From f9edff2bdd1c79e397c41751a9a69aa32971440f Mon Sep 17 00:00:00 2001
From: Demian Katz <demian.katz@villanova.edu>
Date: Wed, 3 Feb 2016 10:38:52 -0500
Subject: [PATCH] Improved safety for save/delete search.
---
.../Controller/MyResearchController.php | 29 +++++++++++++++++--
1 file changed, 26 insertions(+), 3 deletions(-)
diff --git a/module/VuFind/src/VuFind/Controller/MyResearchController.php b/module/VuFind/src/VuFind/Controller/MyResearchController.php
index 32b0fbaaefb..83e7941aaa7 100644
--- a/module/VuFind/src/VuFind/Controller/MyResearchController.php
+++ b/module/VuFind/src/VuFind/Controller/MyResearchController.php
@@ -268,6 +268,30 @@ class MyResearchController extends AbstractBase
->toUrl($this->getAuthManager()->logout($logoutTarget));
}
+ /**
+ * Support method for savesearchAction(): set the saved flag in a secure
+ * fashion, throwing an exception if somebody attempts something invalid.
+ *
+ * @param int $searchId The search ID to save/unsave
+ * @param bool $saved The new desired state of the saved flag
+ * @param int $userId The user ID requesting the change
+ *
+ * @throws \Exception
+ * @return void
+ */
+ protected function setSavedFlagSecurely($searchId, $saved, $userId)
+ {
+ $searchTable = $this->getTable('Search');
+ $sessId = $this->getServiceLocator()->get('VuFind\SessionManager')->getId();
+ $row = $searchTable->getOwnedRowById($searchId, $sessId, $userId);
+ if (empty($row)) {
+ throw new \Exception('Access denied.');
+ }
+ $row->saved = $saved ? 1 : 0;
+ $row->user_id = $userId;
+ $row->save();
+ }
+
/**
* Handle 'save/unsave search' request
*
@@ -281,12 +305,11 @@ class MyResearchController extends AbstractBase
}
// Check for the save / delete parameters and process them appropriately:
- $search = $this->getTable('Search');
if (($id = $this->params()->fromQuery('save', false)) !== false) {
- $search->setSavedFlag($id, true, $user->id);
+ $this->setSavedFlagSecurely($id, true, $user->id);
$this->flashMessenger()->addMessage('search_save_success', 'success');
} else if (($id = $this->params()->fromQuery('delete', false)) !== false) {
- $search->setSavedFlag($id, false);
+ $this->setSavedFlagSecurely($id, false, $user->id);
$this->flashMessenger()->addMessage('search_unsave_success', 'success');
} else {
throw new \Exception('Missing save and delete parameters.');
--
GitLab