Re: IMPORTANT CakePHP Security Fix

2006-09-07 Thread nate
I happen to know that there are many ways to pass data from the Controller to the View tier, because I put many of them there myself. Mika wrote: > Half a dozen? I only know of 2, linking directly to the controller and > using set. Which others are there? https://trac.cakephp.org/browser/branche

Re: IMPORTANT CakePHP Security Fix

2006-09-07 Thread Bert Van den Brande
Imho there's a big difference between linking the controller directly in the view, and providing an interface with a limited set of 'safe' methods to access certain parts of the controller. On 9/7/06, Mika <[EMAIL PROTECTED]> wrote: > > Half a dozen? I only know of 2, linking directly to the cont

Re: IMPORTANT CakePHP Security Fix

2006-09-06 Thread Mika
Half a dozen? I only know of 2, linking directly to the controller and using set. Which others are there? Also, you say the session helper provides an interface but then isn't that the same as linking the controller to the view? It's also just an interface. --~--~-~--~~~

Re: IMPORTANT CakePHP Security Fix

2006-09-06 Thread nate
There are close to a half-dozen methods for controllers (and components) to pass data to the view. In the case of SessionHelper, it provides an interface to the same core object as SessionComponent, which is perfectly legitimate in terms of MVC design. --~--~-~--~~~-

Re: IMPORTANT CakePHP Security Fix

2006-09-06 Thread Mika
Someguy has a point. If you take out the link to the controller, the helpers will not have access to the controllers and components either. Right? If this is the case then the session helper is breaking that rule itself. --~--~-~--~~~---~--~~ You received this me

Re: IMPORTANT CakePHP Security Fix

2006-09-05 Thread Larry E. Masters aka PhpNut
umm I think you missed the point calzone, you still have access to the controller in the view in that release. I think the release announcement said this release is preparing for the day when the controller will not be in the view. There is nothing in that release that would break your code either.

Re: IMPORTANT CakePHP Security Fix

2006-09-05 Thread calzone
I don't mean to beat a dead horse, but, no, it's not there. That says nothing that isn't already contained in this thread. Please take my words as constructive criticism and understand that cake users are not mind readers. Meanwhile, the manual continues to refer to the session component with

Re: IMPORTANT CakePHP Security Fix

2006-09-05 Thread nate
calzone wrote: > I think you guys have missed the actual point of my post, which is that > I don't see any documentation regarding the lack of controller access > in the view, especially as it concerns people who have been using > $this->controller->Session in their views out of necessity from th

Re: IMPORTANT CakePHP Security Fix

2006-09-05 Thread calzone
I think you guys have missed the actual point of my post, which is that I don't see any documentation regarding the lack of controller access in the view, especially as it concerns people who have been using $this->controller->Session in their views out of necessity from the previous version. I'm

Re: IMPORTANT CakePHP Security Fix

2006-09-05 Thread nate
Even in such cases, I doubt your problem is serious enough to warrant trying to break out of a decades-old software design paradigm for one exception; and if that is the case, you should take a step back and re-think the way in which you're designing that part of the application. --~--~-

Re: IMPORTANT CakePHP Security Fix

2006-09-04 Thread calzone
I have a unique situtation where I am using javascript to write cookies and I am evaluating these cookies to make determinations about the session and whether to output the javascript or not. I'm loathe to split this logical block of code just so I can put my session management in the controller

Re: IMPORTANT CakePHP Security Fix

2006-09-04 Thread Larry E. Masters aka PhpNut
You should not be writting session data from a view anyway, it is not broken.There is no $session->write();-- /*** @author Larry E. Masters* @var string $userName* @param string $realName * @returns string aka PhpNut* @access  public*/ --~--~-~--~~~---~--~~ You rec

Re: IMPORTANT CakePHP Security Fix

2006-09-04 Thread calzone
It appears that $session->write() is broken. Please, before applying dramatic changes, documentation about how to transition would be really helpful. I can't seem to find a single reference to the new session helper anywhere other than here. --~--~-~--~~~---~--~

Re: IMPORTANT CakePHP Security Fix

2006-08-09 Thread someguy
What if you have common functionality across several controllers (but not all or most so I don't want to use appcontroller) that involves both database access and html rendering. Currently I have coded it as a component because it's mainly login and database interaction, even though the html port

Re: IMPORTANT CakePHP Security Fix

2006-08-08 Thread nate
The properties that get copied over from the controller (i.e. $params) will still be available, just not the reference to the controller object itself. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups "Cake PHP" grou

Re: IMPORTANT CakePHP Security Fix

2006-08-08 Thread Albert Siersema
> improvements to the bake script and prepares for the day when the > controller object is not available in the view. Stuff like $this->modelNames[] $this->params['controller'] will stay available ? To avoid massive edits on changes and to have something like copy/paste scaffolding :) i use th

IMPORTANT CakePHP Security Fix

2006-08-05 Thread Larry E. Masters aka PhpNut
All CakePHP users,A kind soul informed us that the Not Found error page can be exploited via inserting _javascript_ code in the address bar. This release provides a fix for this vulnerability. This release also includes some other improvements to the bake script and prepares for the day when the co