FOUR-32464: [Octane] CRITICAL Data Leaks Between Requests, MEDIUM — Accumulating State - #8963
Open
pmPaulis wants to merge 32 commits into
Open
FOUR-32464: [Octane] CRITICAL Data Leaks Between Requests, MEDIUM — Accumulating State #8963pmPaulis wants to merge 32 commits into
pmPaulis wants to merge 32 commits into
Conversation
…lues" Description: Fix Octane data leak by storing landlord config in request-scoped Context Replace SwitchTenant static $landlordValues with Laravel Context to prevent tenant config snapshots from persisting across Octane requests. Remove unused duplicate property from ProcessMakerServiceProvider. Related tickets: https://processmaker.atlassian.net/browse/FOUR-32474
…er::class" Description: Replace AnonymousUser singleton with a scoped binding and add resolve() to load the user from the database per request. Prevents stale anonymous user data from leaking across Octane requests while keeping the same behavior in PHP-FPM and queue workers. Related tickets: https://processmaker.atlassian.net/browse/FOUR-32475
…solution and ensure proper redirect handling
…error response handling
Description: Fix Octane state leak by moving controller addons from static trait property to singleton registry Replace `HasControllerAddons` static `$addons` with `ControllerAddonsRegistry` to prevent addon accumulation across Octane requests while keeping the existing `registerAddon()` and `getPluginAddons()` API unchanged. Related tickets: https://processmaker.atlassian.net/browse/FOUR-32498
FOUR-32465: [Octane] CRITICAL Data Leaks Between Requests "$uid2id"
FOUR-32473: [Octane] CRITICAL Data Leaks Between Requests "$redirectionParams"
…rvice for improved redirect handling and state management
FOUR-32466 Octane CRITICAL Data Leaks Between Requests $processRequest
FOUR-32474 [Octane] CRITICAL Data Leaks Between Requests "$landlordVa…
FOUR-32475 [Octane] CRITICAL Data Leaks Between Requests "AnonymousUs…
FOUR-32498 [Octane] MEDIUM — Accumulating State "addons"
…ocessMaker/processmaker into FOUR-32496
Description: Fix Octane state leak in ServerTimingMiddleware by reading min_package_time from config per request instead of a static property. Add tests for package timing threshold and config refresh between requests. Related tickets: https://processmaker.atlassian.net/browse/FOUR-32507
FOUR-32496 Octane CRITICAL - Data Leaks Between Requests $queryTime
FOUR-32505 Octane MEDIUM — Accumulating State SettingObserver
FOUR-32507 [Octane] MEDIUM — Accumulating State "ServerTimingMiddleware"
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[Octane] CRITICAL Data Leaks Between Requests, MEDIUM — Accumulating State
Related Tickets & Packages
Code Review Checklist