From 10c8d11785be0d4769e9558026b54878ffbbbc16 Mon Sep 17 00:00:00 2001 From: Kijin Sung Date: Thu, 6 Sep 2018 10:00:47 +0900 Subject: [PATCH] Add FeatureDisabled and SecurityViolation exception classes --- classes/module/ModuleHandler.class.php | 8 ++++---- classes/module/ModuleObject.class.php | 2 +- common/lang/en.php | 2 ++ common/lang/ko.php | 2 ++ modules/board/board.view.php | 14 +++++++------- modules/comment/comment.controller.php | 4 ++-- modules/comment/comment.model.php | 4 ++-- modules/document/document.controller.php | 4 ++-- modules/document/document.model.php | 4 ++-- modules/member/member.controller.php | 4 ++-- modules/member/member.view.php | 14 +++++++------- 11 files changed, 33 insertions(+), 29 deletions(-) diff --git a/classes/module/ModuleHandler.class.php b/classes/module/ModuleHandler.class.php index 32eb6acf4..3c091437f 100644 --- a/classes/module/ModuleHandler.class.php +++ b/classes/module/ModuleHandler.class.php @@ -86,7 +86,7 @@ class ModuleHandler extends Handler if($isInvalid) { htmlHeader(); - echo lang("msg_invalid_request"); + echo lang('msg_security_violation'); htmlFooter(); Context::close(); exit; @@ -464,7 +464,7 @@ class ModuleHandler extends Handler if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) { - $this->error = "msg_invalid_request"; + $this->error = 'msg_invalid_request'; $oMessageObject = self::getModuleInstance('message', $display_mode); $oMessageObject->setError(-1); $oMessageObject->setMessage($this->error); @@ -620,7 +620,7 @@ class ModuleHandler extends Handler if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList)) { - $this->error = "msg_invalid_request"; + $this->error = 'msg_security_violation'; $oMessageObject = self::getModuleInstance('message', $display_mode); $oMessageObject->setError(-1); $oMessageObject->setMessage($this->error); @@ -635,7 +635,7 @@ class ModuleHandler extends Handler if($xml_info->action->{$this->act} && $xml_info->action->{$this->act}->check_csrf !== 'false' && !checkCSRF()) { $this->_setInputErrorToContext(); - $this->error = 'msg_invalid_request'; + $this->error = 'msg_security_violation'; $oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); $oMessageObject->setError(-1); $oMessageObject->setMessage($this->error); diff --git a/classes/module/ModuleObject.class.php b/classes/module/ModuleObject.class.php index 0ddb2982d..e6b6d9cfa 100644 --- a/classes/module/ModuleObject.class.php +++ b/classes/module/ModuleObject.class.php @@ -136,7 +136,7 @@ class ModuleObject extends BaseObject // Set privileges(granted) information if($this->setPrivileges() !== true) { - $this->stop('msg_invalid_request'); + $this->stop('msg_not_permitted'); return; } diff --git a/common/lang/en.php b/common/lang/en.php index fd557c7dd..1efd7d499 100644 --- a/common/lang/en.php +++ b/common/lang/en.php @@ -231,6 +231,8 @@ $lang->msg_input_password = 'Please type the password.'; $lang->msg_invalid_document = 'Invalid Article Number'; $lang->msg_invalid_request = 'Invalid Request'; $lang->msg_invalid_password = 'The password you entered is incorrect.'; +$lang->msg_security_violation = 'Security Violation'; +$lang->msg_feature_disabled = 'This feature is disabled.'; $lang->msg_error_occured = 'An error has occured.'; $lang->msg_not_founded = 'Cannot find the target.'; $lang->msg_no_result = 'No results found.'; diff --git a/common/lang/ko.php b/common/lang/ko.php index b5571ba87..76259ed8e 100644 --- a/common/lang/ko.php +++ b/common/lang/ko.php @@ -231,6 +231,8 @@ $lang->msg_input_password = '비밀번호를 입력하세요.'; $lang->msg_invalid_document = '잘못된 문서번호입니다.'; $lang->msg_invalid_request = '잘못된 요청입니다.'; $lang->msg_invalid_password = '비밀번호가 올바르지 않습니다.'; +$lang->msg_security_violation = '보안정책상 허용되지 않습니다.'; +$lang->msg_feature_disabled = '사용할 수 없는 기능입니다.'; $lang->msg_error_occured = '오류가 발생했습니다.'; $lang->msg_not_founded = '대상을 찾을 수 없습니다.'; $lang->msg_no_result = '검색 결과가 없습니다.'; diff --git a/modules/board/board.view.php b/modules/board/board.view.php index 76a4e7899..6a682f401 100644 --- a/modules/board/board.view.php +++ b/modules/board/board.view.php @@ -679,18 +679,18 @@ class boardView extends board $document_srl = Context::get('document_srl'); if(!$document_srl) { - throw new Rhymix\Framework\Exception("msg_invalid_request"); + throw new Rhymix\Framework\Exceptions\InvalidRequest; } if($this->grant->view == false || ($this->module_info->consultation == 'Y' && !$this->grant->manager && !$this->grant->consultation_read)) { - throw new Rhymix\Framework\Exception("msg_not_permitted"); + throw new Rhymix\Framework\Exceptions\NotPermitted; } $oDocument = getModel('document')->getDocument($document_srl); if(!$oDocument->isExists()) { - throw new Rhymix\Framework\Exception("msg_invalid_request"); + throw new Rhymix\Framework\Exceptions\InvalidRequest; } Context::set('oDocument', $oDocument); @@ -960,7 +960,7 @@ class boardView extends board $oDocument = $oDocumentModel->getDocument($document_srl); if(!$oDocument->isExists()) { - return $this->dispBoardMessage('msg_invalid_request'); + return $this->dispBoardMessage('msg_not_founded'); } // Check allow comment @@ -1015,11 +1015,11 @@ class boardView extends board // if the comment is not existed, opoup an error message if(!$oSourceComment->isExists()) { - return $this->dispBoardMessage('msg_invalid_request'); + return $this->dispBoardMessage('msg_not_founded'); } if(Context::get('document_srl') && $oSourceComment->get('document_srl') != Context::get('document_srl')) { - return $this->dispBoardMessage('msg_invalid_request'); + return $this->dispBoardMessage('msg_not_founded'); } // Check allow comment @@ -1102,7 +1102,7 @@ class boardView extends board // if the comment is not exited, alert an error message if(!$oComment->isExists()) { - return $this->dispBoardMessage('msg_invalid_request'); + return $this->dispBoardMessage('msg_not_founded'); } // if the comment is not granted, then back to the password input form diff --git a/modules/comment/comment.controller.php b/modules/comment/comment.controller.php index 24981e66a..27c267b96 100644 --- a/modules/comment/comment.controller.php +++ b/modules/comment/comment.controller.php @@ -315,7 +315,7 @@ class commentController extends comment { if(!$manual_inserted && !checkCSRF()) { - return new BaseObject(-1, 'msg_invalid_request'); + return new BaseObject(-1, 'msg_security_violation'); } if(!is_object($obj)) @@ -717,7 +717,7 @@ class commentController extends comment { if(!$manual_updated && !checkCSRF()) { - return new BaseObject(-1, 'msg_invalid_request'); + return new BaseObject(-1, 'msg_security_violation'); } if(!is_object($obj)) diff --git a/modules/comment/comment.model.php b/modules/comment/comment.model.php index b90c7a009..127454b10 100644 --- a/modules/comment/comment.model.php +++ b/modules/comment/comment.model.php @@ -1003,7 +1003,7 @@ class commentModel extends comment { if($comment_config->use_vote_down != 'S') { - throw new Rhymix\Framework\Exceptions\InvalidRequest; + throw new Rhymix\Framework\Exceptions\FeatureDisabled; } $args->below_point = 0; @@ -1012,7 +1012,7 @@ class commentModel extends comment { if($comment_config->use_vote_up != 'S') { - throw new Rhymix\Framework\Exceptions\InvalidRequest; + throw new Rhymix\Framework\Exceptions\FeatureDisabled; } $args->more_point = 0; diff --git a/modules/document/document.controller.php b/modules/document/document.controller.php index bfcb75e66..b9e99c238 100644 --- a/modules/document/document.controller.php +++ b/modules/document/document.controller.php @@ -347,7 +347,7 @@ class documentController extends document { if(!$manual_inserted && !checkCSRF()) { - return new BaseObject(-1, 'msg_invalid_request'); + return new BaseObject(-1, 'msg_security_violation'); } // begin transaction @@ -576,7 +576,7 @@ class documentController extends document { if(!$manual_updated && !checkCSRF()) { - return new BaseObject(-1, 'msg_invalid_request'); + return new BaseObject(-1, 'msg_security_violation'); } if(!$source_obj->document_srl || !$obj->document_srl) return new BaseObject(-1, 'msg_invalied_request'); diff --git a/modules/document/document.model.php b/modules/document/document.model.php index 3b44d5976..b505d5add 100644 --- a/modules/document/document.model.php +++ b/modules/document/document.model.php @@ -1153,12 +1153,12 @@ class documentModel extends document $document_config = $oModuleModel->getModulePartConfig('document',$module_srl); if($point == -1) { - if($document_config->use_vote_down!='S') throw new Rhymix\Framework\Exceptions\InvalidRequest; + if($document_config->use_vote_down!='S') throw new Rhymix\Framework\Exceptions\FeatureDisabled; $args->below_point = 0; } else { - if($document_config->use_vote_up!='S') throw new Rhymix\Framework\Exceptions\InvalidRequest; + if($document_config->use_vote_up!='S') throw new Rhymix\Framework\Exceptions\FeatureDisabled; $args->more_point = 0; } diff --git a/modules/member/member.controller.php b/modules/member/member.controller.php index 06d33f2b0..6007a54e7 100644 --- a/modules/member/member.controller.php +++ b/modules/member/member.controller.php @@ -578,7 +578,7 @@ class memberController extends member { if (Context::getRequestMethod() == 'GET') { - throw new Rhymix\Framework\Exceptions\InvalidRequest; + throw new Rhymix\Framework\Exceptions\SecurityViolation; } $oMemberModel = &getModel ('member'); @@ -588,7 +588,7 @@ class memberController extends member $trigger_output = ModuleHandler::triggerCall ('member.procMemberInsert', 'before', $config); if(!$trigger_output->toBool ()) return $trigger_output; // Check if an administrator allows a membership - if($config->enable_join != 'Y') throw new Rhymix\Framework\Exception('msg_signup_disabled'); + if($config->enable_join != 'Y') throw new Rhymix\Framework\Exceptions\FeatureDisabled('msg_signup_disabled'); // Check if the user accept the license terms (only if terms exist) $accept_agreement = Context::get('accept_agreement'); diff --git a/modules/member/member.view.php b/modules/member/member.view.php index ba77735a5..b0010ad7d 100644 --- a/modules/member/member.view.php +++ b/modules/member/member.view.php @@ -203,7 +203,7 @@ class memberView extends member $trigger_output = ModuleHandler::triggerCall('member.dispMemberSignUpForm', 'before', $member_config); if(!$trigger_output->toBool()) return $trigger_output; // Error appears if the member is not allowed to join - if($member_config->enable_join != 'Y') throw new Rhymix\Framework\Exception('msg_signup_disabled'); + if($member_config->enable_join != 'Y') throw new Rhymix\Framework\Exceptions\FeatureDisabled('msg_signup_disabled'); $formTags = getAdminView('member')->_getMemberInputTag(); Context::set('formTags', $formTags); @@ -351,7 +351,7 @@ class memberView extends member { if ($this->member_config->features['my_documents'] === false) { - throw new Rhymix\Framework\Exceptions\InvalidRequest; + throw new Rhymix\Framework\Exceptions\FeatureDisabled; } // A message appears if the user is not logged-in @@ -385,7 +385,7 @@ class memberView extends member { if ($this->member_config->features['my_comments'] === false) { - throw new Rhymix\Framework\Exceptions\InvalidRequest; + throw new Rhymix\Framework\Exceptions\FeatureDisabled; } $oMemberModel = getModel('member'); @@ -417,7 +417,7 @@ class memberView extends member { if ($this->member_config->features['scrapped_documents'] === false) { - throw new Rhymix\Framework\Exceptions\InvalidRequest; + throw new Rhymix\Framework\Exceptions\FeatureDisabled; } $oMemberModel = getModel('member'); @@ -493,7 +493,7 @@ class memberView extends member { if ($this->member_config->features['saved_documents'] === false) { - throw new Rhymix\Framework\Exceptions\InvalidRequest; + throw new Rhymix\Framework\Exceptions\FeatureDisabled; } $oMemberModel = getModel('member'); @@ -524,7 +524,7 @@ class memberView extends member { if ($this->member_config->features['active_logins'] === false) { - throw new Rhymix\Framework\Exceptions\InvalidRequest; + throw new Rhymix\Framework\Exceptions\FeatureDisabled; } $logged_info = Context::get('logged_info'); @@ -803,7 +803,7 @@ class memberView extends member { if ($this->member_config->features['nickname_log'] === false || $this->member_config->update_nickname_log != 'Y') { - throw new Rhymix\Framework\Exceptions\InvalidRequest; + throw new Rhymix\Framework\Exceptions\FeatureDisabled; } $member_srl = Context::get('member_srl');