToken(),
|
|
'application_currency' => 'EUR',
|
|
'calendar_project_tasks' => '1 OR 1=1 OR 1',
|
|
),
|
|
array(),
|
|
array()
|
|
);
|
|
|
|
$this->container['response'] = $this->getMockBuilder(Response::class)
|
|
->setConstructorArgs(array($this->container))
|
|
->onlyMethods(array('redirect'))
|
|
->getMock();
|
|
|
|
$this->container['response']
|
|
->expects($this->once())
|
|
->method('redirect');
|
|
|
|
(new CurrencyController($this->container))->update();
|
|
|
|
$this->assertEquals('EUR', $this->container['configModel']->getOption('application_currency'));
|
|
$this->assertEquals('date_started', $this->container['configModel']->getOption('calendar_project_tasks'));
|
|
}
|
|
}
|