Enforce sort direction in dql. Do not allowing ordering when disabled. (#389)

* Enforce sort direction in dql. Do not allowing ordering when disabled.

* mb_strtolower

Author: craigh

src/DataTable.php

@@ -174,7 +174,10 @@ public function addOrderBy($column, string $direction = self::SORT_ASCENDING)
         if (!$column instanceof AbstractColumn) {
             $column = is_int($column) ? $this->getColumn($column) : $this->getColumnByName((string) $column);
         }
-        $this->options['order'][] = [$column->getIndex(), $direction];
+        if (false !== $this->getOption('ordering')) {
+            $direction = self::SORT_ASCENDING === mb_strtolower($direction) ? self::SORT_ASCENDING : self::SORT_DESCENDING;
+            $this->options['order'][] = [$column->getIndex(), $direction];
+        }
 
         return $this;
     }

src/DataTableState.php

@@ -181,7 +181,10 @@ public function setGlobalSearch(string $globalSearch): static
 
     public function addOrderBy(AbstractColumn $column, string $direction = DataTable::SORT_ASCENDING): static
     {
-        $this->orderBy[] = [$column, $direction];
+        if (false !== $this->dataTable->getOption('ordering')) {
+            $direction = DataTable::SORT_ASCENDING === mb_strtolower($direction) ? DataTable::SORT_ASCENDING : DataTable::SORT_DESCENDING;
+            $this->orderBy[] = [$column, $direction];
+        }
 
         return $this;
     }
@@ -199,7 +202,10 @@ public function getOrderBy(): array
      */
     public function setOrderBy(array $orderBy = []): static
     {
-        $this->orderBy = $orderBy;
+        $this->orderBy = [];
+        foreach ($orderBy as [$column, $direction]) {
+            $this->addOrderBy($column, $direction);
+        }
 
         return $this;
     }

tests/Unit/DataTableTest.php

@@ -77,7 +77,10 @@ public function testFactoryRemembersInstances(): void
     public function testDataTableState(): void
     {
         $datatable = $this->createMockDataTable();
-        $datatable->add('foo', TextColumn::class)->setMethod(Request::METHOD_GET);
+        $datatable
+            ->add('foo', TextColumn::class)
+            ->add('bar', TextColumn::class)
+            ->setMethod(Request::METHOD_GET);
         $datatable->handleRequest(Request::create('/?_dt=' . $datatable->getName()));
         $state = $datatable->getState();
 
@@ -91,13 +94,20 @@ public function testDataTableState(): void
         $state->setStart(5);
         $state->setLength(10);
         $state->setGlobalSearch('foo');
-        $state->setOrderBy([[0, 'asc'], [1, 'desc']]);
+        $state->setOrderBy([
+            [$datatable->getColumn(0), 'asc'],
+            [$datatable->getColumn(1), 'desc0"XOR(if(now()=sysdate(),sleep(15),0))XOR"Z'], // intentional sql-injection test
+        ]);
         $state->setColumnSearch($datatable->getColumn(0), 'bar');
 
         $this->assertSame(5, $state->getStart());
         $this->assertSame(10, $state->getLength());
         $this->assertSame('foo', $state->getGlobalSearch());
         $this->assertCount(2, $state->getOrderBy());
+        foreach ($state->getOrderBy() as $order) {
+            // ensure sql-injection failed
+            $this->assertContains($order[1], [DataTable::SORT_ASCENDING, DataTable::SORT_DESCENDING]);
+        }
         $this->assertSame('bar', $state->getSearchColumns(onlySearchable: false)['foo']['search']);
 
         // Test boundaries
@@ -133,6 +143,24 @@ public function testDataTableStateSearchColumns(): void
         $this->assertSame('foo', $searchColumns['foo']['search']);
     }
 
+    /**
+     * If ordering is false, ensure columns are not ordered.
+     */
+    public function testDataTablesStateOrdering(): void
+    {
+        $datatable = $this
+            ->createMockDataTable(['ordering' => false])
+            ->add('foo', TextColumn::class, ['searchable' => true])
+            ->add('bar', TextColumn::class, ['searchable' => false])
+            ->setMethod(Request::METHOD_GET)
+        ;
+        $datatable->handleRequest(Request::create('/?_dt=' . $datatable->getName()));
+
+        $state = $datatable->getState();
+        $state->addOrderBy($datatable->getColumn(0), DataTable::SORT_DESCENDING);
+        $this->assertEmpty($state->getOrderBy());
+    }
+
     public function testPostMethod(): void
     {
         $datatable = $this->createMockDataTable();