I create a custom service and it shows up in my services configuration (see attached image). When I tested the URL http://localhost/services/seedme/ with Firefox Poster plugin, I actually get back "200 OK" along with the entire source code in my .inc file...the service is returning my source code! This is huge security hole and definitely not the desired behavior.

My service configuration:

  • Server = REST
  • Path to endpoint = services
  • Debug mode disabled
  • no session authentication
  • REST response formatter: json, jsonp
  • REST request parsing: application/json, application/x-www-form-urlencoded

This is my resource definition in my custom module:

function seedme_services_services_resources()
{
    $resources = array ( "seedme" => array (
        "create" => array ( "help" => "Create a new data set",
            "file" => array ( 'file' => 'inc', 'module' => 'seedme_services' ),
            "callback" => "seedme_services_create",
            'access callback' => 'user_access',
            'access arguments' => array ( 'create data set' ),
            /*
            "args" => array ( array (
                "name" => "data",
                "type" => "array",
                "description" => "The data set object",
                "optional" => FALSE ) ) 
            */
            ) ) );
    return ( $resources );
}

and here is what is returned:

<?

function seedme_services_create ( $data )
{
    $debug = fopen ( "/tmp/debug.txt", "a" );
    fwrite ( $debug, "entered seedme_services_create\n" );
    fwrite ( $debug, "data : " . print_r ( $data, TRUE ) . "\n" );

    // First check on required arguments
    if ( empty ( $data ) )
        return services_error ( 'Empty data set received!', 406 );
    if ( empty ( $data['email'] ) )
        return services_error ( 'Missing required email field!', 406 );
    if ( empty ( $data['api'] ) )
        return services_error ( 'Missing required API key field!', 406 );
    if ( empty ( $data['api'] ) )
        return services_error ( 'Missing required API key field!', 406 );

    $node = node_load ( 178 );
    fwrite ( $debug, "node : " . print_r ( $node, TRUE ) . "\n" );

    // Now create the new data set node
    /*
    $node = new stdClass();
    $node->type = 'user_data';
    $node->is_new = TRUE;
    node_save ( $node );
    return ( array ( "nid" => $node->nid ) );
    */
    return;
}
CommentFileSizeAuthor
1.png36.82 KBmonaw

Comments

Torenware’s picture

Funny question, but does your server correctly handle files that start PHP sections with just <?? I know mine won't.

Since it appears that your file is getting included as text rather than as PHP, that would be the first thing I'd look at.

monaw’s picture

So this morning, I used Poster to make the same call and I didn't get the my source code returned anymore...maybe caching was still in affect yesterday, even though I cleared the cache many times after I turned off debugging mode for services.

But I got another error...something about no controller. Then I saw Torenware's posting about my missing "php" on the first line (thanks for catching that!) and fixed my first line to say "<?php". It was still giving me an error about no controller.

After lunch, without any changes to services or my custom module, I made the same call through Poster and it worked. So I think even with caching turned off, the Service stuff is cached somehow.

Ok, onto getting my custom service to actually do something now (:

monaw’s picture

Status: Active » Closed (won't fix)
monaw’s picture

Issue summary: View changes

added request parsing