aboutsummaryrefslogtreecommitdiffstats
path: root/phpBB/includes
diff options
context:
space:
mode:
Diffstat (limited to 'phpBB/includes')
-rw-r--r--phpBB/includes/acp/acp_bbcodes.php12
-rw-r--r--phpBB/includes/acp/acp_board.php1
-rw-r--r--phpBB/includes/acp/acp_prune.php1
-rw-r--r--phpBB/includes/acp/acp_styles.php33
-rw-r--r--phpBB/includes/constants.php2
-rw-r--r--phpBB/includes/functions.php19
-rw-r--r--phpBB/includes/functions_acp.php3
-rw-r--r--phpBB/includes/functions_content.php3
-rw-r--r--phpBB/includes/functions_posting.php5
-rw-r--r--phpBB/includes/functions_privmsgs.php34
-rw-r--r--phpBB/includes/mcp/mcp_topic.php32
-rw-r--r--phpBB/includes/message_parser.php29
-rw-r--r--phpBB/includes/ucp/ucp_pm_compose.php7
13 files changed, 145 insertions, 36 deletions
diff --git a/phpBB/includes/acp/acp_bbcodes.php b/phpBB/includes/acp/acp_bbcodes.php
index 1f7374a07f..56079061ce 100644
--- a/phpBB/includes/acp/acp_bbcodes.php
+++ b/phpBB/includes/acp/acp_bbcodes.php
@@ -33,7 +33,6 @@ class acp_bbcodes
// Set up general vars
$action = $request->variable('action', '');
$bbcode_id = $request->variable('bbcode', 0);
- $submit = $request->is_set_post('submit');
$this->tpl_name = 'acp_bbcodes';
$this->page_title = 'ACP_BBCODES';
@@ -41,11 +40,6 @@ class acp_bbcodes
add_form_key($form_key);
- if ($submit && !check_form_key($form_key))
- {
- trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
- }
-
// Set up mode-specific vars
switch ($action)
{
@@ -179,6 +173,12 @@ class acp_bbcodes
extract($phpbb_dispatcher->trigger_event('core.acp_bbcodes_modify_create', compact($vars)));
$warn_text = preg_match('%<[^>]*\{text[\d]*\}[^>]*>%i', $bbcode_tpl);
+
+ if (!$warn_text && !check_form_key($form_key))
+ {
+ trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+ }
+
if (!$warn_text || confirm_box(true))
{
$data = $this->build_regexp($bbcode_match, $bbcode_tpl);
diff --git a/phpBB/includes/acp/acp_board.php b/phpBB/includes/acp/acp_board.php
index e348c769bd..0730b4e285 100644
--- a/phpBB/includes/acp/acp_board.php
+++ b/phpBB/includes/acp/acp_board.php
@@ -450,6 +450,7 @@ class acp_board
'email_enable' => array('lang' => 'ENABLE_EMAIL', 'validate' => 'bool', 'type' => 'radio:enabled_disabled', 'explain' => true),
'board_email_form' => array('lang' => 'BOARD_EMAIL_FORM', 'validate' => 'bool', 'type' => 'radio:enabled_disabled', 'explain' => true),
'email_package_size' => array('lang' => 'EMAIL_PACKAGE_SIZE', 'validate' => 'int:0', 'type' => 'number:0:99999', 'explain' => true),
+ 'email_max_chunk_size' => array('lang' => 'EMAIL_MAX_CHUNK_SIZE', 'validate' => 'int:1:99999', 'type' => 'number:1:99999', 'explain' => true),
'board_contact' => array('lang' => 'CONTACT_EMAIL', 'validate' => 'email', 'type' => 'email:25:100', 'explain' => true),
'board_contact_name' => array('lang' => 'CONTACT_EMAIL_NAME', 'validate' => 'string', 'type' => 'text:25:50', 'explain' => true),
'board_email' => array('lang' => 'ADMIN_EMAIL', 'validate' => 'email', 'type' => 'email:25:100', 'explain' => true),
diff --git a/phpBB/includes/acp/acp_prune.php b/phpBB/includes/acp/acp_prune.php
index 3eee4f7922..c5f7789de8 100644
--- a/phpBB/includes/acp/acp_prune.php
+++ b/phpBB/includes/acp/acp_prune.php
@@ -537,6 +537,7 @@ class acp_prune
AND ug.user_id <> ' . ANONYMOUS . '
AND u.user_type <> ' . USER_FOUNDER . '
AND ug.user_pending = 0
+ AND ug.group_leader = 0
AND u.user_id = ug.user_id
' . (!empty($user_ids) ? ' AND ' . $db->sql_in_set('ug.user_id', $user_ids) : '');
$result = $db->sql_query($sql);
diff --git a/phpBB/includes/acp/acp_styles.php b/phpBB/includes/acp/acp_styles.php
index 1bf5a3c6a8..87c8d88f52 100644
--- a/phpBB/includes/acp/acp_styles.php
+++ b/phpBB/includes/acp/acp_styles.php
@@ -259,6 +259,19 @@ class acp_styles
// Get list of styles to uninstall
$ids = $this->request_vars('id', 0, true);
+ // Don't remove prosilver, you can still deactivate it.
+ $sql = 'SELECT style_id
+ FROM ' . STYLES_TABLE . "
+ WHERE style_name = '" . $this->db->sql_escape('prosilver') . "'";
+ $result = $this->db->sql_query($sql);
+ $prosilver_id = (int) $this->db->sql_fetchfield('style_id');
+ $this->db->sql_freeresult($result);
+
+ if ($prosilver_id && in_array($prosilver_id, $ids))
+ {
+ trigger_error($this->user->lang('UNINSTALL_PROSILVER') . adm_back_link($this->u_action), E_USER_WARNING);
+ }
+
// Check if confirmation box was submitted
if (confirm_box(true))
{
@@ -998,11 +1011,14 @@ class acp_styles
'L_ACTION' => $this->user->lang['EXPORT']
); */
- // Uninstall
- $actions[] = array(
- 'U_ACTION' => $this->u_action . '&amp;action=uninstall&amp;hash=' . generate_link_hash('uninstall') . '&amp;id=' . $style['style_id'],
- 'L_ACTION' => $this->user->lang['STYLE_UNINSTALL']
- );
+ if ($style['style_name'] !== 'prosilver')
+ {
+ // Uninstall
+ $actions[] = array(
+ 'U_ACTION' => $this->u_action . '&amp;action=uninstall&amp;hash=' . generate_link_hash('uninstall') . '&amp;id=' . $style['style_id'],
+ 'L_ACTION' => $this->user->lang['STYLE_UNINSTALL']
+ );
+ }
// Preview
$actions[] = array(
@@ -1123,7 +1139,14 @@ class acp_styles
*/
protected function read_style_cfg($dir)
{
+ // This should never happen, we give them a red warning because of its relevance.
+ if (!file_exists($this->styles_path . $dir . '/style.cfg'))
+ {
+ trigger_error($this->user->lang('NO_STYLE_CFG', $dir), E_USER_WARNING);
+ }
+
static $required = array('name', 'phpbb_version', 'copyright');
+
$cfg = parse_cfg_file($this->styles_path . $dir . '/style.cfg');
// Check if it is a valid file
diff --git a/phpBB/includes/constants.php b/phpBB/includes/constants.php
index 89d056f2e1..fedd297895 100644
--- a/phpBB/includes/constants.php
+++ b/phpBB/includes/constants.php
@@ -28,7 +28,7 @@ if (!defined('IN_PHPBB'))
*/
// phpBB Version
-@define('PHPBB_VERSION', '3.2.8-dev');
+@define('PHPBB_VERSION', '3.2.8-RC1');
// QA-related
// define('PHPBB_QA', 1);
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index 5cc6826cb9..c9f589c174 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -2364,7 +2364,7 @@ function login_box($redirect = '', $l_explain = '', $l_success = '', $admin = fa
}
// Check form key
- if ($password && !check_form_key($form_name))
+ if ($password && !defined('IN_CHECK_BAN') && !check_form_key($form_name))
{
$result = array(
'status' => false,
@@ -2526,9 +2526,6 @@ function login_box($redirect = '', $l_explain = '', $l_success = '', $admin = fa
));
}
- // Add form token for login box
- add_form_key($form_name, '_LOGIN');
-
$s_hidden_fields = build_hidden_fields($s_hidden_fields);
$login_box_template_data = array(
@@ -2663,9 +2660,6 @@ function login_forum_box($forum_data)
page_header($user->lang['LOGIN']);
- // Add form token for login box
- add_form_key('login', '_LOGIN');
-
$template->assign_vars(array(
'FORUM_NAME' => isset($forum_data['forum_name']) ? $forum_data['forum_name'] : '',
'S_LOGIN_ACTION' => build_url(array('f')),
@@ -4131,9 +4125,9 @@ function phpbb_get_user_avatar($user_row, $alt = 'USER_AVATAR', $ignore_config =
*
* @return string Avatar html
*/
-function phpbb_get_group_avatar($user_row, $alt = 'GROUP_AVATAR', $ignore_config = false, $lazy = false)
+function phpbb_get_group_avatar($group_row, $alt = 'GROUP_AVATAR', $ignore_config = false, $lazy = false)
{
- $row = \phpbb\avatar\manager::clean_row($user_row, 'group');
+ $row = \phpbb\avatar\manager::clean_row($group_row, 'group');
return phpbb_get_avatar($row, $alt, $ignore_config, $lazy);
}
@@ -4439,6 +4433,10 @@ function page_header($page_title = '', $display_online_list = false, $item_id =
$notification_mark_hash = generate_link_hash('mark_all_notifications_read');
$s_login_redirect = build_hidden_fields(array('redirect' => $phpbb_path_helper->remove_web_root_path(build_url())));
+
+ // Add form token for login box, in case page is presenting a login form.
+ add_form_key('login', '_LOGIN');
+
/**
* Workaround for missing template variable in pre phpBB 3.2.6 styles.
* @deprecated 3.2.7 (To be removed: 3.3.0-a1)
@@ -4591,12 +4589,13 @@ function page_header($page_title = '', $display_online_list = false, $item_id =
if ($send_headers)
{
- // An array of http headers that phpbb will set. The following event may override these.
+ // An array of http headers that phpBB will set. The following event may override these.
$http_headers += array(
// application/xhtml+xml not used because of IE
'Content-type' => 'text/html; charset=UTF-8',
'Cache-Control' => 'private, no-cache="set-cookie"',
'Expires' => gmdate('D, d M Y H:i:s', time()) . ' GMT',
+ 'Referrer-Policy' => 'strict-origin-when-cross-origin',
);
if (!empty($user->data['is_bot']))
{
diff --git a/phpBB/includes/functions_acp.php b/phpBB/includes/functions_acp.php
index dd326c3db6..a2014a7d5b 100644
--- a/phpBB/includes/functions_acp.php
+++ b/phpBB/includes/functions_acp.php
@@ -112,12 +112,13 @@ function adm_page_header($page_title)
'CONTAINER_EXCEPTION' => $phpbb_container->hasParameter('container_exception') ? $phpbb_container->getParameter('container_exception') : false,
));
- // An array of http headers that phpbb will set. The following event may override these.
+ // An array of http headers that phpBB will set. The following event may override these.
$http_headers = array(
// application/xhtml+xml not used because of IE
'Content-type' => 'text/html; charset=UTF-8',
'Cache-Control' => 'private, no-cache="set-cookie"',
'Expires' => gmdate('D, d M Y H:i:s', time()) . ' GMT',
+ 'Referrer-Policy' => 'strict-origin-when-cross-origin',
);
/**
diff --git a/phpBB/includes/functions_content.php b/phpBB/includes/functions_content.php
index a15a03f966..2542be5e02 100644
--- a/phpBB/includes/functions_content.php
+++ b/phpBB/includes/functions_content.php
@@ -1482,6 +1482,8 @@ function truncate_string($string, $max_length = 60, $max_store_length = 255, $al
* Get username details for placing into templates.
* This function caches all modes on first call, except for no_profile and anonymous user - determined by $user_id.
*
+* @html Username spans and links
+*
* @param string $mode Can be profile (for getting an url to the profile), username (for obtaining the username), colour (for obtaining the user colour), full (for obtaining a html string representing a coloured link to the users profile) or no_profile (the same as full but forcing no profile link)
* @param int $user_id The users id
* @param string $username The users name
@@ -1501,6 +1503,7 @@ function get_username_string($mode, $user_id, $username, $username_colour = '',
{
global $phpbb_root_path, $phpEx;
+ /** @html Username spans and links for usage in the template */
$_profile_cache['base_url'] = append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=viewprofile&amp;u={USER_ID}');
$_profile_cache['tpl_noprofile'] = '<span class="username">{USERNAME}</span>';
$_profile_cache['tpl_noprofile_colour'] = '<span style="color: {USERNAME_COLOUR};" class="username-coloured">{USERNAME}</span>';
diff --git a/phpBB/includes/functions_posting.php b/phpBB/includes/functions_posting.php
index c5a7400ddf..2cce77e092 100644
--- a/phpBB/includes/functions_posting.php
+++ b/phpBB/includes/functions_posting.php
@@ -2079,6 +2079,11 @@ function submit_post($mode, $subject, $username, $topic_type, &$poll_ary, &$data
continue;
}
+ if (preg_match('/[\x{10000}-\x{10FFFF}]/u', $attach_row['attach_comment']))
+ {
+ trigger_error('ATTACH_COMMENT_NO_EMOJIS');
+ }
+
if (!$attach_row['is_orphan'])
{
// update entry in db if attachment already stored in db and filespace
diff --git a/phpBB/includes/functions_privmsgs.php b/phpBB/includes/functions_privmsgs.php
index baadf5bdee..f07512d623 100644
--- a/phpBB/includes/functions_privmsgs.php
+++ b/phpBB/includes/functions_privmsgs.php
@@ -1985,9 +1985,7 @@ function message_history($msg_id, $user_id, $message_row, $folder, $in_post_mode
$recipients = array_unique($recipients);
// Get History Messages (could be newer)
- $sql = 'SELECT t.*, p.*, u.*
- FROM ' . PRIVMSGS_TABLE . ' p, ' . PRIVMSGS_TO_TABLE . ' t, ' . USERS_TABLE . ' u
- WHERE t.msg_id = p.msg_id
+ $sql_where = 't.msg_id = p.msg_id
AND p.author_id = u.user_id
AND t.folder_id NOT IN (' . PRIVMSGS_NO_BOX . ', ' . PRIVMSGS_HOLD_BOX . ')
AND ' . $db->sql_in_set('t.author_id', $recipients, false, true) . "
@@ -1998,13 +1996,37 @@ function message_history($msg_id, $user_id, $message_row, $folder, $in_post_mode
if (!$message_row['root_level'])
{
- $sql .= " AND (p.root_level = $msg_id OR (p.root_level = 0 AND p.msg_id = $msg_id))";
+ $sql_where .= " AND (p.root_level = $msg_id OR (p.root_level = 0 AND p.msg_id = $msg_id))";
}
else
{
- $sql .= " AND (p.root_level = " . $message_row['root_level'] . ' OR p.msg_id = ' . $message_row['root_level'] . ')';
+ $sql_where .= " AND (p.root_level = " . $message_row['root_level'] . ' OR p.msg_id = ' . $message_row['root_level'] . ')';
}
- $sql .= ' ORDER BY p.message_time DESC';
+
+ $sql_ary = array(
+ 'SELECT' => 't.*, p.*, u.*',
+ 'FROM' => array(
+ PRIVMSGS_TABLE => 'p',
+ PRIVMSGS_TO_TABLE => 't',
+ USERS_TABLE => 'u'
+ ),
+ 'LEFT_JOIN' => array(),
+ 'WHERE' => $sql_where,
+ 'ORDER_BY' => 'p.message_time DESC',
+ );
+
+ /**
+ * Event to modify the SQL query before the message history in private message is queried
+ *
+ * @event core.message_history_modify_sql_ary
+ * @var array sql_ary The SQL array to get the data of the message history in private message
+ * @since 3.2.8-RC1
+ */
+ $vars = array('sql_ary');
+ extract($phpbb_dispatcher->trigger_event('core.message_history_modify_sql_ary', compact($vars)));
+
+ $sql = $db->sql_build_query('SELECT', $sql_ary);
+ unset($sql_ary);
$result = $db->sql_query($sql);
$row = $db->sql_fetchrow($result);
diff --git a/phpBB/includes/mcp/mcp_topic.php b/phpBB/includes/mcp/mcp_topic.php
index 68a65aafdd..83ad56f3e4 100644
--- a/phpBB/includes/mcp/mcp_topic.php
+++ b/phpBB/includes/mcp/mcp_topic.php
@@ -142,14 +142,36 @@ function mcp_topic_view($id, $mode, $action)
}
$start = $pagination->validate_start($start, $posts_per_page, $total);
- $sql = 'SELECT u.username, u.username_clean, u.user_colour, p.*
- FROM ' . POSTS_TABLE . ' p, ' . USERS_TABLE . ' u
- WHERE ' . (($action == 'reports') ? 'p.post_reported = 1 AND ' : '') . '
+ $sql_where = (($action == 'reports') ? 'p.post_reported = 1 AND ' : '') . '
p.topic_id = ' . $topic_id . '
AND ' . $phpbb_content_visibility->get_visibility_sql('post', $topic_info['forum_id'], 'p.') . '
AND p.poster_id = u.user_id ' .
- $limit_time_sql . '
- ORDER BY ' . $sort_order_sql;
+ $limit_time_sql;
+
+ $sql_ary = array(
+ 'SELECT' => 'u.username, u.username_clean, u.user_colour, p.*',
+ 'FROM' => array(
+ POSTS_TABLE => 'p',
+ USERS_TABLE => 'u'
+ ),
+ 'LEFT_JOIN' => array(),
+ 'WHERE' => $sql_where,
+ 'ORDER_BY' => $sort_order_sql,
+ );
+
+ /**
+ * Event to modify the SQL query before the MCP topic review posts is queried
+ *
+ * @event core.mcp_topic_modify_sql_ary
+ * @var array sql_ary The SQL array to get the data of the MCP topic review posts
+ * @since 3.2.8-RC1
+ */
+ $vars = array('sql_ary');
+ extract($phpbb_dispatcher->trigger_event('core.mcp_topic_modify_sql_ary', compact($vars)));
+
+ $sql = $db->sql_build_query('SELECT', $sql_ary);
+ unset($sql_ary);
+
$result = $db->sql_query_limit($sql, $posts_per_page, $start);
$rowset = $post_id_list = array();
diff --git a/phpBB/includes/message_parser.php b/phpBB/includes/message_parser.php
index 0b79cca864..e1c28223dc 100644
--- a/phpBB/includes/message_parser.php
+++ b/phpBB/includes/message_parser.php
@@ -1525,6 +1525,35 @@ class parse_message extends bbcode_firstpass
}
/**
+ * Check attachment form token depending on submit type
+ *
+ * @param \phpbb\language\language $language Language
+ * @param \phpbb\request\request_interface $request Request
+ * @param string $form_name Form name for checking form key
+ *
+ * @return bool True if form token is not needed or valid, false if needed and invalid
+ */
+ function check_attachment_form_token(\phpbb\language\language $language, \phpbb\request\request_interface $request, $form_name)
+ {
+ $add_file = $request->is_set_post('add_file');
+ $delete_file = $request->is_set_post('delete_file');
+
+ if (($add_file || $delete_file) && !check_form_key($form_name))
+ {
+ $this->warn_msg[] = $language->lang('FORM_INVALID');
+
+ if ($request->is_ajax() && $this->plupload)
+ {
+ $this->plupload->emit_error(-400, 'FORM_INVALID');
+ }
+
+ return false;
+ }
+
+ return true;
+ }
+
+ /**
* Parse Attachments
*/
function parse_attachments($form_name, $mode, $forum_id, $submit, $preview, $refresh, $is_message = false)
diff --git a/phpBB/includes/ucp/ucp_pm_compose.php b/phpBB/includes/ucp/ucp_pm_compose.php
index cb45112b01..06baa279a5 100644
--- a/phpBB/includes/ucp/ucp_pm_compose.php
+++ b/phpBB/includes/ucp/ucp_pm_compose.php
@@ -26,7 +26,7 @@ if (!defined('IN_PHPBB'))
function compose_pm($id, $mode, $action, $user_folders = array())
{
global $template, $db, $auth, $user, $cache;
- global $phpbb_root_path, $phpEx, $config;
+ global $phpbb_root_path, $phpEx, $config, $language;
global $request, $phpbb_dispatcher, $phpbb_container;
// Damn php and globals - i know, this is horrible
@@ -799,7 +799,10 @@ function compose_pm($id, $mode, $action, $user_folders = array())
extract($phpbb_dispatcher->trigger_event('core.ucp_pm_compose_modify_parse_before', compact($vars)));
// Parse Attachments - before checksum is calculated
- $message_parser->parse_attachments('fileupload', $action, 0, $submit, $preview, $refresh, true);
+ if ($message_parser->check_attachment_form_token($language, $request, 'ucp_pm_compose'))
+ {
+ $message_parser->parse_attachments('fileupload', $action, 0, $submit, $preview, $refresh, true);
+ }
if (count($message_parser->warn_msg) && !($remove_u || $remove_g || $add_to || $add_bcc))
{