diff options
| author | Marc Alexander <admin@m-a-styles.de> | 2019-08-25 18:28:08 +0200 |
|---|---|---|
| committer | Marc Alexander <admin@m-a-styles.de> | 2019-08-25 18:28:08 +0200 |
| commit | 79be901cea18960bbcb8571f4e2c0d982d3ca015 (patch) | |
| tree | 9438a09ca35aed1253147e3096021abbca67e27d | |
| parent | 26215517dd04434333bddbc06b9ae92a845fb494 (diff) | |
| parent | f75577e5f858e43e202010f6889bd55096f75ea3 (diff) | |
| download | forums-79be901cea18960bbcb8571f4e2c0d982d3ca015.tar forums-79be901cea18960bbcb8571f4e2c0d982d3ca015.tar.gz forums-79be901cea18960bbcb8571f4e2c0d982d3ca015.tar.bz2 forums-79be901cea18960bbcb8571f4e2c0d982d3ca015.tar.xz forums-79be901cea18960bbcb8571f4e2c0d982d3ca015.zip | |
Merge pull request #51 from phpbb/ticket/security/243
[ticket/security/243] Limit size BBCode to int
| -rw-r--r-- | phpBB/language/en/posting.php | 1 | ||||
| -rw-r--r-- | phpBB/phpbb/textformatter/s9e/factory.php | 2 | ||||
| -rw-r--r-- | phpBB/phpbb/textformatter/s9e/parser.php | 11 | ||||
| -rw-r--r-- | phpBB/styles/prosilver/template/bbcode.html | 2 | ||||
| -rw-r--r-- | tests/text_formatter/s9e/default_formatting_test.php | 2 | ||||
| -rw-r--r-- | tests/text_processing/tickets_data/PHPBB3-13921.html | 2 |
6 files changed, 16 insertions, 4 deletions
diff --git a/phpBB/language/en/posting.php b/phpBB/language/en/posting.php index 426475e77a..570cf63f17 100644 --- a/phpBB/language/en/posting.php +++ b/phpBB/language/en/posting.php @@ -140,6 +140,7 @@ $lang = array_merge($lang, array( 'IMAGES_ARE_OFF' => '[img] is <em>OFF</em>', 'IMAGES_ARE_ON' => '[img] is <em>ON</em>', 'INVALID_FILENAME' => '%s is an invalid filename.', + 'INVALID_FONT_SIZE' => 'The font size you supplied is invalid: %s', 'LOAD' => 'Load', 'LOAD_DRAFT' => 'Load draft', diff --git a/phpBB/phpbb/textformatter/s9e/factory.php b/phpBB/phpbb/textformatter/s9e/factory.php index 6191b9a315..dca1c78d40 100644 --- a/phpBB/phpbb/textformatter/s9e/factory.php +++ b/phpBB/phpbb/textformatter/s9e/factory.php @@ -110,7 +110,7 @@ class factory implements \phpbb\textformatter\cache_interface 'i' => '<span style="font-style: italic"><xsl:apply-templates/></span>', 'u' => '<span style="text-decoration: underline"><xsl:apply-templates/></span>', 'img' => '<img src="{IMAGEURL}" class="postimage" alt="{L_IMAGE}"/>', - 'size' => '<span style="font-size: {FONTSIZE}%; line-height: normal"><xsl:apply-templates/></span>', + 'size' => '<span><xsl:attribute name="style"><xsl:text>font-size: </xsl:text><xsl:value-of select="substring(@size, 1, 4)"/><xsl:text>%; line-height: normal</xsl:text></xsl:attribute><xsl:apply-templates/></span>', 'color' => '<span style="color: {COLOR}"><xsl:apply-templates/></span>', 'email' => '<a> <xsl:attribute name="href"> diff --git a/phpBB/phpbb/textformatter/s9e/parser.php b/phpBB/phpbb/textformatter/s9e/parser.php index 3698dca224..1bc56a8cb4 100644 --- a/phpBB/phpbb/textformatter/s9e/parser.php +++ b/phpBB/phpbb/textformatter/s9e/parser.php @@ -228,6 +228,10 @@ class parser implements \phpbb\textformatter\parser_interface { $errors[] = array($msg); } + else if ($msg === 'INVALID_FONT_SIZE') + { + $errors[] = [$msg, $context['invalid_size']]; + } } // Deduplicate error messages. array_unique() only works on strings so we have to serialize @@ -335,6 +339,13 @@ class parser implements \phpbb\textformatter\parser_interface */ static public function filter_font_size($size, $max_size, Logger $logger) { + if (!is_numeric($size)) + { + $logger->err('INVALID_FONT_SIZE', ['invalid_size' => htmlspecialchars($size)]); + + return false; + } + if ($max_size && $size > $max_size) { $logger->err('MAX_FONT_SIZE_EXCEEDED', array('max_size' => $max_size)); diff --git a/phpBB/styles/prosilver/template/bbcode.html b/phpBB/styles/prosilver/template/bbcode.html index 940c0ace29..f4ec94dbfe 100644 --- a/phpBB/styles/prosilver/template/bbcode.html +++ b/phpBB/styles/prosilver/template/bbcode.html @@ -64,7 +64,7 @@ <!-- BEGIN color --><span style="color: {COLOR}">{TEXT}</span><!-- END color --> -<!-- BEGIN size --><span style="font-size: {SIZE}%; line-height: 116%;">{TEXT}</span><!-- END size --> +<!-- BEGIN size --><span><xsl:attribute name="style"><xsl:text>font-size: </xsl:text><xsl:value-of select="substring(@size, 1, 4)"/><xsl:text>%; line-height: normal</xsl:text></xsl:attribute><xsl:apply-templates/></span><!-- END size --> <!-- BEGIN img --><img src="{URL}" class="postimage" alt="{L_IMAGE}" /><!-- END img --> diff --git a/tests/text_formatter/s9e/default_formatting_test.php b/tests/text_formatter/s9e/default_formatting_test.php index a35c9138a5..1aa4f0bc3a 100644 --- a/tests/text_formatter/s9e/default_formatting_test.php +++ b/tests/text_formatter/s9e/default_formatting_test.php @@ -70,7 +70,7 @@ class phpbb_textformatter_s9e_default_formatting_test extends phpbb_test_case ), array( '[size=75]smaller[/size]', - '<span style="font-size:75%;line-height:normal">smaller</span>' + '<span style="font-size: 75%; line-height: normal">smaller</span>' ), array( '[quote]quoted[/quote]', diff --git a/tests/text_processing/tickets_data/PHPBB3-13921.html b/tests/text_processing/tickets_data/PHPBB3-13921.html index 690668ef28..6a9dc7f504 100644 --- a/tests/text_processing/tickets_data/PHPBB3-13921.html +++ b/tests/text_processing/tickets_data/PHPBB3-13921.html @@ -1 +1 @@ -<span style="font-size:200%;line-height:normal"></span><div style="text-align:center"><span style="font-size:200%;line-height:normal">xxx</span></div>
\ No newline at end of file +<span style="font-size: 200%; line-height: normal"></span><div style="text-align:center"><span style="font-size: 200%; line-height: normal">xxx</span></div>
\ No newline at end of file |