17 files changed, 355 insertions, 40 deletions
diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php
index 1a3083d42e..0d94acfbca 100644
--- a/phpBB/phpbb/auth/provider/oauth/oauth.php
+++ b/phpBB/phpbb/auth/provider/oauth/oauth.php
@@ -634,6 +634,21 @@ class oauth extends \phpbb\auth\provider\base
 	*/
 	protected function link_account_perform_link(array $data)
 	{
+		// Check if the external account is already associated with other user
+		$sql = 'SELECT user_id
+			FROM ' . $this->auth_provider_oauth_token_account_assoc . "
+			WHERE provider = '" . $this->db->sql_escape($data['provider']) . "'
+				AND oauth_provider_id = '" . $this->db->sql_escape($data['oauth_provider_id']) . "'";
+		$result = $this->db->sql_query($sql);
+		$row = $this->db->sql_fetchrow($result);
+		$this->db->sql_freeresult($result);
+
+		if ($row)
+		{
+			trigger_error('AUTH_PROVIDER_OAUTH_ERROR_ALREADY_LINKED');
+		}
+
+		// Link account
 		$sql = 'INSERT INTO ' . $this->auth_provider_oauth_token_account_assoc . '
 			' . $this->db->sql_build_array('INSERT', $data);
 		$this->db->sql_query($sql);
diff --git a/phpBB/phpbb/console/command/extension/enable.php b/phpBB/phpbb/console/command/extension/enable.php
index a6f5b10e86..f007009aa0 100644
--- a/phpBB/phpbb/console/command/extension/enable.php
+++ b/phpBB/phpbb/console/command/extension/enable.php
@@ -69,7 +69,10 @@ class enable extends command
 		}
 		else
 		{
-			$io->error($this->user->lang('CLI_EXTENSION_ENABLE_FAILURE', $name));
+			$enableable = $this->manager->get_extension($name)->is_enableable();
+			$message = !empty($enableable) ? $enableable : $this->user->lang('CLI_EXTENSION_ENABLE_FAILURE');
+			$message = is_array($message) ? implode(PHP_EOL, $message) : $message;
+			$io->error($message, $name);
 			return 1;
 		}
 	}
diff --git a/phpBB/phpbb/db/driver/mysqli.php b/phpBB/phpbb/db/driver/mysqli.php
index df8b88c315..0c1c063262 100644
--- a/phpBB/phpbb/db/driver/mysqli.php
+++ b/phpBB/phpbb/db/driver/mysqli.php
@@ -68,6 +68,9 @@ class mysqli extends \phpbb\db\driver\mysql_base
 
 		if ($this->db_connect_id && $this->dbname != '')
 		{
+			// Disable loading local files on client side
+			@mysqli_options($this->db_connect_id, MYSQLI_OPT_LOCAL_INFILE, false);
+
 			@mysqli_query($this->db_connect_id, "SET NAMES 'utf8'");
 
 			// enforce strict mode on databases that support it
diff --git a/phpBB/phpbb/db/migration/data/v32x/v328.php b/phpBB/phpbb/db/migration/data/v32x/v328.php
new file mode 100644
index 0000000000..28ff2c7033
--- /dev/null
+++ b/phpBB/phpbb/db/migration/data/v32x/v328.php
@@ -0,0 +1,36 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\db\migration\data\v32x;
+
+class v328 extends \phpbb\db\migration\migration
+{
+	public function effectively_installed()
+	{
+		return phpbb_version_compare($this->config['version'], '3.2.8', '>=');
+	}
+
+	static public function depends_on()
+	{
+		return array(
+			'\phpbb\db\migration\data\v32x\v328rc1',
+		);
+	}
+
+	public function update_data()
+	{
+		return array(
+			array('config.update', array('version', '3.2.8')),
+		);
+	}
+}
diff --git a/phpBB/phpbb/db/migration/data/v32x/v328rc1.php b/phpBB/phpbb/db/migration/data/v32x/v328rc1.php
new file mode 100644
index 0000000000..fa43cf33a7
--- /dev/null
+++ b/phpBB/phpbb/db/migration/data/v32x/v328rc1.php
@@ -0,0 +1,37 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\db\migration\data\v32x;
+
+class v328rc1 extends \phpbb\db\migration\migration
+{
+	public function effectively_installed()
+	{
+		return phpbb_version_compare($this->config['version'], '3.2.8-RC1', '>=');
+	}
+
+	static public function depends_on()
+	{
+		return array(
+			'\phpbb\db\migration\data\v32x\timezone_p3',
+			'\phpbb\db\migration\data\v32x\v327',
+		);
+	}
+
+	public function update_data()
+	{
+		return array(
+			array('config.update', array('version', '3.2.8-RC1')),
+		);
+	}
+}
diff --git a/phpBB/phpbb/extension/extension_interface.php b/phpBB/phpbb/extension/extension_interface.php
index 6a6b6adb8f..46072d420c 100644
--- a/phpBB/phpbb/extension/extension_interface.php
+++ b/phpBB/phpbb/extension/extension_interface.php
@@ -22,7 +22,8 @@ interface extension_interface
 	/**
 	* Indicate whether or not the extension can be enabled.
 	*
-	* @return bool
+	* @return bool|array	True if extension is enableable, array of reasons
+	*						if not, false for generic reason.
 	*/
 	public function is_enableable();
 
diff --git a/phpBB/phpbb/filesystem/filesystem.php b/phpBB/phpbb/filesystem/filesystem.php
index 943bce3910..9acead0876 100644
--- a/phpBB/phpbb/filesystem/filesystem.php
+++ b/phpBB/phpbb/filesystem/filesystem.php
@@ -835,7 +835,7 @@ class filesystem implements filesystem_interface
 				$current_path = $resolved_path . '/' . $path_part;
 
 				// Resolve symlinks
-				if (is_link($current_path))
+				if (@is_link($current_path))
 				{
 					if (!function_exists('readlink'))
 					{
@@ -872,12 +872,12 @@ class filesystem implements filesystem_interface
 
 					$resolved_path = false;
 				}
-				else if (is_dir($current_path . '/'))
+				else if (@is_dir($current_path . '/'))
 				{
 					$resolved[] = $path_part;
 					$resolved_path = $current_path;
 				}
-				else if (is_file($current_path))
+				else if (@is_file($current_path))
 				{
 					$resolved[] = $path_part;
 					$resolved_path = $current_path;
diff --git a/phpBB/phpbb/message/form.php b/phpBB/phpbb/message/form.php
index 63bada91ff..6573a04f8b 100644
--- a/phpBB/phpbb/message/form.php
+++ b/phpBB/phpbb/message/form.php
@@ -136,7 +136,7 @@ abstract class form
 	{
 		if (!check_form_key('memberlist_email'))
 		{
-			$this->errors[] = 'FORM_INVALID';
+			$this->errors[] = $this->user->lang('FORM_INVALID');
 		}
 
 		if (!count($this->errors))
diff --git a/phpBB/phpbb/notification/type/approve_post.php b/phpBB/phpbb/notification/type/approve_post.php
index 1e8afec3f9..139b5fabb9 100644
--- a/phpBB/phpbb/notification/type/approve_post.php
+++ b/phpBB/phpbb/notification/type/approve_post.php
@@ -78,10 +78,7 @@ class approve_post extends \phpbb\notification\type\post
 			'ignore_users'		=> array(),
 		), $options);
 
-		$users = array();
-		$users[$post['poster_id']] = $this->notification_manager->get_default_methods();
-
-		return $this->get_authorised_recipients(array_keys($users), $post['forum_id'], array_merge($options, array(
+		return $this->get_authorised_recipients(array($post['poster_id']), $post['forum_id'], array_merge($options, array(
 			'item_type'		=> static::$notification_option['id'],
 		)));
 	}
diff --git a/phpBB/phpbb/notification/type/approve_topic.php b/phpBB/phpbb/notification/type/approve_topic.php
index f0bbf3f6b0..0c343646ee 100644
--- a/phpBB/phpbb/notification/type/approve_topic.php
+++ b/phpBB/phpbb/notification/type/approve_topic.php
@@ -78,10 +78,7 @@ class approve_topic extends \phpbb\notification\type\topic
 			'ignore_users'		=> array(),
 		), $options);
 
-		$users = array();
-		$users[$post['poster_id']] = $this->notification_manager->get_default_methods();
-
-		return $this->get_authorised_recipients(array_keys($users), $post['forum_id'], array_merge($options, array(
+		return $this->get_authorised_recipients(array($post['poster_id']), $post['forum_id'], array_merge($options, array(
 			'item_type'		=> static::$notification_option['id'],
 		)));
 	}
diff --git a/phpBB/phpbb/plupload/plupload.php b/phpBB/phpbb/plupload/plupload.php
index eb698fb35d..9ad12b1082 100644
--- a/phpBB/phpbb/plupload/plupload.php
+++ b/phpBB/phpbb/plupload/plupload.php
@@ -216,38 +216,36 @@ class plupload
 	}
 
 	/**
-	* Looks at the list of allowed extensions and generates a string
-	* appropriate for use in configuring plupload with
-	*
-	* @param \phpbb\cache\service $cache
-	* @param string $forum_id The ID of the forum
-	*
-	* @return string
-	*/
+	 * Looks at the list of allowed extensions and generates a string
+	 * appropriate for use in configuring plupload with
+	 *
+	 * @param \phpbb\cache\service	$cache		Cache service object
+	 * @param string				$forum_id	The forum identifier
+	 *
+	 * @return string
+	 */
 	public function generate_filter_string(\phpbb\cache\service $cache, $forum_id)
 	{
+		$groups = [];
+		$filters = [];
+
 		$attach_extensions = $cache->obtain_attach_extensions($forum_id);
 		unset($attach_extensions['_allowed_']);
-		$groups = array();
 
 		// Re-arrange the extension array to $groups[$group_name][]
 		foreach ($attach_extensions as $extension => $extension_info)
 		{
-			if (!isset($groups[$extension_info['group_name']]))
-			{
-				$groups[$extension_info['group_name']] = array();
-			}
-
-			$groups[$extension_info['group_name']][] = $extension;
+			$groups[$extension_info['group_name']]['extensions'][] = $extension;
+			$groups[$extension_info['group_name']]['max_file_size'] = (int) $extension_info['max_filesize'];
 		}
 
-		$filters = array();
-		foreach ($groups as $group => $extensions)
+		foreach ($groups as $group => $group_info)
 		{
 			$filters[] = sprintf(
-				"{title: '%s', extensions: '%s'}",
+				"{title: '%s', extensions: '%s', max_file_size: %s}",
 				addslashes(ucfirst(strtolower($group))),
-				addslashes(implode(',', $extensions))
+				addslashes(implode(',', $group_info['extensions'])),
+				$group_info['max_file_size']
 			);
 		}
 
diff --git a/phpBB/phpbb/template/twig/extension.php b/phpBB/phpbb/template/twig/extension.php
index c5b3db1aaf..1131a7f3aa 100644
--- a/phpBB/phpbb/template/twig/extension.php
+++ b/phpBB/phpbb/template/twig/extension.php
@@ -30,7 +30,6 @@ class extension extends \Twig_Extension
 	* @param \phpbb\template\context $context
 	* @param \phpbb\template\twig\environment $environment
 	* @param \phpbb\language\language $language
-	* @return \phpbb\template\twig\extension
 	*/
 	public function __construct(\phpbb\template\context $context, \phpbb\template\twig\environment $environment, $language)
 	{
@@ -91,6 +90,7 @@ class extension extends \Twig_Extension
 		return array(
 			new \Twig_SimpleFunction('lang', array($this, 'lang')),
 			new \Twig_SimpleFunction('lang_defined', array($this, 'lang_defined')),
+			new \Twig_SimpleFunction('get_class', 'get_class'),
 		);
 	}
 
@@ -190,10 +190,10 @@ class extension extends \Twig_Extension
 	}
 
 	/**
-	* Check if a language variable exists
-	*
-	* @return bool
-	*/
+	 * Check if a language variable exists
+	 *
+	 * @return bool
+	 */
 	public function lang_defined($key)
 	{
 		return call_user_func_array([$this->language, 'is_set'], [$key]);
diff --git a/phpBB/phpbb/template/twig/extension/avatar.php b/phpBB/phpbb/template/twig/extension/avatar.php
new file mode 100644
index 0000000000..7a17fd4b42
--- /dev/null
+++ b/phpBB/phpbb/template/twig/extension/avatar.php
@@ -0,0 +1,80 @@
+<?php
+/**
+ *
+ * This file is part of the phpBB Forum Software package.
+ *
+ * @copyright (c) phpBB Limited <https://www.phpbb.com>
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ * For full copyright and license information, please see
+ * the docs/CREDITS.txt file.
+ *
+ */
+
+namespace phpbb\template\twig\extension;
+
+class avatar extends \Twig_Extension
+{
+	/**
+	 * Get the name of this extension
+	 *
+	 * @return string
+	 */
+	public function getName()
+	{
+		return 'avatar';
+	}
+
+	/**
+	 * Returns a list of global functions to add to the existing list.
+	 *
+	 * @return array An array of global functions
+	 */
+	public function getFunctions()
+	{
+		return array(
+			new \Twig_SimpleFunction('avatar', array($this, 'get_avatar')),
+		);
+	}
+
+	/**
+	 * Get avatar for placing into templates.
+	 *
+	 * How to use in a template:
+	 * - {{ avatar('mode', row, alt, ignore_config, lazy) }}
+	 *
+	 * The mode and row (group_row or user_row) are required.
+	 * The other fields (alt|ignore_config|lazy) are optional.
+	 *
+	 * @uses \phpbb_get_group_avatar()
+	 * @uses \phpbb_get_user_avatar()
+	 *
+	 * @return string	The avatar HTML for the specified mode
+	 */
+	public function get_avatar()
+	{
+		$args = func_get_args();
+
+		$mode = (string) $args[0];
+		$row = (array) $args[1];
+		$alt = isset($args[2]) ? (string) $args[2] : false;
+		$ignore_config = isset($args[3]) ? (bool) $args[3] : false;
+		$lazy = isset($args[4]) ? (bool) $args[4] : false;
+
+		// To prevent having to redefine alt attribute ('USER_AVATAR'|'GROUP_AVATAR'), we check if an alternative has been provided
+		switch ($mode)
+		{
+			case 'group':
+				return $alt ? phpbb_get_group_avatar($row, $alt, $ignore_config, $lazy) : phpbb_get_group_avatar($row);
+			break;
+
+			case 'user':
+				return $alt ? phpbb_get_user_avatar($row, $alt, $ignore_config, $lazy) : phpbb_get_user_avatar($row);
+			break;
+
+			default:
+				return '';
+			break;
+		}
+	}
+}
diff --git a/phpBB/phpbb/template/twig/extension/config.php b/phpBB/phpbb/template/twig/extension/config.php
new file mode 100644
index 0000000000..cbf6e505c5
--- /dev/null
+++ b/phpBB/phpbb/template/twig/extension/config.php
@@ -0,0 +1,64 @@
+<?php
+/**
+ *
+ * This file is part of the phpBB Forum Software package.
+ *
+ * @copyright (c) phpBB Limited <https://www.phpbb.com>
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ * For full copyright and license information, please see
+ * the docs/CREDITS.txt file.
+ *
+ */
+
+namespace phpbb\template\twig\extension;
+
+class config extends \Twig_Extension
+{
+	/** @var \phpbb\config\config */
+	protected $config;
+
+	/**
+	 * Constructor.
+	 *
+	 * @param \phpbb\config\config	$config		Configuration object
+	 */
+	public function __construct(\phpbb\config\config $config)
+	{
+		$this->config = $config;
+	}
+
+	/**
+	 * Get the name of this extension
+	 *
+	 * @return string
+	 */
+	public function getName()
+	{
+		return 'config';
+	}
+
+	/**
+	 * Returns a list of global functions to add to the existing list.
+	 *
+	 * @return array An array of global functions
+	 */
+	public function getFunctions()
+	{
+		return array(
+			new \Twig_SimpleFunction('config', array($this, 'get_config')),
+		);
+	}
+
+	/**
+	 * Retrieves a configuration value for use in templates.
+	 *
+	 * @return string	The configuration value
+	 */
+	public function get_config()
+	{
+		$args = func_get_args();
+
+		return $this->config->offsetGet($args[0]);
+	}
+}
diff --git a/phpBB/phpbb/template/twig/extension/username.php b/phpBB/phpbb/template/twig/extension/username.php
new file mode 100644
index 0000000000..ef149693a0
--- /dev/null
+++ b/phpBB/phpbb/template/twig/extension/username.php
@@ -0,0 +1,84 @@
+<?php
+/**
+ *
+ * This file is part of the phpBB Forum Software package.
+ *
+ * @copyright (c) phpBB Limited <https://www.phpbb.com>
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ * For full copyright and license information, please see
+ * the docs/CREDITS.txt file.
+ *
+ */
+
+namespace phpbb\template\twig\extension;
+
+class username extends \Twig_Extension
+{
+	/**
+	 * Get the name of this extension
+	 *
+	 * @return string
+	 */
+	public function getName()
+	{
+		return 'username';
+	}
+
+	/**
+	 * Returns a list of global functions to add to the existing list.
+	 *
+	 * @return array An array of global functions
+	 */
+	public function getFunctions()
+	{
+		return array(
+			new \Twig_SimpleFunction('username', array($this, 'get_username')),
+		);
+	}
+
+	/**
+	 * Get username details for placing into templates.
+	 *
+	 * How to use in a template:
+	 * - {{ username('mode', user_id, username, user_colour, guest_username, custom_profile_url) }}
+	 * - {{ username('mode', user_row, guest_username, custom_profile_url) }}
+	 * It's possible to provide the user identifier, name and colour separately,
+	 * or provide the entire user row at once as an array.
+	 *
+	 * The mode, user_id and username are required (separately or through a user row).
+	 * The other fields (user_colour|guest_username|custom_profile_url) are optional.
+	 *
+	 * @uses \get_username_string()
+	 *
+	 * @return string		A string based on what is wanted depending on $mode
+	 */
+	public function get_username()
+	{
+		$args = func_get_args();
+
+		$mode = $args[0];
+		$user = $args[1];
+
+		// If the entire user row is provided
+		if (is_array($user))
+		{
+			$user_id = isset($user['user_id']) ? $user['user_id'] : '';
+			$username = isset($user['username']) ? $user['username'] : '';
+			$user_colour = isset($user['user_colour']) ? $user['user_colour'] : '';
+			$guest_username = isset($args[2]) ? $args[2] : false;
+			$custom_profile_url = isset($args[3]) ? $args[3] : false;
+		}
+		else
+		{
+			// Options are provided separately
+			$user_id = $user;
+			$username = $args[2];
+			$user_colour = isset($args[3]) ? $args[3] : '';
+			$guest_username = isset($args[4]) ? $args[4] : false;
+			$custom_profile_url = isset($args[5]) ? $args[5] : false;
+		}
+
+		return get_username_string($mode, $user_id, $username, $user_colour, $guest_username, $custom_profile_url);
+	}
+}
diff --git a/phpBB/phpbb/textformatter/s9e/factory.php b/phpBB/phpbb/textformatter/s9e/factory.php
index 6191b9a315..dca1c78d40 100644
--- a/phpBB/phpbb/textformatter/s9e/factory.php
+++ b/phpBB/phpbb/textformatter/s9e/factory.php
@@ -110,7 +110,7 @@ class factory implements \phpbb\textformatter\cache_interface
 		'i'     => '<span style="font-style: italic"><xsl:apply-templates/></span>',
 		'u'     => '<span style="text-decoration: underline"><xsl:apply-templates/></span>',
 		'img'   => '<img src="{IMAGEURL}" class="postimage" alt="{L_IMAGE}"/>',
-		'size'  => '<span style="font-size: {FONTSIZE}%; line-height: normal"><xsl:apply-templates/></span>',
+		'size'	=> '<span><xsl:attribute name="style"><xsl:text>font-size: </xsl:text><xsl:value-of select="substring(@size, 1, 4)"/><xsl:text>%; line-height: normal</xsl:text></xsl:attribute><xsl:apply-templates/></span>',
 		'color' => '<span style="color: {COLOR}"><xsl:apply-templates/></span>',
 		'email' => '<a>
 			<xsl:attribute name="href">
diff --git a/phpBB/phpbb/textformatter/s9e/parser.php b/phpBB/phpbb/textformatter/s9e/parser.php
index 3698dca224..a36fc63141 100644
--- a/phpBB/phpbb/textformatter/s9e/parser.php
+++ b/phpBB/phpbb/textformatter/s9e/parser.php
@@ -342,7 +342,7 @@ class parser implements \phpbb\textformatter\parser_interface
 			return false;
 		}
 
-		if ($size < 1)
+		if ($size < 1 || !is_numeric($size))
 		{
 			return false;
 		}