#578: Unvalidated arguments are left behind by non-required validators if those
have multiple arguments and did not run
------------------------+---------------------------------------------------
Reporter: david | Owner: dominik
Type: defect | Status: new
Priority: normal | Milestone: 0.11
Component: validation | Version: 0.11.0RC5
Severity: minor | Keywords:
------------------------+---------------------------------------------------
An example:
{{{
<validator class="equals" name="sansgleich" required="false"
provides="fieldsequal">
<argument>field1</argument>
<argument>field2</argument>
<error>Fields not equal</error>
</validator>
<validator class="regex" name="importantregexp" depends="fieldsequal">
<argument>field1</argument>
<parameter
name="pattern">veryimportantregexthatpreventshugesecurityissue</parameter>
</validator>
}}}
Now if {{{field1}}} has a value, and {{{field2}}} does not, then regex is
never executed. Of course, in this case, the action is not executed, but
still, {{{field1}}} is left behind in the request data, and potentially
dangerous.
--
Ticket URL: <http://trac.agavi.org/ticket/578>
Agavi <http://www.agavi.org/>
An MVC Framework for PHP5
_______________________________________________
Agavi Tickets Mailing List
[email protected]
http://lists.agavi.org/mailman/listinfo/tickets
