+ <property name="olderversions" value="3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.7-pl1, 3.1.8, 3.1.9, 3.1.10, 3.1.11, 3.1.12, 3.2.0-a1, 3.2.0-a2, 3.2.0-b1, 3.2.0-b2, 3.2.0-RC1, 3.2.0-RC2, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.8-RC1" />

+ var no_role_assigned = "{LA_NO_ROLE_ASSIGNED}";

+

+

+ var parent = t.parentNode;

+ parent.querySelector('span.dropdown-trigger').innerText = no_role_assigned;

+ parent.querySelector('input[data-name^=role]').value = '0';

+

+ // Insert form data

+ var $pluploadForm = $(phpbb.plupload.config.form_hook).first();

+ obj.creation_time = $pluploadForm.find('input[type=hidden][name="creation_time"]').val();

+ obj.form_token = $pluploadForm.find('input[type=hidden][name="form_token"]').val();

+

+

+ // Handle errors while deleting file

+ if (typeof response.error !== 'undefined') {

+ phpbb.alert(phpbb.plupload.lang.ERROR, response.error.message);

+

+ // We will have to assume that the deletion failed. So leave the file status as uploaded.

+ row.find('.file-status').toggleClass('file-uploaded');

+

+ return;

+ }

+

+ <li><a href="#v328rc1">Changes since 3.2.8-RC1</a></li>

+ <a name="v328rc1"></a><h3>Changes since 3.2.8-RC1</h3>

+ <h4>Bug</h4>

+ <ul>

+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-15467">PHPBB3-15467</a>] - Permission settings do not take affect when set using All YES/NO/NEVER</li>

+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16123">PHPBB3-16123</a>] - PHP error (Array to string conversion) on new user registration if email address is banned and &quot; Reason shown to the banned&quot; is empty</li>

+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16136">PHPBB3-16136</a>] - Missing word in 'AUTH_PROVIDER_OAUTH_ERROR_ALREADY_LINKED' </li>

+ </ul>

+ <h4>Improvement</h4>

+ <ul>

+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16134">PHPBB3-16134</a>] - Exclude group leaders on group member purge</li>

+ </ul>

+ <h4>Security Issue</h4>

+ <ul>

+ <li>[SECURITY-243] - CSS injection via BBCode tag</li>

+ <li>[SECURITY-244] - Missing form token check when handling attachments</li>

+ <li>[SECURITY-246] - Missing form token check when managing BBCodes</li>

+ </ul>

+ <h4>Hardening</h4>

+ <ul>

+ <li>[SECURITY-247] - Disable MySQLi local infile to prevent local file inclusion</li>

+ </ul>

+

+ <h4>Hardening</h4>

+ <ul>

+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16101">PHPBB3-16101</a>] - Add Referrer-Policy header</li>

+ </ul>

+* phpBB © Copyright phpBB Limited 2003-2019

+* https://www.phpbb.com

+ MichaelC (Michael Cullum) [11/2017 - 09/2019]

+

+ if (!$warn_text && !check_form_key($form_key))

+ {

+ trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);

+ }

+

+ AND ug.group_leader = 0

+ $ban = $user->check_ban(false, false, $email, true);

+ if (!empty($ban))

+ return !empty($ban['ban_give_reason']) ? $ban['ban_give_reason'] : 'EMAIL_BANNED';

+ * Check attachment form token depending on submit type

+ *

+ * @param \phpbb\language\language $language Language

+ * @param \phpbb\request\request_interface $request Request

+ * @param string $form_name Form name for checking form key

+ *

+ * @return bool True if form token is not needed or valid, false if needed and invalid

+ */

+ function check_attachment_form_token(\phpbb\language\language $language, \phpbb\request\request_interface $request, $form_name)

+ {

+ $add_file = $request->is_set_post('add_file');

+ $delete_file = $request->is_set_post('delete_file');

+

+ if (($add_file || $delete_file) && !check_form_key($form_name))

+ {

+ $this->warn_msg[] = $language->lang('FORM_INVALID');

+

+ if ($request->is_ajax() && $this->plupload)

+ {

+ $this->plupload->emit_error(-400, 'FORM_INVALID');

+ }

+

+ return false;

+ }

+

+ return true;

+ }

+

+ /**

+ global $phpbb_root_path, $phpEx, $config, $language;

+ if ($message_parser->check_attachment_form_token($language, $request, 'ucp_pm_compose'))

+ {

+ $message_parser->parse_attachments('fileupload', $action, 0, $submit, $preview, $refresh, true);

+ }

+define('PHPBB_VERSION', '3.2.8');

+ 'AUTH_PROVIDER_OAUTH_ERROR_ALREADY_LINKED' => 'This external service is already associated with another board account.',

+ // Disable loading local files on client side

+ @mysqli_options($this->db_connect_id, MYSQLI_OPT_LOCAL_INFILE, false);

+

+<?php

+/**

+*

+* This file is part of the phpBB Forum Software package.

+*

+* @copyright (c) phpBB Limited <https://www.phpbb.com>

+* @license GNU General Public License, version 2 (GPL-2.0)

+*

+* For full copyright and license information, please see

+* the docs/CREDITS.txt file.

+*

+*/

+

+namespace phpbb\db\migration\data\v32x;

+

+class v328 extends \phpbb\db\migration\migration

+{

+ public function effectively_installed()

+ {

+ return phpbb_version_compare($this->config['version'], '3.2.8', '>=');

+ }

+

+ static public function depends_on()

+ {

+ return array(

+ '\phpbb\db\migration\data\v32x\v328rc1',

+ );

+ }

+

+ public function update_data()

+ {

+ return array(

+ array('config.update', array('version', '3.2.8')),

+ );

+ }

+}

+ 'size' => '<span><xsl:attribute name="style"><xsl:text>font-size: </xsl:text><xsl:value-of select="substring(@size, 1, 4)"/><xsl:text>%; line-height: normal</xsl:text></xsl:attribute><xsl:apply-templates/></span>',

+ if ($size < 1 || !is_numeric($size))

+ if ($message_parser->check_attachment_form_token($language, $request, 'posting'))

+ {

+ $message_parser->parse_attachments('fileupload', $mode, $forum_id, $submit, $preview, $refresh);

+ }

+ FORM_INVALID: '{LA_FORM_INVALID}',

+ $crawler = self::$client->request(

+ 'GET',

+ 'posting.php?mode=reply&f=2&t=1&sid=' . $this->sid

+ );

+

+ $file_form_data = array_merge(['add_file' => $this->lang('ADD_FILE')], $this->get_hidden_fields($crawler, 'posting.php?mode=reply&f=2&t=1&sid=' . $this->sid));

+

+ $file_form_data,

+ $crawler = self::$client->request('POST', $url . '&sid=' . $this->sid);

+

+ $file_form_data = $this->get_hidden_fields($crawler, $url);

+

+ array_merge(array(

+ ), $file_form_data),

+ $file_form_data = $this->get_hidden_fields(null, $url);

+

+ array_merge(array(

+ ), $file_form_data),

+ <table name="phpbb_banlist">

+ <column>ban_id</column>

+ <column>ban_userid</column>

+ <column>ban_exclude</column>

+ <column>ban_end</column>

+ <column>ban_email</column>

+ <column>ban_give_reason</column>

+ <row>

+ <value>1</value>

+ <value>0</value>

+ <value>0</value>

+ <value>0</value>

+ <value>banned@example.com</value>

+ <value></value>

+ </row>

+ <row>

+ <value>2</value>

+ <value>0</value>

+ <value>0</value>

+ <value>0</value>

+ <value>banned2@example.com</value>

+ <value>just because</value>

+ </row>

+ </table>

+ global $cache, $phpbb_dispatcher, $phpbb_root_path, $phpEx;

+

+ $cache = new \phpbb\cache\driver\file();

+ $cache->purge();

+ $phpbb_dispatcher = new phpbb_mock_event_dispatcher();

+ $language = new phpbb\language\language(new phpbb\language\language_file_loader($phpbb_root_path, $phpEx));

+ $this->user = new phpbb\user($language, '\phpbb\datetime');

+ array('banned', ['just because'], 'banned2@example.com'),

+ array('banned', ['EMAIL_BANNED'], 'banned@example.com')

+ $file_form_data = array_merge(['add_file' => $this->lang('ADD_FILE')], $this->get_hidden_fields($crawler, $posting_url));

+

+ $crawler = self::$client->request('POST', $posting_url, $file_form_data, array('fileupload' => $file));

+ $form_data = array_merge($form_data, $this->get_hidden_fields($crawler, $posting_url));

+

+ /**

+ * Get hidden fields for URL

+ *

+ * @param Symfony\Component\DomCrawler\Crawler|null $crawler Crawler instance or null

+ * @param string $url Request URL

+ *

+ * @return array Hidden form fields array

+ */

+ protected function get_hidden_fields($crawler, $url)

+ {

+ if (!$crawler)

+ {

+ $crawler = self::$client->request('GET', $url);

+ }

+ $hidden_fields = [

+ $crawler->filter('[type="hidden"]')->each(function ($node, $i) {

+ return ['name' => $node->attr('name'), 'value' => $node->attr('value')];

+ }),

+ ];

+

+ $file_form_data = [];

+

+ foreach ($hidden_fields as $fields)

+ {

+ foreach($fields as $field)

+ {

+ $file_form_data[$field['name']] = $field['value'];

+ }

+ }

+

+ return $file_form_data;

+ }

+ '<span style="font-size: 75%; line-height: normal">smaller</span>'

+<span style="font-size: 200%; line-height: normal"></span><div style="text-align:center"><span style="font-size: 200%; line-height: normal">xxx</span></div> \ No newline at end of file