Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Limit version name to 30 characters, AS-339 #933

Merged
merged 3 commits into from
Nov 27, 2024
Merged

Limit version name to 30 characters, AS-339 #933

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8fd297b
Fixes possible xss via version name, AS-339
AltamashShaikh Nov 26, 2024
bce46c9
Merged with 5.x-dev
AltamashShaikh Nov 26, 2024
13c2500
Fixes for test
AltamashShaikh Nov 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions API.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,9 @@
use Piwik\Plugins\TagManager\Template\Variable\VariablesProvider;
use Exception;
use Piwik\UrlHelper;
use Piwik\Validators\BaseValidator;
use Piwik\Validators\CharacterLength;
use Piwik\Validators\NotEmpty;

/**
* API for plugin Tag Manager.
Expand Down Expand Up @@ -1167,6 +1170,7 @@ public function createContainerVersion($idSite, $idContainer, $name, $descriptio
$this->accessValidator->checkUseCustomTemplatesCapability($idSite);
}
$this->containers->checkContainerExists($idSite, $idContainer);
BaseValidator::check(Piwik::translate('TagManager_VersionName'), $name, [new NotEmpty(), new CharacterLength(1, 30)]);

if (empty($idContainerVersion)) {
$idContainerVersion = $this->getContainerDraftVersion($idSite, $idContainer);
Expand Down Expand Up @@ -1196,6 +1200,7 @@ public function updateContainerVersion($idSite, $idContainer, $idContainerVersio
if (!Piwik::isUserHasCapability($idSite, PublishLiveContainer::ID) && !Piwik::isUserHasCapability($idSite, PublishLiveContainer::ID)) {
$this->accessValidator->checkUseCustomTemplatesCapability($idSite);
}
BaseValidator::check(Piwik::translate('TagManager_VersionName'), $name, [new NotEmpty(), new CharacterLength(1, 30)]);
$this->containers->checkContainerVersionExists($idSite, $idContainer, $idContainerVersion);

return $this->containers->updateContainerVersion($idSite, $idContainer, $idContainerVersion, $name, $description);
Expand Down
2 changes: 1 addition & 1 deletion tests/Fixtures/TagManagerFixture.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@ public function setUpContainers()
$this->idContainer1Version3 = $this->api->createContainerVersion($this->idSite2, $this->idContainer1, 'container1_v3', 'Version from draft with tags, triggers and variables');
$this->idContainer1Version4 = $this->api->createContainerVersion($this->idSite2, $this->idContainer1, 'container1_v4_reversioned', 'new version from an older version', $this->idContainer1Version2);

$this->idContainerQuotesVersion1 = $this->api->createContainerVersion($this->idSite2, $this->idContainerQuotes, 'container1_v4_reversioned "Quotes"', 'new version for quotes container');
$this->idContainerQuotesVersion1 = $this->api->createContainerVersion($this->idSite2, $this->idContainerQuotes, 'container1_v4_rev "Quotes"', 'new version for quotes container');

$this->addContainerVariable($this->idSite2, $this->idContainer1, $this->idContainer1DraftVersion, null, 'My Var 3', array('dataLayerName' => 'dataVarName'), false, [], 'My Var 3 description');

Expand Down
19 changes: 19 additions & 0 deletions tests/Integration/APITest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -384,6 +384,16 @@ public function test_updateContainerVersion_shouldFailWhenContainerVersionDoesNo
$this->api->updateContainerVersion($this->idSite, $this->idContainer, 99999, 'TheName');
}

public function test_updateContainerVersion_shouldThrowExceptionForInvalidNameLength()
{
$this->expectException(\Exception::class);
$this->expectExceptionMessage('Version name: The value contains "48" characters but should contain at most 30 characters.');

$this->setSuperUser();
$idContainerVersion = $this->api->createContainerVersion($this->idSite, $this->idContainer, 'My Name');
$this->api->updateContainerVersion($this->idSite, $this->idContainer, $idContainerVersion, 'My Name very long name should throw an exception', 'TheName');
}

public function test_createContainerVersion_shouldFailWhenNotHavingViewPermissions()
{
$this->expectException(\Piwik\NoAccessException::class);
Expand All @@ -402,6 +412,15 @@ public function test_createContainerVersion_shouldFailWhenContainerVersionDoesNo
$this->api->createContainerVersion($this->idSite, $this->idContainer, 'TheName');
}

public function test_createContainerVersion_shouldThrowExceptionForInvalidNameLength()
{
$this->expectException(\Exception::class);
$this->expectExceptionMessage('Version name: The value contains "48" characters but should contain at most 30 characters.');

$this->setSuperUser();
$this->api->createContainerVersion($this->idSite, $this->idContainer, 'My Name very long name should throw an exception');
}

public function test_deleteContainerVersion_shouldFailWhenNotHavingViewPermissions()
{
$this->expectException(\Piwik\NoAccessException::class);
Expand Down
8 changes: 4 additions & 4 deletions tests/System/expected/test_with_containers__TagManager.getContainers.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
<idsite>2</idsite>
<status>active</status>
<revision>1</revision>
<name>container1_v4_reversioned &quot;Quotes&quot;</name>
<name>container1_v4_rev &quot;Quotes&quot;</name>
<description>new version for quotes container</description>


Expand All @@ -45,7 +45,7 @@
<release_login>superUserLogin</release_login>


<version_name>container1_v4_reversioned &quot;Quotes&quot;</version_name>
<version_name>container1_v4_rev &quot;Quotes&quot;</version_name>
</row>
<row>
<idcontainerrelease>6</idcontainerrelease>
Expand All @@ -57,7 +57,7 @@
<release_login>superUserLogin</release_login>


<version_name>container1_v4_reversioned &quot;Quotes&quot;</version_name>
<version_name>container1_v4_rev &quot;Quotes&quot;</version_name>
</row>
<row>
<idcontainerrelease>7</idcontainerrelease>
Expand All @@ -69,7 +69,7 @@
<release_login>superUserLogin</release_login>


<version_name>container1_v4_reversioned &quot;Quotes&quot;</version_name>
<version_name>container1_v4_rev &quot;Quotes&quot;</version_name>
</row>
<row>
<idcontainerrelease>8</idcontainerrelease>
Expand Down
Loading