View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 15350 | Bug reports | Response browsing | public | 2019-10-01 19:02 | 2019-10-08 10:32 |
| Reporter | DenisChenu | Assigned To | DenisChenu | ||
| Priority | none | Severity | minor | ||
| Status | closed | Resolution | fixed | ||
| Product Version | 3.18.x | ||||
| Fixed in Version | 3.18.x | ||||
| Summary | 15350: Unable to delete saved reponse | ||||
| Description | When browse response, goes to Saved response : click on delete : throw a 500 error : Method saved::index() does not exist | ||||
| Steps To Reproduce | Lauch any survey (no token , with allow save) save | ||||
| Tags | No tags attached. | ||||
| Attached Files | ReflectionException.html (16,992 bytes)
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>ReflectionException</title>
<style type="text/css">
/*<![CDATA[*/
html,body,div,span,applet,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquote,pre,a,abbr,acronym,address,big,cite,code,del,dfn,em,font,img,ins,kbd,q,s,samp,small,strike,strong,sub,sup,tt,var,b,u,i,center,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,table,caption,tbody,tfoot,thead,tr,th,td{border:0;outline:0;font-size:100%;vertical-align:baseline;background:transparent;margin:0;padding:0;}
body{line-height:1;}
ol,ul{list-style:none;}
blockquote,q{quotes:none;}
blockquote:before,blockquote:after,q:before,q:after{content:none;}
:focus{outline:0;}
ins{text-decoration:none;}
del{text-decoration:line-through;}
table{border-collapse:collapse;border-spacing:0;}
body {
font: normal 9pt "Verdana";
color: #000;
background: #fff;
}
h1 {
font: normal 18pt "Verdana";
color: #f00;
margin-bottom: .5em;
}
h2 {
font: normal 14pt "Verdana";
color: #800000;
margin-bottom: .5em;
}
h3 {
font: bold 11pt "Verdana";
}
pre {
font: normal 11pt Menlo, Consolas, "Lucida Console", Monospace;
}
pre span.error {
display: block;
background: #fce3e3;
}
pre span.ln {
color: #999;
padding-right: 0.5em;
border-right: 1px solid #ccc;
}
pre span.error-ln {
font-weight: bold;
}
.container {
margin: 1em 4em;
}
.version {
color: gray;
font-size: 8pt;
border-top: 1px solid #aaa;
padding-top: 1em;
margin-bottom: 1em;
}
.message {
color: #000;
padding: 1em;
font-size: 11pt;
background: #f3f3f3;
-webkit-border-radius: 10px;
-moz-border-radius: 10px;
border-radius: 10px;
margin-bottom: 1em;
line-height: 160%;
}
.source {
margin-bottom: 1em;
}
.code pre {
background-color: #ffe;
margin: 0.5em 0;
padding: 0.5em;
line-height: 125%;
border: 1px solid #eee;
}
.source .file {
margin-bottom: 1em;
font-weight: bold;
}
.traces {
margin: 2em 0;
}
.trace {
margin: 0.5em 0;
padding: 0.5em;
}
.trace.app {
border: 1px dashed #c00;
}
.trace .number {
text-align: right;
width: 2em;
padding: 0.5em;
}
.trace .content {
padding: 0.5em;
}
.trace .plus,
.trace .minus {
display:inline;
vertical-align:middle;
text-align:center;
border:1px solid #000;
color:#000;
font-size:10px;
line-height:10px;
margin:0;
padding:0 1px;
width:10px;
height:10px;
}
.trace.collapsed .minus,
.trace.expanded .plus,
.trace.collapsed pre {
display: none;
}
.trace-file {
cursor: pointer;
padding: 0.2em;
}
.trace-file:hover {
background: #f0ffff;
}
/*]]>*/
</style>
</head>
<body>
<div class="container">
<h1>ReflectionException</h1>
<p class="message">
Method saved::index() does not exist </p>
<div class="source">
<p class="file">/mnt/data/shnoulle/nginx/www/mastervanilla/application/core/Survey_Common_Action.php(78)</p>
<div class="code"><pre><span class="ln">66</span> }
<span class="ln">67</span> // Check if the method is public and of the action class, not its parents
<span class="ln">68</span> // ReflectionClass gets us the methods of the class and parent class
<span class="ln">69</span> // If the above method existence check passed, it might not be neceessary that it is of the action class
<span class="ln">70</span> $oMethod = new ReflectionMethod($this, $sSubAction);
<span class="ln">71</span>
<span class="ln">72</span> // Get the action classes from the admin controller as the urls necessarily do not equal the class names. Eg. survey -> surveyaction
<span class="ln">73</span> $aActions = Yii::app()->getController()->getActionClasses();
<span class="ln">74</span>
<span class="ln">75</span> if (empty($aActions[$this->getId()]) || strtolower($oMethod->getDeclaringClass()->name) != strtolower($aActions[$this->getId()]) || !$oMethod->isPublic()) {
<span class="ln">76</span> // Either action doesn't exist in our whitelist, or the method class doesn't equal the action class or the method isn't public
<span class="ln">77</span> // So let us get the last possible default method, ie. index
<span class="error"><span class="ln error-ln">78</span> $oMethod = new ReflectionMethod($this, $sDefault);
</span><span class="ln">79</span> }
<span class="ln">80</span>
<span class="ln">81</span> // We're all good to go, let's execute it
<span class="ln">82</span> // runWithParamsInternal would automatically get the parameters of the method and populate them as required with the params
<span class="ln">83</span> return parent::runWithParamsInternal($this, $oMethod, $params);
<span class="ln">84</span> }
<span class="ln">85</span>
<span class="ln">86</span> /**
<span class="ln">87</span> * Some functions have different parameters, which are just an alias of the
<span class="ln">88</span> * usual parameters we're getting in the url. This function just populates
<span class="ln">89</span> * those variables so that we don't end up in an error.
<span class="ln">90</span> *
</pre></div> </div>
<div class="traces">
<h2>Stack Trace</h2>
<table style="width:100%;">
<tbody><tr class="trace app expanded">
<td class="number">
#0 </td>
<td class="content">
<div class="trace-file">
<div class="plus">+</div>
<div class="minus">–</div>
/mnt/data/shnoulle/nginx/www/mastervanilla/application/core/Survey_Common_Action.php(78): <strong>ReflectionMethod</strong>-><strong>__construct</strong>(saved, "index") </div>
<div class="code"><pre><span class="ln">73</span> $aActions = Yii::app()->getController()->getActionClasses();
<span class="ln">74</span>
<span class="ln">75</span> if (empty($aActions[$this->getId()]) || strtolower($oMethod->getDeclaringClass()->name) != strtolower($aActions[$this->getId()]) || !$oMethod->isPublic()) {
<span class="ln">76</span> // Either action doesn't exist in our whitelist, or the method class doesn't equal the action class or the method isn't public
<span class="ln">77</span> // So let us get the last possible default method, ie. index
<span class="error"><span class="ln error-ln">78</span> $oMethod = new ReflectionMethod($this, $sDefault);
</span><span class="ln">79</span> }
<span class="ln">80</span>
<span class="ln">81</span> // We're all good to go, let's execute it
<span class="ln">82</span> // runWithParamsInternal would automatically get the parameters of the method and populate them as required with the params
<span class="ln">83</span> return parent::runWithParamsInternal($this, $oMethod, $params);
</pre></div> </td>
</tr>
<tr class="trace core collapsed">
<td class="number">
#1 </td>
<td class="content">
<div class="trace-file">
<div class="plus">+</div>
<div class="minus">–</div>
/mnt/data/shnoulle/nginx/www/mastervanilla/framework/web/CController.php(308): <strong>Survey_Common_Action</strong>-><strong>runWithParams</strong>(array("r"
=> "admin/saved/delete/surveyid/157447/srid/1/scid/1", "delete"
=> "surveyid", 157447 => "srid", 1 => "")) </div>
<div class="code"><pre><span class="ln">303</span> {
<span class="ln">304</span> $priorAction=$this->_action;
<span class="ln">305</span> $this->_action=$action;
<span class="ln">306</span> if($this->beforeAction($action))
<span class="ln">307</span> {
<span class="error"><span class="ln error-ln">308</span> if($action->runWithParams($this->getActionParams())===false)
</span><span class="ln">309</span> $this->invalidActionParams($action);
<span class="ln">310</span> else
<span class="ln">311</span> $this->afterAction($action);
<span class="ln">312</span> }
<span class="ln">313</span> $this->_action=$priorAction;
</pre></div> </td>
</tr>
<tr class="trace core collapsed">
<td class="number">
#2 </td>
<td class="content">
<div class="trace-file">
<div class="plus">+</div>
<div class="minus">–</div>
/mnt/data/shnoulle/nginx/www/mastervanilla/framework/web/CController.php(286): <strong>CController</strong>-><strong>runAction</strong>(saved) </div>
<div class="code"><pre><span class="ln">281</span> * @see runAction
<span class="ln">282</span> */
<span class="ln">283</span> public function runActionWithFilters($action,$filters)
<span class="ln">284</span> {
<span class="ln">285</span> if(empty($filters))
<span class="error"><span class="ln error-ln">286</span> $this->runAction($action);
</span><span class="ln">287</span> else
<span class="ln">288</span> {
<span class="ln">289</span> $priorAction=$this->_action;
<span class="ln">290</span> $this->_action=$action;
<span class="ln">291</span> CFilterChain::create($this,$action,$filters)->run();
</pre></div> </td>
</tr>
<tr class="trace core collapsed">
<td class="number">
#3 </td>
<td class="content">
<div class="trace-file">
<div class="plus">+</div>
<div class="minus">–</div>
/mnt/data/shnoulle/nginx/www/mastervanilla/framework/web/CController.php(265): <strong>CController</strong>-><strong>runActionWithFilters</strong>(saved, array()) </div>
<div class="code"><pre><span class="ln">260</span> {
<span class="ln">261</span> if(($parent=$this->getModule())===null)
<span class="ln">262</span> $parent=Yii::app();
<span class="ln">263</span> if($parent->beforeControllerAction($this,$action))
<span class="ln">264</span> {
<span class="error"><span class="ln error-ln">265</span> $this->runActionWithFilters($action,$this->filters());
</span><span class="ln">266</span> $parent->afterControllerAction($this,$action);
<span class="ln">267</span> }
<span class="ln">268</span> }
<span class="ln">269</span> else
<span class="ln">270</span> $this->missingAction($actionID);
</pre></div> </td>
</tr>
<tr class="trace app expanded">
<td class="number">
#4 </td>
<td class="content">
<div class="trace-file">
<div class="plus">+</div>
<div class="minus">–</div>
/mnt/data/shnoulle/nginx/www/mastervanilla/application/controllers/AdminController.php(158): <strong>CController</strong>-><strong>run</strong>("saved") </div>
<div class="code"><pre><span class="ln">153</span> $this->redirect(array('/admin/authentication/sa/login'));
<span class="ln">154</span> }
<span class="ln">155</span> }
<span class="ln">156</span> }
<span class="ln">157</span>
<span class="error"><span class="ln error-ln">158</span> return parent::run($action);
</span><span class="ln">159</span> }
<span class="ln">160</span>
<span class="ln">161</span> /**
<span class="ln">162</span> * Routes all the actions to their respective places
<span class="ln">163</span> *
</pre></div> </td>
</tr>
<tr class="trace core collapsed">
<td class="number">
#5 </td>
<td class="content">
<div class="trace-file">
<div class="plus">+</div>
<div class="minus">–</div>
/mnt/data/shnoulle/nginx/www/mastervanilla/framework/web/CWebApplication.php(282): <strong>AdminController</strong>-><strong>run</strong>("saved") </div>
<div class="code"><pre><span class="ln">277</span> {
<span class="ln">278</span> list($controller,$actionID)=$ca;
<span class="ln">279</span> $oldController=$this->_controller;
<span class="ln">280</span> $this->_controller=$controller;
<span class="ln">281</span> $controller->init();
<span class="error"><span class="ln error-ln">282</span> $controller->run($actionID);
</span><span class="ln">283</span> $this->_controller=$oldController;
<span class="ln">284</span> }
<span class="ln">285</span> else
<span class="ln">286</span> throw new CHttpException(404,Yii::t('yii','Unable to resolve the request "{route}".',
<span class="ln">287</span> array('{route}'=>$route===''?$this->defaultController:$route)));
</pre></div> </td>
</tr>
<tr class="trace core collapsed">
<td class="number">
#6 </td>
<td class="content">
<div class="trace-file">
<div class="plus">+</div>
<div class="minus">–</div>
/mnt/data/shnoulle/nginx/www/mastervanilla/framework/web/CWebApplication.php(141): <strong>CWebApplication</strong>-><strong>runController</strong>("admin/saved/delete/surveyid/157447/srid/1/scid/1") </div>
<div class="code"><pre><span class="ln">136</span> foreach(array_splice($this->catchAllRequest,1) as $name=>$value)
<span class="ln">137</span> $_GET[$name]=$value;
<span class="ln">138</span> }
<span class="ln">139</span> else
<span class="ln">140</span> $route=$this->getUrlManager()->parseUrl($this->getRequest());
<span class="error"><span class="ln error-ln">141</span> $this->runController($route);
</span><span class="ln">142</span> }
<span class="ln">143</span>
<span class="ln">144</span> /**
<span class="ln">145</span> * Registers the core application components.
<span class="ln">146</span> * This method overrides the parent implementation by registering additional core components.
</pre></div> </td>
</tr>
<tr class="trace core collapsed">
<td class="number">
#7 </td>
<td class="content">
<div class="trace-file">
<div class="plus">+</div>
<div class="minus">–</div>
/mnt/data/shnoulle/nginx/www/mastervanilla/framework/base/CApplication.php(185): <strong>CWebApplication</strong>-><strong>processRequest</strong>() </div>
<div class="code"><pre><span class="ln">180</span> public function run()
<span class="ln">181</span> {
<span class="ln">182</span> if($this->hasEventHandler('onBeginRequest'))
<span class="ln">183</span> $this->onBeginRequest(new CEvent($this));
<span class="ln">184</span> register_shutdown_function(array($this,'end'),0,false);
<span class="error"><span class="ln error-ln">185</span> $this->processRequest();
</span><span class="ln">186</span> if($this->hasEventHandler('onEndRequest'))
<span class="ln">187</span> $this->onEndRequest(new CEvent($this));
<span class="ln">188</span> }
<span class="ln">189</span>
<span class="ln">190</span> /**
</pre></div> </td>
</tr>
<tr class="trace app expanded">
<td class="number">
#8 </td>
<td class="content">
<div class="trace-file">
<div class="plus">+</div>
<div class="minus">–</div>
/mnt/data/shnoulle/nginx/www/mastervanilla/index.php(194): <strong>CApplication</strong>-><strong>run</strong>() </div>
<div class="code"><pre><span class="ln">189</span> require_once APPPATH . 'core/LSYii_Application' . EXT;
<span class="ln">190</span>
<span class="ln">191</span> $config = require_once(APPPATH . 'config/internal' . EXT);
<span class="ln">192</span>
<span class="ln">193</span> Yii::$enableIncludePath = false;
<span class="error"><span class="ln error-ln">194</span> Yii::createApplication('LSYii_Application', $config)->run();
</span><span class="ln">195</span>
<span class="ln">196</span> /* End of file index.php */
<span class="ln">197</span> /* Location: ./index.php */
</pre></div> </td>
</tr>
</tbody></table>
</div>
<div class="version">
2019-10-01 16:59:58 nginx/1.16.1 <a href="http://www.yiiframework.com/">Yii Framework</a>/1.1.21 </div>
</div>
<script type="text/javascript">
/*<![CDATA[*/
var traceReg = new RegExp("(^|\\s)trace-file(\\s|$)");
var collapsedReg = new RegExp("(^|\\s)collapsed(\\s|$)");
var e = document.getElementsByTagName("div");
for(var j=0,len=e.length;j<len;j++){
if(traceReg.test(e[j].className)){
e[j].onclick = function(){
var trace = this.parentNode.parentNode;
if(collapsedReg.test(trace.className))
trace.className = trace.className.replace("collapsed", "expanded");
else
trace.className = trace.className.replace("expanded", "collapsed");
}
}
}
/*]]>*/
</script>
</body></html> | ||||
| Bug heat | 4 | ||||
| Complete LimeSurvey version number (& build) | 3.18.0 | ||||
| I will donate to the project if issue is resolved | No | ||||
| Browser | not relevant ? | ||||
| Database type & version | not relevant ? | ||||
| Server OS (if known) | not relevant ? | ||||
| Webserver software & version (if known) | not relevant ? | ||||
| PHP Version | not relevant ? | ||||
 |
PS : seems delete saved is not CRSF protected ? |
|
|
Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=29164 |
 |
Fixed in Release 3.19.0+191008 |
|
LimeSurvey: master 391dba01 2019-10-04 10:52 Committer: GitHub Details Diff |
Fixed issue 15350: Unable to delete saved reponse Fixed issue [security] : no CRSF control when delete saved response Dev: move to LimeGridView Dev: Add Permission check |
Affected Issues 15350 |
|
| mod - application/controllers/admin/saved.php | Diff File | ||
| mod - application/models/SavedControl.php | Diff File | ||
| mod - application/views/admin/saved/savedlist_view.php | Diff File | ||
| rm - assets/scripts/admin/saved.js | Diff | ||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2019-10-01 19:02 | DenisChenu | New Issue | |
| 2019-10-01 19:02 | DenisChenu | File Added: Capture d’écran du 2019-10-01 19-00-31.png | |
| 2019-10-01 19:02 | DenisChenu | File Added: ReflectionException.html | |
| 2019-10-01 19:02 | DenisChenu | Note Added: 53814 | |
| 2019-10-01 20:20 | DenisChenu | Assigned To | => DenisChenu |
| 2019-10-01 20:20 | DenisChenu | Status | new => assigned |
| 2019-10-04 08:53 | DenisChenu | Changeset attached | => LimeSurvey master 391dba01 |
| 2019-10-04 08:53 | DenisChenu | Note Added: 53870 | |
| 2019-10-04 08:53 | DenisChenu | Resolution | open => fixed |
| 2019-10-04 08:53 | DenisChenu | Status | assigned => resolved |
| 2019-10-04 08:53 | DenisChenu | Fixed in Version | => 3.18.x |
| 2019-10-08 10:32 | lime_release_bot | Note Added: 53937 | |
| 2019-10-08 10:32 | lime_release_bot | Status | resolved => closed |
