[#34262] - [4][Security] filelist field type doesnt validate the input before saving
- Closed
- 30 May 2021
- Medium
- Build: staging
- # 34262
Steps to reproduce the issue
A good example of this is in #34233, specifically this comment #34233 (comment) where you can right click and modify the value of the selected item, and click save, and it is saved in the database.
you do that like this video, and then click save, and then inspect your db and you will see the faked value added to the db
Screen.Recording.2021-05-28.at.05.35.53.pm.mp4
Expected result
That any POSTed value is revalidated against the available options presented when the form was rendered before saving to the db.
Actual result
The unfiltered value is saved to the db
joomla-cms-bot
- | Labels |
Added:
?
|
||
| Title |
|
||||||
| Title |
|
||||||
The field does not validate anything if it not configured to.
where you can right click and modify the value of the selected item, and click save, and it is saved in the database.
For this we have a rule Joomla\CMS\Form\Rule\OptionsRule, to validate whether the value from the list.
That should be used when such validation needed.
For this we have a rule Joomla\CMS\Form\Rule\OptionsRule
Oh sexy... pity its not actually used though :-)
The OptionsRule only works for list fields but not for filelist fields as far as I remember (but I might be wrong).
But I'm currently working on new validation rules.
OptionsRule should work for all fields that provide $field->options property. (At least how it looks in the code).
Filelist field extend the list field, and so also should work.
For the example mentioned here, we could also use the new "FilePathExistsRule" rule (i.e. validate="filePathExists") which will be added by my PR #34277 .
@PhilETaylor Would my PR #34277 close this issue here, or do you want to wait with that until it has been merged and the new rule is used at all places where it's necessary?
Hmm, for filelist and folderlist fields, my new validation rules aren't really necessary because the files or folders have to exist for being added to the options.
But the OptionsRule would work.
So there are 2 ways to go:
- Either add
validate="options"to all fields of type "filelist" or "folderlist" in the XML, or - Let these fields use
validate="options"by default if no other validation is specified.
The 2nd possibility would be a B/C break, I think.
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-05-30 11:18:23 |
| Closed_By | ⇒ | richard67 |
I gave up trying to get a response to this. I think I have 3 open and 2 closed issues =- the last of which was closed "now that j4 was as broken as j3 "