[magento] Patch Security for Community Edition

web/app/code/core/Mage/Admin/Model/Observer.php
web/app/code/core/Mage/Core/Controller/Request/Http.php
web/app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
web/app/code/core/Mage/XmlConnect/Model/Observer.php
web/lib/Varien/Db/Adapter/Pdo/Mysql.php


1. Mage_Admin_Model_Observer


/** @var $request Mage_Core_Controller_Request_Http */
        $request = Mage::app()->getRequest();


//if (!$request->getParam('forwarded')) {
                if (!$request->getInternallyForwarded()) {





2. Mage_Core_Controller_Request_Http

/**
     * Flag for recognizing if request internally forwarded
     *
     * @var bool
     */
    protected $_internallyForwarded = false;

/**
     * Define that request was forwarded internally
     *
     * @param boolean $flag
     * @return Mage_Core_Controller_Request_Http
     */
    public function setInternallyForwarded($flag = true)
    {
        $this->_internallyForwarded = (bool)$flag;
        return $this;
    }

    /**
     * Checks if request was forwarded internally
     *
     * @return bool
     */
    public function getInternallyForwarded()
    {
        return $this->_internallyForwarded;
    }



3. Varien_Db_Adapter_Pdo_Mysql

//if (isset($condition['field_expr'])) {
            //    $fieldName = str_replace('#?', $this->quoteIdentifier($fieldName), $condition['field_expr']);
            //    unset($condition['field_expr']);
            //




4. Mage_Oauth_Adminhtml_Oauth_AuthorizeController

//$this->getRequest()->setParam('forwarded', true);
        Mage::app()->getRequest()->setInternallyForwarded();





5. Mage_XmlConnect_Model_Observer

//$request->setParam('forwarded', true)->setDispatched(true);
            $request->setInternallyForwarded()->setDispatched(true);

//$request->setParam('forwarded', true)->setRouteName('adminhtml')->setControllerName('connect_user')
            $request->setInternallyForwarded()->setRouteName('adminhtml')->setControllerName('connect_user')