Silverstripe-framework: Security::permissionFailure() assumes session is available

[kinglozzer]

Affected Version

4.x

Description

Security::permissionFailure() attempts to store a back URL in the session without checking whether a session is available on the request object:

https://github.com/silverstripe/silverstripe-framework/blob/d04e54c1bea46c17bb8bf4a3ec661833d4127de6/src/Security/Security.php#L426

This may result in an exception:

BadMethodCallException: "No session available for this HTTPRequest"

I believe this happened because the current request was a NullHTTPRequest. The setup that reached this error is a bit complex (it involves elemental + userforms + elemental-userforms + page access controls), but it’s a simple change to code defensively here.

[robbieaverill]

Yeah, none of HTTPRequest indicates that getRequest() can return null, but I'm pretty sure it can. Do you think this would be a case of "if there's a session, run that logic, else ignore it" or something else like trying to get a session from somewhere else?

[kinglozzer]

Do you think this would be a case of "if there's a session, run that logic, else ignore it" or something else like trying to get a session from somewhere else?

I think the first option is fine, we could achieve that by introducing a simple hasSession() method

[robbieaverill]

Patch at https://github.com/silverstripe/silverstripe-framework/pull/9152

[ScopeyNZ]

Throwing an exception like that in the getter is a bit strange. I'm +1 for the hasSession method.

[robbieaverill]

We can probably do both

[kinglozzer]

Merged https://github.com/silverstripe/silverstripe-framework/pull/9152 but I’ll leave this open until hasSession() is added to a minor release

[robbieaverill]

Sweet, PR at https://github.com/silverstripe/silverstripe-framework/pull/9159