Closed (won't fix)
Project:
Services
Version:
7.x-3.3
Component:
Code
Priority:
Major
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
21 Feb 2013 at 22:39 UTC
Updated:
23 Feb 2013 at 00:07 UTC
I create a custom service and it shows up in my services configuration (see attached image). When I tested the URL http://localhost/services/seedme/ with Firefox Poster plugin, I actually get back "200 OK" along with the entire source code in my .inc file...the service is returning my source code! This is huge security hole and definitely not the desired behavior.
My service configuration:
This is my resource definition in my custom module:
function seedme_services_services_resources()
{
$resources = array ( "seedme" => array (
"create" => array ( "help" => "Create a new data set",
"file" => array ( 'file' => 'inc', 'module' => 'seedme_services' ),
"callback" => "seedme_services_create",
'access callback' => 'user_access',
'access arguments' => array ( 'create data set' ),
/*
"args" => array ( array (
"name" => "data",
"type" => "array",
"description" => "The data set object",
"optional" => FALSE ) )
*/
) ) );
return ( $resources );
}
and here is what is returned:
<?
function seedme_services_create ( $data )
{
$debug = fopen ( "/tmp/debug.txt", "a" );
fwrite ( $debug, "entered seedme_services_create\n" );
fwrite ( $debug, "data : " . print_r ( $data, TRUE ) . "\n" );
// First check on required arguments
if ( empty ( $data ) )
return services_error ( 'Empty data set received!', 406 );
if ( empty ( $data['email'] ) )
return services_error ( 'Missing required email field!', 406 );
if ( empty ( $data['api'] ) )
return services_error ( 'Missing required API key field!', 406 );
if ( empty ( $data['api'] ) )
return services_error ( 'Missing required API key field!', 406 );
$node = node_load ( 178 );
fwrite ( $debug, "node : " . print_r ( $node, TRUE ) . "\n" );
// Now create the new data set node
/*
$node = new stdClass();
$node->type = 'user_data';
$node->is_new = TRUE;
node_save ( $node );
return ( array ( "nid" => $node->nid ) );
*/
return;
}
Comments
Comment #1
Torenware commentedFunny question, but does your server correctly handle files that start PHP sections with just
<?? I know mine won't.Since it appears that your file is getting included as text rather than as PHP, that would be the first thing I'd look at.
Comment #2
monaw commentedSo this morning, I used Poster to make the same call and I didn't get the my source code returned anymore...maybe caching was still in affect yesterday, even though I cleared the cache many times after I turned off debugging mode for services.
But I got another error...something about no controller. Then I saw Torenware's posting about my missing "php" on the first line (thanks for catching that!) and fixed my first line to say "<?php". It was still giving me an error about no controller.
After lunch, without any changes to services or my custom module, I made the same call through Poster and it worked. So I think even with caching turned off, the Service stuff is cached somehow.
Ok, onto getting my custom service to actually do something now (:
Comment #3
monaw commentedComment #3.0
monaw commentedadded request parsing