diff options
| author | Marc Alexander <admin@m-a-styles.de> | 2019-04-14 14:07:22 +0200 |
|---|---|---|
| committer | Marc Alexander <admin@m-a-styles.de> | 2019-04-14 14:07:22 +0200 |
| commit | 84ea5d71481c450dfe1f4a70a10877d4469c1329 (patch) | |
| tree | e75869c4e3b1517c9210886dad10f95a4c151d43 /phpBB | |
| parent | 507efee633fee769e7e2af4a2b298c951193f800 (diff) | |
| download | forums-84ea5d71481c450dfe1f4a70a10877d4469c1329.tar forums-84ea5d71481c450dfe1f4a70a10877d4469c1329.tar.gz forums-84ea5d71481c450dfe1f4a70a10877d4469c1329.tar.bz2 forums-84ea5d71481c450dfe1f4a70a10877d4469c1329.tar.xz forums-84ea5d71481c450dfe1f4a70a10877d4469c1329.zip | |
[ticket/security/234] Add URL validation for input fields
SECURITY-234
Diffstat (limited to 'phpBB')
| -rw-r--r-- | phpBB/includes/acp/acp_board.php | 7 | ||||
| -rw-r--r-- | phpBB/includes/functions_acp.php | 12 | ||||
| -rw-r--r-- | phpBB/language/en/acp/common.php | 1 |
3 files changed, 17 insertions, 3 deletions
diff --git a/phpBB/includes/acp/acp_board.php b/phpBB/includes/acp/acp_board.php index f89f5535eb..5b37bb5c57 100644 --- a/phpBB/includes/acp/acp_board.php +++ b/phpBB/includes/acp/acp_board.php @@ -30,10 +30,13 @@ class acp_board function main($id, $mode) { - global $user, $template, $request; + global $user, $template, $request, $language; global $config, $phpbb_root_path, $phpEx; global $cache, $phpbb_container, $phpbb_dispatcher, $phpbb_log; + /** @var \phpbb\language\language $language Language object */ + $language = $phpbb_container->get('language'); + $user->add_lang('acp/board'); $submit = (isset($_POST['submit']) || isset($_POST['allow_quick_reply_enable'])) ? true : false; @@ -56,7 +59,7 @@ class acp_board 'legend1' => 'ACP_BOARD_SETTINGS', 'sitename' => array('lang' => 'SITE_NAME', 'validate' => 'string', 'type' => 'text:40:255', 'explain' => false), 'site_desc' => array('lang' => 'SITE_DESC', 'validate' => 'string', 'type' => 'text:40:255', 'explain' => false), - 'site_home_url' => array('lang' => 'SITE_HOME_URL', 'validate' => 'string', 'type' => 'url:40:255', 'explain' => true), + 'site_home_url' => array('lang' => 'SITE_HOME_URL', 'validate' => 'url', 'type' => 'url:40:255', 'explain' => true), 'site_home_text' => array('lang' => 'SITE_HOME_TEXT', 'validate' => 'string', 'type' => 'text:40:255', 'explain' => true), 'board_index_text' => array('lang' => 'BOARD_INDEX_TEXT', 'validate' => 'string', 'type' => 'text:40:255', 'explain' => true), 'board_disable' => array('lang' => 'DISABLE_BOARD', 'validate' => 'bool', 'type' => 'custom', 'method' => 'board_disable', 'explain' => true), diff --git a/phpBB/includes/functions_acp.php b/phpBB/includes/functions_acp.php index 9b7491305c..dd326c3db6 100644 --- a/phpBB/includes/functions_acp.php +++ b/phpBB/includes/functions_acp.php @@ -419,7 +419,7 @@ function build_cfg_template($tpl_type, $key, &$new_ary, $config_key, $vars) */ function validate_config_vars($config_vars, &$cfg_array, &$error) { - global $phpbb_root_path, $user, $phpbb_dispatcher, $phpbb_filesystem; + global $phpbb_root_path, $user, $phpbb_dispatcher, $phpbb_filesystem, $language; $type = 0; $min = 1; @@ -442,6 +442,16 @@ function validate_config_vars($config_vars, &$cfg_array, &$error) // Validate a bit. ;) (0 = type, 1 = min, 2= max) switch ($validator[$type]) { + case 'url': + $cfg_array[$config_name] = trim($cfg_array[$config_name]); + + if (!empty($cfg_array[$config_name]) && !preg_match('#^' . get_preg_expression('url') . '$#iu', $cfg_array[$config_name])) + { + $error[] = $language->lang('URL_INVALID', $language->lang($config_definition['lang'])); + } + + // no break here + case 'string': $length = utf8_strlen($cfg_array[$config_name]); diff --git a/phpBB/language/en/acp/common.php b/phpBB/language/en/acp/common.php index 0d5f6fee25..1c2253542c 100644 --- a/phpBB/language/en/acp/common.php +++ b/phpBB/language/en/acp/common.php @@ -325,6 +325,7 @@ $lang = array_merge($lang, array( 'TOTAL_SIZE' => 'Total size', 'UCP' => 'User Control Panel', + 'URL_INVALID' => 'The provided URL for the setting “%1$s” is invalid.', 'USERNAMES_EXPLAIN' => 'Place each username on a separate line.', 'USER_CONTROL_PANEL' => 'User Control Panel', |