Possible security risk when saving data in forms - adding fields

2008-07-05 Thread phpjoy
When getting a form from a user, it should be double checked in the user's action logic. A user could easily manipulate a form field to submit a new field to the server, like id=4294967294, and stuck the users table. The user could guess, of course, other field names, or see other forms/views and

Re: Possible security risk when saving data in forms - adding fields

2008-07-05 Thread Dr. Tarique Sani
On Sat, Jul 5, 2008 at 11:37 AM, phpjoy [EMAIL PROTECTED] wrote: Throughout the examples in the manual (1.2 and 1.1), I haven't noticed any reminder of that possible risk, though I noticed the bad http://api.cakephp.org/1.2/class_model.html#ebe42ae387be89985b5a35dd428f5c81 Notice the third

Re: schema shell problem

2008-07-05 Thread Ziad
Figured out what the problem is! the postgres driver does not override the alterSchema method which is responsible for generating the SQL for altering the schema. It is there in the mysql driver and works fine there. I'll try and do it for the postgres driver and update this post when/if I do.

Re: paginate and belongsTo at a belongsTo-Model

2008-07-05 Thread Alessio
Attention at a little detail.. I was going be mad... When you put recursive to a model, and you will paginate it, you have to say to cakephp, if it has to reset or not the associations... This if you create associations on fly... So you have to put false, in the bindmodel function... On Jul 4,

Re: schema shell problem

2008-07-05 Thread Marcin Domanski
Please do. I'm using postgres too but i dont use schema cause i use native postgres uuid types and other db specific features. Postgre dbo may need some working to get it to mysqls level On Sat, Jul 5, 2008 at 8:43 AM, Ziad [EMAIL PROTECTED] wrote: Figured out what the problem is! the

Re: schema shell problem

2008-07-05 Thread Ziad
Yeah postgres dbo seems quite far behind MySQL which is a bit of shame. Just out of interest, how do you manage your database versioning? On Jul 5, 10:23 am, Marcin Domanski [EMAIL PROTECTED] wrote: Please do. I'm using postgres too but i dont use schema cause i use native postgres uuid

Re: Possible security risk when saving data in forms - adding fields

2008-07-05 Thread the_woodsman
I think you can also do this globally for a model using its $whitelist field. On Jul 5, 7:11 am, Dr. Tarique Sani [EMAIL PROTECTED] wrote: On Sat, Jul 5, 2008 at 11:37 AM, phpjoy [EMAIL PROTECTED] wrote: Throughout the examples in the manual (1.2 and 1.1), I haven't noticed any reminder of

$form-input as dateTime wrapper doesn't map correctly the dateTime showEmpty option

2008-07-05 Thread operativo
Hi I used the FormHelper $form-input() method to wrap a dateTime this way: echo $form-input('expire',array( 'type'='datetime', 'dateFormat' = 'DMY', 'timeFormat' = '24', 'selected' = null, 'attributes' = array(), ) ); I read

Re: Question regarding associations; hasMany -AND- belongTo

2008-07-05 Thread martin_nyc
Nevermind...the answer was of course quite simple. The bake function creates something similar to this for all hasMany associations: $comment['state_id']; Changing the recursion to 2 in the Controller and changing the View to read: $comment['State']['state_id']; does the trick. On

Re: Model validation

2008-07-05 Thread Sai Krishna
I tried it all. It seems to be not a problem of plurals, my colleague is not a cake expert, he was just there for code review. Is there any other setting to be done? On Jul 4, 7:24 pm, Jonathan Snook [EMAIL PROTECTED] wrote: Go back to how you originally had it and then use franky's advice

Anyone use Mantis BT?

2008-07-05 Thread Smelly_Eddie
I know, I know; bugzilla and trac seem to be the standard of hip projects everywhere, but I can't install python modules on my shared hosting accounts, so I 'settled' for mantis. I must say, I am very pleased with the operation of the software, and it has gotten a little friendlier since i used

Re: Auth Redirect Losing $_GET value

2008-07-05 Thread Eric
You may be able to turn off the Auth redirect and handle it yourself. I think the redirect location is stored in the Session object. This thread may help. http://groups.google.com/group/cake-php/browse_thread/thread/557a6367f823ef61/db0ffd9be8548bad#db0ffd9be8548bad On Jul 4, 8:31 am, Kyle

display var from view in layout

2008-07-05 Thread bmgz
Hi All, I need to display a few vars from my view in the layout.. I don't want to complicate things by adding another layout so this is basically what I want to do: I have a script which uses Google Maps. I need to assign a block of javascript to a var in between the head tags and need to

blog tutorial error - cakePHP 1.1

2008-07-05 Thread Kinicky
Hello everyone, i'm trying to learn CakePHP by the bog tutorial, i'm using APache2Triad 1.5.4 and CakePHP 1.1.19.6305 and i had two problems: 1) MySQL did'nt accept the DEFAULT parameter in: CREATE TABLE posts ( id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, title VARCHAR(50), body TEXT,

Re: blog tutorial error - cakePHP 1.1

2008-07-05 Thread Dardo Sordi Bogado
Hello, and welcome to CakePHP! i'm trying to learn CakePHP by the bog tutorial, i'm using APache2Triad 1.5.4 and CakePHP 1.1.19.6305 and i had two problems: Let me suggest you start right with CakePHP 1.2 RC2, since it's the second release candidate seems like soon we will have a stable

Re: display var from view in layout

2008-07-05 Thread bmgz
I managed to figure this out, however it wasnt as elegant or simple as it could be.. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups CakePHP group. To post to this group, send email to cake-php@googlegroups.com To

Re: blog tutorial error - cakePHP 1.1

2008-07-05 Thread Kinicky
1) i don't know what's wrong in the SQL statement, what it is? 2) this is the code in my .php, it's exactly the tutorial: http://bin.cakephp.org/saved/34489 On Sat, Jul 5, 2008 at 4:49 PM, Dardo Sordi Bogado [EMAIL PROTECTED] wrote: Hello, and welcome to CakePHP! i'm trying to learn

Controller question

2008-07-05 Thread [EMAIL PROTECTED]
Hi again. Is there anyway to detect from what view a controller action was called? Thanks. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups CakePHP group. To post to this group, send email to

Re: Controller question

2008-07-05 Thread Chris Hartjes
On Sat, Jul 5, 2008 at 7:48 PM, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Hi again. Is there anyway to detect from what view a controller action was called? Controllers are not called from views, it's the other way around. What are you trying to accomplish that you need to know this

Dispatcher::start - Controller::$beforeFilter property usage is deprecated and will no longer be supported. Use Controller::beforeFilter()

2008-07-05 Thread rhrn
Dispatcher::start - Controller::$beforeFilter property usage is deprecated and will no longer be supported. Use Controller::beforeFilter() how to use right? --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups CakePHP