From 557f1a89d512e6c4f4c96033091ab5b429825e6d Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Fri, 14 Aug 2015 09:01:29 +0200 Subject: [ticket/13904] Add filespec class to files classes PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 480 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 480 insertions(+) create mode 100644 phpBB/phpbb/files/filespec.php (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php new file mode 100644 index 0000000000..f74e91b0d5 --- /dev/null +++ b/phpBB/phpbb/files/filespec.php @@ -0,0 +1,480 @@ + + * @license GNU General Public License, version 2 (GPL-2.0) + * + * For full copyright and license information, please see + * the docs/CREDITS.txt file. + * + */ + +namespace phpbb\files; + +/** + * Responsible for holding all file relevant information, as well as doing file-specific operations. + * The {@link fileupload fileupload class} can be used to upload several files, each of them being this object to operate further on. + */ +class filespec +{ + var $filename = ''; + var $realname = ''; + var $uploadname = ''; + var $mimetype = ''; + var $extension = ''; + var $filesize = 0; + var $width = 0; + var $height = 0; + var $image_info = array(); + + var $destination_file = ''; + var $destination_path = ''; + + var $file_moved = false; + var $init_error = false; + var $local = false; + + var $error = array(); + + var $upload = ''; + + /** + * @var \phpbb\filesystem\filesystem_interface + */ + protected $filesystem; + + /** + * The plupload object + * @var \phpbb\plupload\plupload + */ + protected $plupload; + + /** + * phpBB Mimetype guesser + * @var \phpbb\mimetype\guesser + */ + protected $mimetype_guesser; + + /** + * File Class + * @access private + */ + function filespec($upload_ary, $upload_namespace, \phpbb\filesystem\filesystem_interface $phpbb_filesystem, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + { + if (!isset($upload_ary)) + { + $this->init_error = true; + return; + } + + $this->filename = $upload_ary['tmp_name']; + $this->filesize = $upload_ary['size']; + $name = (STRIP) ? stripslashes($upload_ary['name']) : $upload_ary['name']; + $name = trim(utf8_basename($name)); + $this->realname = $this->uploadname = $name; + $this->mimetype = $upload_ary['type']; + + // Opera adds the name to the mime type + $this->mimetype = (strpos($this->mimetype, '; name') !== false) ? str_replace(strstr($this->mimetype, '; name'), '', $this->mimetype) : $this->mimetype; + + if (!$this->mimetype) + { + $this->mimetype = 'application/octet-stream'; + } + + $this->extension = strtolower(self::get_extension($this->realname)); + + // Try to get real filesize from temporary folder (not always working) ;) + $this->filesize = (@filesize($this->filename)) ? @filesize($this->filename) : $this->filesize; + + $this->width = $this->height = 0; + $this->file_moved = false; + + $this->local = (isset($upload_ary['local_mode'])) ? true : false; + $this->upload = $upload_namespace; + $this->plupload = $plupload; + $this->mimetype_guesser = $mimetype_guesser; + $this->filesystem = $phpbb_filesystem; + } + + /** + * Cleans destination filename + * + * @param real|unique|unique_ext $mode real creates a realname, filtering some characters, lowering every character. Unique creates an unique filename + * @param string $prefix Prefix applied to filename + * @param string $user_id The user_id is only needed for when cleaning a user's avatar + * @access public + */ + function clean_filename($mode = 'unique', $prefix = '', $user_id = '') + { + if ($this->init_error) + { + return; + } + + switch ($mode) + { + case 'real': + // Remove every extension from filename (to not let the mime bug being exposed) + if (strpos($this->realname, '.') !== false) + { + $this->realname = substr($this->realname, 0, strpos($this->realname, '.')); + } + + // Replace any chars which may cause us problems with _ + $bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|'); + + $this->realname = rawurlencode(str_replace($bad_chars, '_', strtolower($this->realname))); + $this->realname = preg_replace("/%(\w{2})/", '_', $this->realname); + + $this->realname = $prefix . $this->realname . '.' . $this->extension; + break; + + case 'unique': + $this->realname = $prefix . md5(unique_id()); + break; + + case 'avatar': + $this->extension = strtolower($this->extension); + $this->realname = $prefix . $user_id . '.' . $this->extension; + + break; + + case 'unique_ext': + default: + $this->realname = $prefix . md5(unique_id()) . '.' . $this->extension; + break; + } + } + + /** + * Get property from file object + */ + function get($property) + { + if ($this->init_error || !isset($this->$property)) + { + return false; + } + + return $this->$property; + } + + /** + * Check if file is an image (mimetype) + * + * @return true if it is an image, false if not + */ + function is_image() + { + return (strpos($this->mimetype, 'image/') === 0); + } + + /** + * Check if the file got correctly uploaded + * + * @return true if it is a valid upload, false if not + */ + function is_uploaded() + { + $is_plupload = $this->plupload && $this->plupload->is_active(); + + if (!$this->local && !$is_plupload && !is_uploaded_file($this->filename)) + { + return false; + } + + if (($this->local || $is_plupload) && !file_exists($this->filename)) + { + return false; + } + + return true; + } + + /** + * Remove file + */ + function remove() + { + if ($this->file_moved) + { + @unlink($this->destination_file); + } + } + + /** + * Get file extension + * + * @param string Filename that needs to be checked + * @return string Extension of the supplied filename + */ + static public function get_extension($filename) + { + $filename = utf8_basename($filename); + + if (strpos($filename, '.') === false) + { + return ''; + } + + $filename = explode('.', $filename); + return array_pop($filename); + } + + /** + * Get mimetype + * + * @param string $filename Filename that needs to be checked + * @return string Mimetype of supplied filename + */ + function get_mimetype($filename) + { + if ($this->mimetype_guesser !== null) + { + $mimetype = $this->mimetype_guesser->guess($filename, $this->uploadname); + + if ($mimetype !== 'application/octet-stream') + { + $this->mimetype = $mimetype; + } + } + + return $this->mimetype; + } + + /** + * Get filesize + */ + function get_filesize($filename) + { + return @filesize($filename); + } + + + /** + * Check the first 256 bytes for forbidden content + */ + function check_content($disallowed_content) + { + if (empty($disallowed_content)) + { + return true; + } + + $fp = @fopen($this->filename, 'rb'); + + if ($fp !== false) + { + $ie_mime_relevant = fread($fp, 256); + fclose($fp); + foreach ($disallowed_content as $forbidden) + { + if (stripos($ie_mime_relevant, '<' . $forbidden) !== false) + { + return false; + } + } + } + return true; + } + + /** + * Move file to destination folder + * The phpbb_root_path variable will be applied to the destination path + * + * @param string $destination Destination path, for example $config['avatar_path'] + * @param bool $overwrite If set to true, an already existing file will be overwritten + * @param bool $skip_image_check If set to true, the check for the file to be a valid image is skipped + * @param string $chmod Permission mask for chmodding the file after a successful move. The mode entered here reflects the mode defined by {@link phpbb_chmod()} + * + * @access public + */ + function move_file($destination, $overwrite = false, $skip_image_check = false, $chmod = false) + { + global $user, $phpbb_root_path; + + if (sizeof($this->error)) + { + return false; + } + + $chmod = ($chmod === false) ? CHMOD_READ | CHMOD_WRITE : $chmod; + + // We need to trust the admin in specifying valid upload directories and an attacker not being able to overwrite it... + $this->destination_path = $phpbb_root_path . $destination; + + // Check if the destination path exist... + if (!file_exists($this->destination_path)) + { + @unlink($this->filename); + return false; + } + + $upload_mode = (@ini_get('open_basedir') || @ini_get('safe_mode') || strtolower(@ini_get('safe_mode')) == 'on') ? 'move' : 'copy'; + $upload_mode = ($this->local) ? 'local' : $upload_mode; + $this->destination_file = $this->destination_path . '/' . utf8_basename($this->realname); + + // Check if the file already exist, else there is something wrong... + if (file_exists($this->destination_file) && !$overwrite) + { + @unlink($this->filename); + $this->error[] = $user->lang($this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR', $this->destination_file); + $this->file_moved = false; + return false; + } + else + { + if (file_exists($this->destination_file)) + { + @unlink($this->destination_file); + } + + switch ($upload_mode) + { + case 'copy': + + if (!@copy($this->filename, $this->destination_file)) + { + if (!@move_uploaded_file($this->filename, $this->destination_file)) + { + $this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file); + } + } + + break; + + case 'move': + + if (!@move_uploaded_file($this->filename, $this->destination_file)) + { + if (!@copy($this->filename, $this->destination_file)) + { + $this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file); + } + } + + break; + + case 'local': + + if (!@copy($this->filename, $this->destination_file)) + { + $this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file); + } + + break; + } + + // Remove temporary filename + @unlink($this->filename); + + if (sizeof($this->error)) + { + return false; + } + + try + { + $this->filesystem->phpbb_chmod($this->destination_file, $chmod); + } + catch (\phpbb\filesystem\exception\filesystem_exception $e) + { + // Do nothing + } + } + + // Try to get real filesize from destination folder + $this->filesize = (@filesize($this->destination_file)) ? @filesize($this->destination_file) : $this->filesize; + + // Get mimetype of supplied file + $this->mimetype = $this->get_mimetype($this->destination_file); + + if ($this->is_image() && !$skip_image_check) + { + $this->width = $this->height = 0; + + // Get imagesize class + $imagesize = new \fastImageSize\fastImageSize(); + + $this->image_info = $imagesize->getImageSize($this->destination_file, $this->mimetype); + + if ($this->image_info !== false) + { + $this->width = $this->image_info['width']; + $this->height = $this->image_info['height']; + + // Check image type + $types = fileupload::image_types(); + + if (!isset($types[$this->image_info['type']]) || !in_array($this->extension, $types[$this->image_info['type']])) + { + if (!isset($types[$this->image_info['type']])) + { + $this->error[] = $user->lang('IMAGE_FILETYPE_INVALID', $this->image_info['type'], $this->mimetype); + } + else + { + $this->error[] = $user->lang('IMAGE_FILETYPE_MISMATCH', $types[$this->image_info['type']][0], $this->extension); + } + } + + // Make sure the dimensions match a valid image + if (empty($this->width) || empty($this->height)) + { + $this->error[] = $user->lang['ATTACHED_IMAGE_NOT_IMAGE']; + } + } + else + { + $this->error[] = $user->lang['UNABLE_GET_IMAGE_SIZE']; + } + } + + $this->file_moved = true; + $this->additional_checks(); + unset($this->upload); + + return true; + } + + /** + * Performing additional checks + */ + function additional_checks() + { + global $user; + + if (!$this->file_moved) + { + return false; + } + + // Filesize is too big or it's 0 if it was larger than the maxsize in the upload form + if ($this->upload->max_filesize && ($this->get('filesize') > $this->upload->max_filesize || $this->filesize == 0)) + { + $max_filesize = get_formatted_filesize($this->upload->max_filesize, false); + + $this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'WRONG_FILESIZE'], $max_filesize['value'], $max_filesize['unit']); + + return false; + } + + if (!$this->upload->valid_dimensions($this)) + { + $this->error[] = $user->lang($this->upload->error_prefix . 'WRONG_SIZE', + $user->lang('PIXELS', (int) $this->upload->min_width), + $user->lang('PIXELS', (int) $this->upload->min_height), + $user->lang('PIXELS', (int) $this->upload->max_width), + $user->lang('PIXELS', (int) $this->upload->max_height), + $user->lang('PIXELS', (int) $this->width), + $user->lang('PIXELS', (int) $this->height)); + + return false; + } + + return true; + } +} -- cgit v1.2.1 From c72d6a71bb71b5abeae05b4a6494ffb166624179 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Sun, 31 May 2015 14:02:02 +0200 Subject: [ticket/13904] Modify constructor to be instantiatable by container PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 41 ++++++++++++++++++++++++++++------------- 1 file changed, 28 insertions(+), 13 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index f74e91b0d5..4e52d13d01 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -33,7 +33,6 @@ class filespec var $destination_path = ''; var $file_moved = false; - var $init_error = false; var $local = false; var $error = array(); @@ -61,14 +60,19 @@ class filespec * File Class * @access private */ - function filespec($upload_ary, $upload_namespace, \phpbb\filesystem\filesystem_interface $phpbb_filesystem, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + function filespec(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { - if (!isset($upload_ary)) - { - $this->init_error = true; - return; - } + // @todo call this via files + //$this->set_upload_ary($upload_ary); + //$this->set_upload_namespace($upload_namespace); + $this->plupload = $plupload; + $this->mimetype_guesser = $mimetype_guesser; + $this->filesystem = $phpbb_filesystem; + } + + public function set_upload_ary($upload_ary) + { $this->filename = $upload_ary['tmp_name']; $this->filesize = $upload_ary['size']; $name = (STRIP) ? stripslashes($upload_ary['name']) : $upload_ary['name']; @@ -93,10 +97,21 @@ class filespec $this->file_moved = false; $this->local = (isset($upload_ary['local_mode'])) ? true : false; - $this->upload = $upload_namespace; - $this->plupload = $plupload; - $this->mimetype_guesser = $mimetype_guesser; - $this->filesystem = $phpbb_filesystem; + } + + public function set_upload_namespace($namespace) + { + $this->upload = $namespace; + } + + /** + * Check if class members were not properly initalised yet + * + * @return bool True if there was an init error, false if not + */ + protected function init_error() + { + return !isset($upload_ary); } /** @@ -109,7 +124,7 @@ class filespec */ function clean_filename($mode = 'unique', $prefix = '', $user_id = '') { - if ($this->init_error) + if ($this->init_error()) { return; } @@ -154,7 +169,7 @@ class filespec */ function get($property) { - if ($this->init_error || !isset($this->$property)) + if ($this->init_error() || !isset($this->$property)) { return false; } -- cgit v1.2.1 From 0cbb713cc2a6249cb12507db7d0fa78ce8663ae6 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Sun, 31 May 2015 14:47:57 +0200 Subject: [ticket/13904] Fix uploading for use with new filespec class PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 4e52d13d01..8501b217f7 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -60,7 +60,7 @@ class filespec * File Class * @access private */ - function filespec(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { // @todo call this via files //$this->set_upload_ary($upload_ary); @@ -109,9 +109,9 @@ class filespec * * @return bool True if there was an init error, false if not */ - protected function init_error() + public function init_error() { - return !isset($upload_ary); + return !isset($this->filename); } /** @@ -422,7 +422,7 @@ class filespec $this->height = $this->image_info['height']; // Check image type - $types = fileupload::image_types(); + $types = \fileupload::image_types(); if (!isset($types[$this->image_info['type']]) || !in_array($this->extension, $types[$this->image_info['type']])) { -- cgit v1.2.1 From 92e49cd0acef56b78fda3bcffebb7a0958891b82 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Mon, 1 Jun 2015 13:27:29 +0200 Subject: [ticket/13904] Turn filespec into prototype and improve init methods PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 8501b217f7..3f50488e7c 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -97,11 +97,15 @@ class filespec $this->file_moved = false; $this->local = (isset($upload_ary['local_mode'])) ? true : false; + + return $this; } public function set_upload_namespace($namespace) { $this->upload = $namespace; + + return $this; } /** -- cgit v1.2.1 From 2915647a546b4c0733a0e1a0cdc924272e41615b Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Tue, 2 Jun 2015 00:29:03 +0200 Subject: [ticket/13904] Fix filespec tests PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 3f50488e7c..2fdba2d793 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -426,7 +426,7 @@ class filespec $this->height = $this->image_info['height']; // Check image type - $types = \fileupload::image_types(); + $types = upload::image_types(); if (!isset($types[$this->image_info['type']]) || !in_array($this->extension, $types[$this->image_info['type']])) { -- cgit v1.2.1 From a53825ad760cc8437d8c26eb1f947622c0fcf229 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Tue, 2 Jun 2015 11:48:55 +0200 Subject: [ticket/13904] No longer use fileerror class for extending filespec class PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 2fdba2d793..d14c9a226d 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -118,6 +118,20 @@ class filespec return !isset($this->filename); } + /** + * Set error in error array + * + * @param mixed $error Content for error array + * + * @return \phpbb\files\filespec This instance of the filespec class + */ + public function set_error($error) + { + $this->error[] = $error; + + return $this; + } + /** * Cleans destination filename * -- cgit v1.2.1 From 6541e4cb17d3014151d469b870eac5637ed23071 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Tue, 2 Jun 2015 14:52:09 +0200 Subject: [ticket/13904] Improve doc blocks in filespec class PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 94 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 76 insertions(+), 18 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index d14c9a226d..d091e975d5 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -19,25 +19,50 @@ namespace phpbb\files; */ class filespec { + /** @var string File name */ var $filename = ''; + + /** @var string Real name of file */ var $realname = ''; + + /** @var string Upload name of file */ var $uploadname = ''; + + /** @var string Mimetype of file */ var $mimetype = ''; + + /** @var string File extension */ var $extension = ''; + + /** @var int File size */ var $filesize = 0; + + /** @var int Width of file */ var $width = 0; + + /** @var int Height of file */ var $height = 0; + + /** @var array Image info including type and size */ var $image_info = array(); + /** @var string Destination file name */ var $destination_file = ''; + + /** @var string Destination file path */ var $destination_path = ''; + /** @var bool Whether file was moved */ var $file_moved = false; + + /** @var bool Whether file is local */ var $local = false; + /** @var array Error array */ var $error = array(); - var $upload = ''; + /** @var upload Instance of upload class */ + var $upload; /** * @var \phpbb\filesystem\filesystem_interface @@ -57,20 +82,26 @@ class filespec protected $mimetype_guesser; /** - * File Class - * @access private + * File upload class + * + * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem + * @param \phpbb\mimetype\guesser $mimetype_guesser + * @param \phpbb\plupload\plupload $plupload */ function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { - // @todo call this via files - //$this->set_upload_ary($upload_ary); - //$this->set_upload_namespace($upload_namespace); - $this->plupload = $plupload; $this->mimetype_guesser = $mimetype_guesser; $this->filesystem = $phpbb_filesystem; } + /** + * Set upload ary + * + * @param array $upload_ary Upload ary + * + * @return filespec This instance of the filespec class + */ public function set_upload_ary($upload_ary) { $this->filename = $upload_ary['tmp_name']; @@ -101,6 +132,13 @@ class filespec return $this; } + /** + * Set the upload namespace + * + * @param upload $namespace Instance of upload class + * + * @return filespec This instance of the filespec class + */ public function set_upload_namespace($namespace) { $this->upload = $namespace; @@ -109,7 +147,7 @@ class filespec } /** - * Check if class members were not properly initalised yet + * Check if class members were not properly initialised yet * * @return bool True if there was an init error, false if not */ @@ -135,10 +173,13 @@ class filespec /** * Cleans destination filename * - * @param real|unique|unique_ext $mode real creates a realname, filtering some characters, lowering every character. Unique creates an unique filename + * @param string $mode Either real, unique, or unique_ext. Real creates a + * realname, filtering some characters, lowering every + * character. Unique creates a unique filename. * @param string $prefix Prefix applied to filename * @param string $user_id The user_id is only needed for when cleaning a user's avatar - * @access public + * + *@access public */ function clean_filename($mode = 'unique', $prefix = '', $user_id = '') { @@ -184,6 +225,10 @@ class filespec /** * Get property from file object + * + * @param string $property Name of property + * + * @return mixed Content of property */ function get($property) { @@ -196,9 +241,9 @@ class filespec } /** - * Check if file is an image (mimetype) + * Check if file is an image (mime type) * - * @return true if it is an image, false if not + * @return bool true if it is an image, false if not */ function is_image() { @@ -208,7 +253,7 @@ class filespec /** * Check if the file got correctly uploaded * - * @return true if it is a valid upload, false if not + * @return bool true if it is a valid upload, false if not */ function is_uploaded() { @@ -241,7 +286,8 @@ class filespec /** * Get file extension * - * @param string Filename that needs to be checked + * @param string $filename Filename that needs to be checked + * * @return string Extension of the supplied filename */ static public function get_extension($filename) @@ -258,10 +304,10 @@ class filespec } /** - * Get mimetype + * Get mime type * * @param string $filename Filename that needs to be checked - * @return string Mimetype of supplied filename + * @return string Mime type of supplied filename */ function get_mimetype($filename) { @@ -279,7 +325,11 @@ class filespec } /** - * Get filesize + * Get file size + * + * @param string $filename File name of file to check + * + * @return int File size */ function get_filesize($filename) { @@ -289,6 +339,10 @@ class filespec /** * Check the first 256 bytes for forbidden content + * + * @param array $disallowed_content Array containg disallowed content + * + * @return bool False if disallowed content found, true if not */ function check_content($disallowed_content) { @@ -321,8 +375,10 @@ class filespec * @param string $destination Destination path, for example $config['avatar_path'] * @param bool $overwrite If set to true, an already existing file will be overwritten * @param bool $skip_image_check If set to true, the check for the file to be a valid image is skipped - * @param string $chmod Permission mask for chmodding the file after a successful move. The mode entered here reflects the mode defined by {@link phpbb_chmod()} + * @param string|bool $chmod Permission mask for chmodding the file after a successful move. + * The mode entered here reflects the mode defined by {@link phpbb_chmod()} * + * @return bool True if file was moved, false if not * @access public */ function move_file($destination, $overwrite = false, $skip_image_check = false, $chmod = false) @@ -475,6 +531,8 @@ class filespec /** * Performing additional checks + * + * @return bool False if issue was found, true if not */ function additional_checks() { -- cgit v1.2.1 From 697ac5f4aa151b06ed65f8352652443bf297682a Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Tue, 2 Jun 2015 15:06:24 +0200 Subject: [ticket/13904] Use language class instead of global user in filespec PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 45 +++++++++++++++++++++++------------------- 1 file changed, 25 insertions(+), 20 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index d091e975d5..5e685615d7 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -13,6 +13,8 @@ namespace phpbb\files; +use \phpbb\language\language; + /** * Responsible for holding all file relevant information, as well as doing file-specific operations. * The {@link fileupload fileupload class} can be used to upload several files, each of them being this object to operate further on. @@ -81,18 +83,23 @@ class filespec */ protected $mimetype_guesser; + /** @var \phpbb\language\language Language class */ + protected $language; + /** * File upload class * * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem + * @param \phpbb\language\language $language * @param \phpbb\mimetype\guesser $mimetype_guesser * @param \phpbb\plupload\plupload $plupload */ - function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { $this->plupload = $plupload; $this->mimetype_guesser = $mimetype_guesser; $this->filesystem = $phpbb_filesystem; + $this->language = $language; } /** @@ -383,7 +390,7 @@ class filespec */ function move_file($destination, $overwrite = false, $skip_image_check = false, $chmod = false) { - global $user, $phpbb_root_path; + global $phpbb_root_path; if (sizeof($this->error)) { @@ -410,7 +417,7 @@ class filespec if (file_exists($this->destination_file) && !$overwrite) { @unlink($this->filename); - $this->error[] = $user->lang($this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR', $this->destination_file); + $this->error[] = $this->language->lang($this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR', $this->destination_file); $this->file_moved = false; return false; } @@ -429,7 +436,7 @@ class filespec { if (!@move_uploaded_file($this->filename, $this->destination_file)) { - $this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file); + $this->error[] = $this->language->lang($this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR', $this->destination_file); } } @@ -441,7 +448,7 @@ class filespec { if (!@copy($this->filename, $this->destination_file)) { - $this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file); + $this->error[] = $this->language->lang($this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR', $this->destination_file); } } @@ -451,7 +458,7 @@ class filespec if (!@copy($this->filename, $this->destination_file)) { - $this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file); + $this->error[] = $this->language->lang($this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR', $this->destination_file); } break; @@ -502,23 +509,23 @@ class filespec { if (!isset($types[$this->image_info['type']])) { - $this->error[] = $user->lang('IMAGE_FILETYPE_INVALID', $this->image_info['type'], $this->mimetype); + $this->error[] = $this->language->lang('IMAGE_FILETYPE_INVALID', $this->image_info['type'], $this->mimetype); } else { - $this->error[] = $user->lang('IMAGE_FILETYPE_MISMATCH', $types[$this->image_info['type']][0], $this->extension); + $this->error[] = $this->language->lang('IMAGE_FILETYPE_MISMATCH', $types[$this->image_info['type']][0], $this->extension); } } // Make sure the dimensions match a valid image if (empty($this->width) || empty($this->height)) { - $this->error[] = $user->lang['ATTACHED_IMAGE_NOT_IMAGE']; + $this->error[] = $this->language->lang('ATTACHED_IMAGE_NOT_IMAGE'); } } else { - $this->error[] = $user->lang['UNABLE_GET_IMAGE_SIZE']; + $this->error[] = $this->language->lang('UNABLE_GET_IMAGE_SIZE'); } } @@ -536,8 +543,6 @@ class filespec */ function additional_checks() { - global $user; - if (!$this->file_moved) { return false; @@ -548,20 +553,20 @@ class filespec { $max_filesize = get_formatted_filesize($this->upload->max_filesize, false); - $this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'WRONG_FILESIZE'], $max_filesize['value'], $max_filesize['unit']); + $this->error[] = $this->language->lang($this->upload->error_prefix . 'WRONG_FILESIZE', $max_filesize['value'], $max_filesize['unit']); return false; } if (!$this->upload->valid_dimensions($this)) { - $this->error[] = $user->lang($this->upload->error_prefix . 'WRONG_SIZE', - $user->lang('PIXELS', (int) $this->upload->min_width), - $user->lang('PIXELS', (int) $this->upload->min_height), - $user->lang('PIXELS', (int) $this->upload->max_width), - $user->lang('PIXELS', (int) $this->upload->max_height), - $user->lang('PIXELS', (int) $this->width), - $user->lang('PIXELS', (int) $this->height)); + $this->error[] = $this->language->lang($this->upload->error_prefix . 'WRONG_SIZE', + $this->language->lang('PIXELS', (int) $this->upload->min_width), + $this->language->lang('PIXELS', (int) $this->upload->min_height), + $this->language->lang('PIXELS', (int) $this->upload->max_width), + $this->language->lang('PIXELS', (int) $this->upload->max_height), + $this->language->lang('PIXELS', (int) $this->width), + $this->language->lang('PIXELS', (int) $this->height)); return false; } -- cgit v1.2.1 From b871dbcf1f2d0483cbe19cddf94a5bdc9659ab00 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Tue, 2 Jun 2015 15:46:41 +0200 Subject: [ticket/13904] Remove phpbb_root_path global from filespec class PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 5e685615d7..736610f6c2 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -86,20 +86,25 @@ class filespec /** @var \phpbb\language\language Language class */ protected $language; + /** @var string phpBB root path */ + protected $phpbb_root_path; + /** * File upload class * - * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem - * @param \phpbb\language\language $language - * @param \phpbb\mimetype\guesser $mimetype_guesser - * @param \phpbb\plupload\plupload $plupload + * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem Filesystem + * @param \phpbb\language\language $language Language + * @param string $phpbb_root_path phpBB root path + * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser + * @param \phpbb\plupload\plupload $plupload Plupload */ - function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { $this->plupload = $plupload; $this->mimetype_guesser = $mimetype_guesser; $this->filesystem = $phpbb_filesystem; $this->language = $language; + $this->phpbb_root_path = $phpbb_root_path; } /** @@ -390,8 +395,6 @@ class filespec */ function move_file($destination, $overwrite = false, $skip_image_check = false, $chmod = false) { - global $phpbb_root_path; - if (sizeof($this->error)) { return false; @@ -400,7 +403,7 @@ class filespec $chmod = ($chmod === false) ? CHMOD_READ | CHMOD_WRITE : $chmod; // We need to trust the admin in specifying valid upload directories and an attacker not being able to overwrite it... - $this->destination_path = $phpbb_root_path . $destination; + $this->destination_path = $this->phpbb_root_path . $destination; // Check if the destination path exist... if (!file_exists($this->destination_path)) -- cgit v1.2.1 From 5b21830ba81b5512b7c3f945a899da9103c80558 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Wed, 15 Jul 2015 18:00:26 +0200 Subject: [ticket/13904] Improve docblock PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 736610f6c2..ed64b7ff5c 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -83,7 +83,7 @@ class filespec */ protected $mimetype_guesser; - /** @var \phpbb\language\language Language class */ + /** @var language Language class */ protected $language; /** @var string phpBB root path */ @@ -93,7 +93,7 @@ class filespec * File upload class * * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem Filesystem - * @param \phpbb\language\language $language Language + * @param language $language Language * @param string $phpbb_root_path phpBB root path * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser * @param \phpbb\plupload\plupload $plupload Plupload -- cgit v1.2.1 From 3e99816fa2f184b859d47308254aa8f07d68f1dd Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Thu, 16 Jul 2015 12:06:23 +0200 Subject: [ticket/13904] Set visibility in files and improve test coverage PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 78 +++++++++++++++++++++++------------------- 1 file changed, 43 insertions(+), 35 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index ed64b7ff5c..e07aef9892 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -22,49 +22,52 @@ use \phpbb\language\language; class filespec { /** @var string File name */ - var $filename = ''; + protected $filename = ''; /** @var string Real name of file */ - var $realname = ''; + protected $realname = ''; /** @var string Upload name of file */ - var $uploadname = ''; + protected $uploadname = ''; /** @var string Mimetype of file */ - var $mimetype = ''; + protected $mimetype = ''; /** @var string File extension */ - var $extension = ''; + public $extension = ''; /** @var int File size */ - var $filesize = 0; + public $filesize = 0; /** @var int Width of file */ - var $width = 0; + protected $width = 0; /** @var int Height of file */ - var $height = 0; + protected $height = 0; /** @var array Image info including type and size */ - var $image_info = array(); + protected $image_info = array(); /** @var string Destination file name */ - var $destination_file = ''; + protected $destination_file = ''; /** @var string Destination file path */ - var $destination_path = ''; + protected $destination_path = ''; /** @var bool Whether file was moved */ - var $file_moved = false; + public $file_moved = false; - /** @var bool Whether file is local */ - var $local = false; + /** @var bool Whether file is local */ + public $local = false; + + /** @var bool Class initialization flag */ + protected $class_initialized = false; /** @var array Error array */ - var $error = array(); + public $error = array(); /** @var upload Instance of upload class */ - var $upload; + public $upload; /** * @var \phpbb\filesystem\filesystem_interface @@ -98,7 +101,7 @@ class filespec * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser * @param \phpbb\plupload\plupload $plupload Plupload */ - function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { $this->plupload = $plupload; $this->mimetype_guesser = $mimetype_guesser; @@ -116,6 +119,12 @@ class filespec */ public function set_upload_ary($upload_ary) { + if (!isset($upload_ary) || !sizeof($upload_ary)) + { + return $this; + } + + $this->class_initialized = true; $this->filename = $upload_ary['tmp_name']; $this->filesize = $upload_ary['size']; $name = (STRIP) ? stripslashes($upload_ary['name']) : $upload_ary['name']; @@ -165,7 +174,7 @@ class filespec */ public function init_error() { - return !isset($this->filename); + return !$this->class_initialized; } /** @@ -193,7 +202,7 @@ class filespec * *@access public */ - function clean_filename($mode = 'unique', $prefix = '', $user_id = '') + public function clean_filename($mode = 'unique', $prefix = '', $user_id = '') { if ($this->init_error()) { @@ -216,22 +225,21 @@ class filespec $this->realname = preg_replace("/%(\w{2})/", '_', $this->realname); $this->realname = $prefix . $this->realname . '.' . $this->extension; - break; + break; case 'unique': $this->realname = $prefix . md5(unique_id()); - break; + break; case 'avatar': $this->extension = strtolower($this->extension); $this->realname = $prefix . $user_id . '.' . $this->extension; - break; + break; case 'unique_ext': default: $this->realname = $prefix . md5(unique_id()) . '.' . $this->extension; - break; } } @@ -242,7 +250,7 @@ class filespec * * @return mixed Content of property */ - function get($property) + public function get($property) { if ($this->init_error() || !isset($this->$property)) { @@ -257,7 +265,7 @@ class filespec * * @return bool true if it is an image, false if not */ - function is_image() + public function is_image() { return (strpos($this->mimetype, 'image/') === 0); } @@ -267,7 +275,7 @@ class filespec * * @return bool true if it is a valid upload, false if not */ - function is_uploaded() + public function is_uploaded() { $is_plupload = $this->plupload && $this->plupload->is_active(); @@ -287,7 +295,7 @@ class filespec /** * Remove file */ - function remove() + public function remove() { if ($this->file_moved) { @@ -321,7 +329,7 @@ class filespec * @param string $filename Filename that needs to be checked * @return string Mime type of supplied filename */ - function get_mimetype($filename) + public function get_mimetype($filename) { if ($this->mimetype_guesser !== null) { @@ -343,7 +351,7 @@ class filespec * * @return int File size */ - function get_filesize($filename) + public function get_filesize($filename) { return @filesize($filename); } @@ -356,7 +364,7 @@ class filespec * * @return bool False if disallowed content found, true if not */ - function check_content($disallowed_content) + public function check_content($disallowed_content) { if (empty($disallowed_content)) { @@ -393,7 +401,7 @@ class filespec * @return bool True if file was moved, false if not * @access public */ - function move_file($destination, $overwrite = false, $skip_image_check = false, $chmod = false) + public function move_file($destination, $overwrite = false, $skip_image_check = false, $chmod = false) { if (sizeof($this->error)) { @@ -443,7 +451,7 @@ class filespec } } - break; + break; case 'move': @@ -455,7 +463,7 @@ class filespec } } - break; + break; case 'local': @@ -464,7 +472,7 @@ class filespec $this->error[] = $this->language->lang($this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR', $this->destination_file); } - break; + break; } // Remove temporary filename @@ -544,7 +552,7 @@ class filespec * * @return bool False if issue was found, true if not */ - function additional_checks() + public function additional_checks() { if (!$this->file_moved) { -- cgit v1.2.1 From cdde86ce7e0c594fad5992789b3fae466bd526cc Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Wed, 26 Aug 2015 13:57:42 +0200 Subject: [ticket/13904] Use \phpbb\php\ini class for ini_get() PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index e07aef9892..34d86116c2 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -74,6 +74,15 @@ class filespec */ protected $filesystem; + /** @var \phpbb\php\ini ini_get() wrapper class */ + protected $php_ini; + + /** @var language Language class */ + protected $language; + + /** @var string phpBB root path */ + protected $phpbb_root_path; + /** * The plupload object * @var \phpbb\plupload\plupload @@ -86,28 +95,24 @@ class filespec */ protected $mimetype_guesser; - /** @var language Language class */ - protected $language; - - /** @var string phpBB root path */ - protected $phpbb_root_path; - /** * File upload class * * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem Filesystem + * @param \phpbb\php\ini $php_ini ini_get() wrapper * @param language $language Language - * @param string $phpbb_root_path phpBB root path - * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser - * @param \phpbb\plupload\plupload $plupload Plupload + * @param string $phpbb_root_path phpBB root path + * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser + * @param \phpbb\plupload\plupload $plupload Plupload */ - public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, \phpbb\php\ini $php_ini, language $language, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { - $this->plupload = $plupload; - $this->mimetype_guesser = $mimetype_guesser; $this->filesystem = $phpbb_filesystem; + $this->php_ini = $php_ini; $this->language = $language; $this->phpbb_root_path = $phpbb_root_path; + $this->plupload = $plupload; + $this->mimetype_guesser = $mimetype_guesser; } /** @@ -420,7 +425,7 @@ class filespec return false; } - $upload_mode = (@ini_get('open_basedir') || @ini_get('safe_mode') || strtolower(@ini_get('safe_mode')) == 'on') ? 'move' : 'copy'; + $upload_mode = ($this->php_ini->get_bool('open_basedir') || $this->php_ini->get_bool('safe_mode')) ? 'move' : 'copy'; $upload_mode = ($this->local) ? 'local' : $upload_mode; $this->destination_file = $this->destination_path . '/' . utf8_basename($this->realname); -- cgit v1.2.1 From 36545d5cbe7188efbedf2e1f44b1a7b9617b50c1 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Wed, 26 Aug 2015 16:18:10 +0200 Subject: [ticket/13904] Switch around constructor arguments PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 34d86116c2..48e12f23ef 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -69,9 +69,7 @@ class filespec /** @var upload Instance of upload class */ public $upload; - /** - * @var \phpbb\filesystem\filesystem_interface - */ + /** @var \phpbb\filesystem\filesystem_interface */ protected $filesystem; /** @var \phpbb\php\ini ini_get() wrapper class */ @@ -83,33 +81,27 @@ class filespec /** @var string phpBB root path */ protected $phpbb_root_path; - /** - * The plupload object - * @var \phpbb\plupload\plupload - */ + /** @var \phpbb\plupload\plupload The plupload object */ protected $plupload; - /** - * phpBB Mimetype guesser - * @var \phpbb\mimetype\guesser - */ + /** @var \phpbb\mimetype\guesser phpBB Mimetype guesser */ protected $mimetype_guesser; /** * File upload class * * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem Filesystem - * @param \phpbb\php\ini $php_ini ini_get() wrapper * @param language $language Language + * @param \phpbb\php\ini $php_ini ini_get() wrapper * @param string $phpbb_root_path phpBB root path * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser * @param \phpbb\plupload\plupload $plupload Plupload */ - public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, \phpbb\php\ini $php_ini, language $language, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, \phpbb\php\ini $php_ini, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { $this->filesystem = $phpbb_filesystem; - $this->php_ini = $php_ini; $this->language = $language; + $this->php_ini = $php_ini; $this->phpbb_root_path = $phpbb_root_path; $this->plupload = $plupload; $this->mimetype_guesser = $mimetype_guesser; -- cgit v1.2.1 From 16f3b8c2b9de388223cbe8ace9e1d9bcf0ba5e11 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Thu, 27 Aug 2015 10:51:10 +0200 Subject: [ticket/13904] Modify files for changes in ini wrapper PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 48e12f23ef..580016b281 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -72,7 +72,7 @@ class filespec /** @var \phpbb\filesystem\filesystem_interface */ protected $filesystem; - /** @var \phpbb\php\ini ini_get() wrapper class */ + /** @var \bantu\IniGetWrapper\IniGetWrapper ini_get() wrapper class */ protected $php_ini; /** @var language Language class */ @@ -92,12 +92,12 @@ class filespec * * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem Filesystem * @param language $language Language - * @param \phpbb\php\ini $php_ini ini_get() wrapper + * @param \bantu\IniGetWrapper\IniGetWrapper $php_ini ini_get() wrapper * @param string $phpbb_root_path phpBB root path * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser * @param \phpbb\plupload\plupload $plupload Plupload */ - public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, \phpbb\php\ini $php_ini, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, \bantu\IniGetWrapper\IniGetWrapper $php_ini, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { $this->filesystem = $phpbb_filesystem; $this->language = $language; @@ -417,7 +417,7 @@ class filespec return false; } - $upload_mode = ($this->php_ini->get_bool('open_basedir') || $this->php_ini->get_bool('safe_mode')) ? 'move' : 'copy'; + $upload_mode = ($this->php_ini->getBool('open_basedir') || $this->php_ini->getBool('safe_mode')) ? 'move' : 'copy'; $upload_mode = ($this->local) ? 'local' : $upload_mode; $this->destination_file = $this->destination_path . '/' . utf8_basename($this->realname); -- cgit v1.2.1 From 591995267a3f1931131fa630bd3ff120476f881f Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Thu, 3 Sep 2015 17:20:54 +0200 Subject: [ticket/13904] Improve test coverage of filespec class PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 580016b281..6ce54a4789 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -75,6 +75,9 @@ class filespec /** @var \bantu\IniGetWrapper\IniGetWrapper ini_get() wrapper class */ protected $php_ini; + /** @var \fastImageSize\fastImageSize */ + protected $imagesize; + /** @var language Language class */ protected $language; @@ -97,11 +100,12 @@ class filespec * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser * @param \phpbb\plupload\plupload $plupload Plupload */ - public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, \bantu\IniGetWrapper\IniGetWrapper $php_ini, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, \bantu\IniGetWrapper\IniGetWrapper $php_ini, \fastImageSize\fastImageSize $imagesize, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { $this->filesystem = $phpbb_filesystem; $this->language = $language; $this->php_ini = $php_ini; + $this->imagesize = $imagesize; $this->phpbb_root_path = $phpbb_root_path; $this->plupload = $plupload; $this->mimetype_guesser = $mimetype_guesser; @@ -500,10 +504,7 @@ class filespec { $this->width = $this->height = 0; - // Get imagesize class - $imagesize = new \fastImageSize\fastImageSize(); - - $this->image_info = $imagesize->getImageSize($this->destination_file, $this->mimetype); + $this->image_info = $this->imagesize->getImageSize($this->destination_file, $this->mimetype); if ($this->image_info !== false) { -- cgit v1.2.1 From 7a92ad596c56c25728fd6a22c3a817504e8cb347 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Mon, 7 Sep 2015 12:19:48 +0200 Subject: [ticket/13904] Minor coding style fixes PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 1 + 1 file changed, 1 insertion(+) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 6ce54a4789..83007f11c0 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -96,6 +96,7 @@ class filespec * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem Filesystem * @param language $language Language * @param \bantu\IniGetWrapper\IniGetWrapper $php_ini ini_get() wrapper + * @param \fastImageSize\fastImageSize $imagesize Imagesize class * @param string $phpbb_root_path phpBB root path * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser * @param \phpbb\plupload\plupload $plupload Plupload -- cgit v1.2.1 From 327e36a4d68ff9607967af52ef8f6a00c60343ff Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Wed, 9 Sep 2015 09:41:40 +0200 Subject: [ticket/13904] Modify files for updated fast-image-size library PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 83007f11c0..e171e7e68f 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -75,7 +75,7 @@ class filespec /** @var \bantu\IniGetWrapper\IniGetWrapper ini_get() wrapper class */ protected $php_ini; - /** @var \fastImageSize\fastImageSize */ + /** @var \FastImageSize\FastImageSize */ protected $imagesize; /** @var language Language class */ @@ -96,12 +96,12 @@ class filespec * @param \phpbb\filesystem\filesystem_interface $phpbb_filesystem Filesystem * @param language $language Language * @param \bantu\IniGetWrapper\IniGetWrapper $php_ini ini_get() wrapper - * @param \fastImageSize\fastImageSize $imagesize Imagesize class + * @param \FastImageSize\FastImageSize $imagesize Imagesize class * @param string $phpbb_root_path phpBB root path * @param \phpbb\mimetype\guesser $mimetype_guesser Mime type guesser * @param \phpbb\plupload\plupload $plupload Plupload */ - public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, \bantu\IniGetWrapper\IniGetWrapper $php_ini, \fastImageSize\fastImageSize $imagesize, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) + public function __construct(\phpbb\filesystem\filesystem_interface $phpbb_filesystem, language $language, \bantu\IniGetWrapper\IniGetWrapper $php_ini, \FastImageSize\FastImageSize $imagesize, $phpbb_root_path, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null) { $this->filesystem = $phpbb_filesystem; $this->language = $language; -- cgit v1.2.1 From 5f91f1cad85eaf7f8dc62a1a140605a46431496f Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Wed, 9 Sep 2015 10:46:14 +0200 Subject: [ticket/13904] Minor coding style fixes PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index e171e7e68f..7a42e6bd50 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -13,7 +13,7 @@ namespace phpbb\files; -use \phpbb\language\language; +use phpbb\language\language; /** * Responsible for holding all file relevant information, as well as doing file-specific operations. @@ -201,8 +201,6 @@ class filespec * character. Unique creates a unique filename. * @param string $prefix Prefix applied to filename * @param string $user_id The user_id is only needed for when cleaning a user's avatar - * - *@access public */ public function clean_filename($mode = 'unique', $prefix = '', $user_id = '') { -- cgit v1.2.1 From 759dc9bb84d712c11148a9689d294c09aa0f81d4 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Sun, 13 Sep 2015 09:30:56 +0200 Subject: [ticket/13904] Set properties to protected where possible in filespec PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 7a42e6bd50..7fc9e923ea 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -34,10 +34,10 @@ class filespec protected $mimetype = ''; /** @var string File extension */ - public $extension = ''; + protected $extension = ''; /** @var int File size */ - public $filesize = 0; + protected $filesize = 0; /** @var int Width of file */ protected $width = 0; @@ -55,10 +55,10 @@ class filespec protected $destination_path = ''; /** @var bool Whether file was moved */ - public $file_moved = false; + protected $file_moved = false; /** @var bool Whether file is local */ - public $local = false; + protected $local = false; /** @var bool Class initialization flag */ protected $class_initialized = false; -- cgit v1.2.1 From 6651c1d8f4aead15f4750989670f75721390ee21 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Sun, 13 Sep 2015 09:31:23 +0200 Subject: [ticket/13904] Use filespec's get_filesize instead of calling filesize() PHPBB3-13904 --- phpBB/phpbb/files/filespec.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 7fc9e923ea..2ff2a92c83 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -145,7 +145,7 @@ class filespec $this->extension = strtolower(self::get_extension($this->realname)); // Try to get real filesize from temporary folder (not always working) ;) - $this->filesize = (@filesize($this->filename)) ? @filesize($this->filename) : $this->filesize; + $this->filesize = ($this->get_filesize($this->filename)) ?: $this->filesize; $this->width = $this->height = 0; $this->file_moved = false; @@ -494,7 +494,7 @@ class filespec } // Try to get real filesize from destination folder - $this->filesize = (@filesize($this->destination_file)) ? @filesize($this->destination_file) : $this->filesize; + $this->filesize = ($this->get_filesize($this->destination_file)) ?: $this->filesize; // Get mimetype of supplied file $this->mimetype = $this->get_mimetype($this->destination_file); -- cgit v1.2.1 From 1d5f5ccffcfd30a652734485b51066950bbb8a76 Mon Sep 17 00:00:00 2001 From: javiexin Date: Sun, 21 May 2017 12:58:05 +0200 Subject: [ticket/15227] Remove STRIP, as always false PHPBB3-15227 --- phpBB/phpbb/files/filespec.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/phpbb/files/filespec.php') diff --git a/phpBB/phpbb/files/filespec.php b/phpBB/phpbb/files/filespec.php index 2ff2a92c83..f1a32ef4a8 100644 --- a/phpBB/phpbb/files/filespec.php +++ b/phpBB/phpbb/files/filespec.php @@ -129,7 +129,7 @@ class filespec $this->class_initialized = true; $this->filename = $upload_ary['tmp_name']; $this->filesize = $upload_ary['size']; - $name = (STRIP) ? stripslashes($upload_ary['name']) : $upload_ary['name']; + $name = $upload_ary['name']; $name = trim(utf8_basename($name)); $this->realname = $this->uploadname = $name; $this->mimetype = $upload_ary['type']; -- cgit v1.2.1