Ethna

Abstract

This version of Ethna is deversed from 2.1.2 of original Ethna.

This project deversed version aims following

Fast response
Composer enabled
=PHP5.3
PSR-2 support.

ethna's People

Contributors

Stargazers

Watchers

ethna's Issues

Support JSON RPC 2.0 response

http://en.wikipedia.org/wiki/JSON-RPC

Need to check the security vulnerability

*** Ethna_Controller.php.org    2013-05-20 18:08:36.000000000 +0900
--- Ethna_Controller.php    2013-05-21 17:47:19.000000000 +0900
***************
*** 768,773 ****
--- 768,782 ----
          $session->restore();
          $forward_name = $backend->perform($action_name);

+         if (
+             strpos($forward_name, "\0") !== false ||
+             strpos($forward_name, '../') !== false ||
+             strpos($forward_name, '.._') !== false
+         ) {
+             trigger_error("Ethna Security Violation. input illegal character[" . addslashes($forward_name) . "]", E_USER_NOTICE);
+             return Ethna::raiseError("security violation");
+         }
+ 
          // アクション実行後フィルタ
          for ($i = count($this->filter_chain) - 1; $i >= 0; $i--) {
              $r = $this->filter_chain[$i]->postActionFilter($action_name, $forward_name);

patch for v2.2 autoload version.

*** ./Ethna_Controller.php.org  2013-05-20 18:08:36.000000000 +0900
--- ./Ethna_Controller.php  2013-06-05 17:12:33.000000000 +0900
***************
*** 768,779 ****
--- 768,796 ----
          $session->restore();
          $forward_name = $backend->perform($action_name);

+         if (
+             strpos($forward_name, "\0") !== false ||
+             strpos($forward_name, '../') !== false ||
+             strpos($forward_name, '.._') !== false
+         ) {
+             trigger_error("Ethna Security Violation. input illegal character[" . addslashes($forward_name) . "]", E_USER_NOTICE);
+             return Ethna::raiseError("security violation");
+         }
+ 
          // アクション実行後フィルタ
          for ($i = count($this->filter_chain) - 1; $i >= 0; $i--) {
              $r = $this->filter_chain[$i]->postActionFilter($action_name, $forward_name);
              if ($r != null) {
                  $this->logger->log(LOG_DEBUG, 'forward [%s] -> [%s] by %s', $forward_name, $r, get_class($this->filter_chain[$i]));
                  $forward_name = $r;
+                 if (
+                     strpos($forward_name, "\0") !== false ||
+                     strpos($forward_name, '../') !== false ||
+                     strpos($forward_name, '.._') !== false
+                 ) {
+                     trigger_error("Ethna Security Violation. input illegal character[" . addslashes($forward_name) . "]", E_USER_NOTICE);
+                     return Ethna::raiseError("security violation");
+                 }
              }
          }

Recommend Projects