aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--phpBB/adm/style/install_footer.html2
-rw-r--r--phpBB/includes/acp/acp_language.php27
-rw-r--r--phpBB/includes/acp/acp_users.php6
-rw-r--r--phpBB/includes/auth/auth_db.php4
-rw-r--r--phpBB/includes/functions.php4
-rw-r--r--phpBB/includes/functions_jabber.php8
-rw-r--r--phpBB/includes/mcp/mcp_front.php2
-rw-r--r--phpBB/includes/request/request.php125
-rw-r--r--phpBB/includes/request/type_cast_helper.php22
-rw-r--r--phpBB/includes/search/fulltext_mysql.php36
-rw-r--r--phpBB/includes/search/fulltext_native.php36
-rw-r--r--phpBB/includes/search/fulltext_postgres.php36
-rw-r--r--phpBB/includes/search/fulltext_sphinx.php36
-rw-r--r--phpBB/includes/ucp/ucp_profile.php6
-rw-r--r--phpBB/includes/ucp/ucp_register.php4
-rw-r--r--phpBB/install/convertors/convert_phpbb20.php2
-rw-r--r--phpBB/install/database_update.php2
-rw-r--r--phpBB/install/index.php2
-rw-r--r--phpBB/install/install_update.php18
-rw-r--r--phpBB/language/en/acp/board.php2
-rw-r--r--phpBB/search.php22
-rw-r--r--phpBB/styles/prosilver/template/ucp_pm_viewmessage_print.html2
-rw-r--r--phpBB/styles/prosilver/template/viewtopic_print.html2
-rw-r--r--phpBB/styles/prosilver/theme/stylesheet.css2
-rw-r--r--phpBB/styles/subsilver2/template/simple_footer.html2
-rw-r--r--phpBB/styles/subsilver2/template/ucp_pm_viewmessage_print.html2
-rw-r--r--phpBB/styles/subsilver2/template/viewtopic_print.html2
-rw-r--r--phpBB/styles/subsilver2/theme/stylesheet.css2
-rw-r--r--tests/request/type_cast_helper_test.php20
29 files changed, 341 insertions, 95 deletions
diff --git a/phpBB/adm/style/install_footer.html b/phpBB/adm/style/install_footer.html
index a3b2294025..73c3f5a6b9 100644
--- a/phpBB/adm/style/install_footer.html
+++ b/phpBB/adm/style/install_footer.html
@@ -8,7 +8,7 @@
</div>
<div id="page-footer">
- Powered by <a href="http://www.phpbb.com/">phpBB</a>&reg; Forum Software &copy; phpBB Group
+ Powered by <a href="https://www.phpbb.com/">phpBB</a>&reg; Forum Software &copy; phpBB Group
</div>
</div>
diff --git a/phpBB/includes/acp/acp_language.php b/phpBB/includes/acp/acp_language.php
index 2b19f93c75..2be1ccfc41 100644
--- a/phpBB/includes/acp/acp_language.php
+++ b/phpBB/includes/acp/acp_language.php
@@ -100,11 +100,25 @@ class acp_language
switch ($method)
{
case 'ftp':
- $transfer = new ftp(request_var('host', ''), request_var('username', ''), request_var('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));
+ $transfer = new ftp(
+ request_var('host', ''),
+ request_var('username', ''),
+ htmlspecialchars_decode($request->untrimmed_variable('password', '')),
+ request_var('root_path', ''),
+ request_var('port', ''),
+ request_var('timeout', '')
+ );
break;
case 'ftp_fsock':
- $transfer = new ftp_fsock(request_var('host', ''), request_var('username', ''), request_var('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));
+ $transfer = new ftp_fsock(
+ request_var('host', ''),
+ request_var('username', ''),
+ htmlspecialchars_decode($request->untrimmed_variable('password', '')),
+ request_var('root_path', ''),
+ request_var('port', ''),
+ request_var('timeout', '')
+ );
break;
default:
@@ -404,7 +418,14 @@ class acp_language
trigger_error($user->lang['INVALID_UPLOAD_METHOD'], E_USER_ERROR);
}
- $transfer = new $method(request_var('host', ''), request_var('username', ''), request_var('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));
+ $transfer = new $method(
+ request_var('host', ''),
+ request_var('username', ''),
+ htmlspecialchars_decode($request->untrimmed_variable('password', '')),
+ request_var('root_path', ''),
+ request_var('port', ''),
+ request_var('timeout', '')
+ );
if (($result = $transfer->open_session()) !== true)
{
diff --git a/phpBB/includes/acp/acp_users.php b/phpBB/includes/acp/acp_users.php
index b54257b04a..985a12d9ce 100644
--- a/phpBB/includes/acp/acp_users.php
+++ b/phpBB/includes/acp/acp_users.php
@@ -32,7 +32,7 @@ class acp_users
{
global $config, $db, $user, $auth, $template, $cache;
global $phpbb_root_path, $phpbb_admin_path, $phpEx, $table_prefix, $file_uploads;
- global $phpbb_dispatcher;
+ global $phpbb_dispatcher, $request;
$user->add_lang(array('posting', 'ucp', 'acp/users'));
$this->tpl_name = 'acp_users';
@@ -770,8 +770,8 @@ class acp_users
'username' => utf8_normalize_nfc(request_var('user', $user_row['username'], true)),
'user_founder' => request_var('user_founder', ($user_row['user_type'] == USER_FOUNDER) ? 1 : 0),
'email' => strtolower(request_var('user_email', $user_row['user_email'])),
- 'new_password' => request_var('new_password', '', true),
- 'password_confirm' => request_var('password_confirm', '', true),
+ 'new_password' => $request->variable('new_password', '', true),
+ 'password_confirm' => $request->variable('password_confirm', '', true),
);
// Validation data - we do not check the password complexity setting here
diff --git a/phpBB/includes/auth/auth_db.php b/phpBB/includes/auth/auth_db.php
index 76790e4dad..ac944532a5 100644
--- a/phpBB/includes/auth/auth_db.php
+++ b/phpBB/includes/auth/auth_db.php
@@ -41,6 +41,10 @@ function login_db($username, $password, $ip = '', $browser = '', $forwarded_for
global $db, $config;
global $request;
+ // Auth plugins get the password untrimmed.
+ // For compatibility we trim() here.
+ $password = trim($password);
+
// do not allow empty password
if (!$password)
{
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index 2480ca80fa..0c9421c12f 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -3044,11 +3044,11 @@ function login_box($redirect = '', $l_explain = '', $l_success = '', $admin = fa
trigger_error('NO_AUTH_ADMIN');
}
- $password = request_var('password_' . $credential, '', true);
+ $password = $request->untrimmed_variable('password_' . $credential, '', true);
}
else
{
- $password = request_var('password', '', true);
+ $password = $request->untrimmed_variable('password', '', true);
}
$username = request_var('username', '', true);
diff --git a/phpBB/includes/functions_jabber.php b/phpBB/includes/functions_jabber.php
index d76309d5bb..3d8e403f4b 100644
--- a/phpBB/includes/functions_jabber.php
+++ b/phpBB/includes/functions_jabber.php
@@ -68,7 +68,7 @@ class jabber
}
$this->password = $password;
- $this->use_ssl = ($use_ssl && $this->can_use_ssl()) ? true : false;
+ $this->use_ssl = ($use_ssl && self::can_use_ssl()) ? true : false;
// Change port if we use SSL
if ($this->port == 5222 && $this->use_ssl)
@@ -83,7 +83,7 @@ class jabber
/**
* Able to use the SSL functionality?
*/
- function can_use_ssl()
+ static public function can_use_ssl()
{
// Will not work with PHP >= 5.2.1 or < 5.2.3RC2 until timeout problem with ssl hasn't been fixed (http://bugs.php.net/41236)
return ((version_compare(PHP_VERSION, '5.2.1', '<') || version_compare(PHP_VERSION, '5.2.3RC2', '>=')) && @extension_loaded('openssl')) ? true : false;
@@ -92,7 +92,7 @@ class jabber
/**
* Able to use TLS?
*/
- function can_use_tls()
+ static public function can_use_tls()
{
if (!@extension_loaded('openssl') || !function_exists('stream_socket_enable_crypto') || !function_exists('stream_get_meta_data') || !function_exists('socket_set_blocking') || !function_exists('stream_get_wrappers'))
{
@@ -442,7 +442,7 @@ class jabber
}
// Let's use TLS if SSL is not enabled and we can actually use it
- if (!$this->session['ssl'] && $this->can_use_tls() && $this->can_use_ssl() && isset($xml['stream:features'][0]['#']['starttls']))
+ if (!$this->session['ssl'] && self::can_use_tls() && self::can_use_ssl() && isset($xml['stream:features'][0]['#']['starttls']))
{
$this->add_to_log('Switching to TLS.');
$this->send("<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>\n");
diff --git a/phpBB/includes/mcp/mcp_front.php b/phpBB/includes/mcp/mcp_front.php
index 13398e62bc..ba4b15895a 100644
--- a/phpBB/includes/mcp/mcp_front.php
+++ b/phpBB/includes/mcp/mcp_front.php
@@ -251,7 +251,7 @@ function mcp_front_view($id, $mode, $action)
'ORDER_BY' => 'p.message_time DESC',
);
- $sql_ary = $db->sql_build_query('SELECT', $sql_ary);
+ $sql = $db->sql_build_query('SELECT', $sql_ary);
$result = $db->sql_query_limit($sql, 5);
$pm_by_id = $pm_list = array();
diff --git a/phpBB/includes/request/request.php b/phpBB/includes/request/request.php
index 4e425dbd27..a06fc0d85d 100644
--- a/phpBB/includes/request/request.php
+++ b/phpBB/includes/request/request.php
@@ -200,46 +200,31 @@ class phpbb_request implements phpbb_request_interface
*/
public function variable($var_name, $default, $multibyte = false, $super_global = phpbb_request_interface::REQUEST)
{
- $path = false;
-
- // deep direct access to multi dimensional arrays
- if (is_array($var_name))
- {
- $path = $var_name;
- // make sure at least the variable name is specified
- if (empty($path))
- {
- return (is_array($default)) ? array() : $default;
- }
- // the variable name is the first element on the path
- $var_name = array_shift($path);
- }
-
- if (!isset($this->input[$super_global][$var_name]))
- {
- return (is_array($default)) ? array() : $default;
- }
- $var = $this->input[$super_global][$var_name];
-
- if ($path)
- {
- // walk through the array structure and find the element we are looking for
- foreach ($path as $key)
- {
- if (is_array($var) && isset($var[$key]))
- {
- $var = $var[$key];
- }
- else
- {
- return (is_array($default)) ? array() : $default;
- }
- }
- }
-
- $this->type_cast_helper->recursive_set_var($var, $default, $multibyte);
+ return $this->_variable($var_name, $default, $multibyte, $super_global, true);
+ }
- return $var;
+ /**
+ * Get a variable, but without trimming strings.
+ * Same functionality as variable(), except does not run trim() on strings.
+ * This method should be used when handling passwords.
+ *
+ * @param string|array $var_name The form variable's name from which data shall be retrieved.
+ * If the value is an array this may be an array of indizes which will give
+ * direct access to a value at any depth. E.g. if the value of "var" is array(1 => "a")
+ * then specifying array("var", 1) as the name will return "a".
+ * @param mixed $default A default value that is returned if the variable was not set.
+ * This function will always return a value of the same type as the default.
+ * @param bool $multibyte If $default is a string this paramater has to be true if the variable may contain any UTF-8 characters
+ * Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks
+ * @param phpbb_request_interface::POST|GET|REQUEST|COOKIE $super_global
+ * Specifies which super global should be used
+ *
+ * @return mixed The value of $_REQUEST[$var_name] run through {@link set_var set_var} to ensure that the type is the
+ * the same as that of $default. If the variable is not set $default is returned.
+ */
+ public function untrimmed_variable($var_name, $default, $multibyte, $super_global = phpbb_request_interface::REQUEST)
+ {
+ return $this->_variable($var_name, $default, $multibyte, $super_global, false);
}
/**
@@ -351,4 +336,66 @@ class phpbb_request implements phpbb_request_interface
return array_keys($this->input[$super_global]);
}
+
+ /**
+ * Helper function used by variable() and untrimmed_variable().
+ *
+ * @param string|array $var_name The form variable's name from which data shall be retrieved.
+ * If the value is an array this may be an array of indizes which will give
+ * direct access to a value at any depth. E.g. if the value of "var" is array(1 => "a")
+ * then specifying array("var", 1) as the name will return "a".
+ * @param mixed $default A default value that is returned if the variable was not set.
+ * This function will always return a value of the same type as the default.
+ * @param bool $multibyte If $default is a string this paramater has to be true if the variable may contain any UTF-8 characters
+ * Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks
+ * @param phpbb_request_interface::POST|GET|REQUEST|COOKIE $super_global
+ * Specifies which super global should be used
+ * @param bool $trim Indicates whether trim() should be applied to string values.
+ *
+ * @return mixed The value of $_REQUEST[$var_name] run through {@link set_var set_var} to ensure that the type is the
+ * the same as that of $default. If the variable is not set $default is returned.
+ */
+ protected function _variable($var_name, $default, $multibyte = false, $super_global = phpbb_request_interface::REQUEST, $trim = true)
+ {
+ $path = false;
+
+ // deep direct access to multi dimensional arrays
+ if (is_array($var_name))
+ {
+ $path = $var_name;
+ // make sure at least the variable name is specified
+ if (empty($path))
+ {
+ return (is_array($default)) ? array() : $default;
+ }
+ // the variable name is the first element on the path
+ $var_name = array_shift($path);
+ }
+
+ if (!isset($this->input[$super_global][$var_name]))
+ {
+ return (is_array($default)) ? array() : $default;
+ }
+ $var = $this->input[$super_global][$var_name];
+
+ if ($path)
+ {
+ // walk through the array structure and find the element we are looking for
+ foreach ($path as $key)
+ {
+ if (is_array($var) && isset($var[$key]))
+ {
+ $var = $var[$key];
+ }
+ else
+ {
+ return (is_array($default)) ? array() : $default;
+ }
+ }
+ }
+
+ $this->type_cast_helper->recursive_set_var($var, $default, $multibyte, $trim);
+
+ return $var;
+ }
}
diff --git a/phpBB/includes/request/type_cast_helper.php b/phpBB/includes/request/type_cast_helper.php
index 561e8fc251..1a5274ed14 100644
--- a/phpBB/includes/request/type_cast_helper.php
+++ b/phpBB/includes/request/type_cast_helper.php
@@ -93,15 +93,23 @@ class phpbb_request_type_cast_helper implements phpbb_request_type_cast_helper_i
* @param mixed $type The variable type. Will be used with {@link settype()}
* @param bool $multibyte Indicates whether string values may contain UTF-8 characters.
* Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks.
+ * @param bool $trim Indicates whether trim() should be applied to string values.
+ * Default is true.
*/
- public function set_var(&$result, $var, $type, $multibyte = false)
+ public function set_var(&$result, $var, $type, $multibyte = false, $trim = true)
{
settype($var, $type);
$result = $var;
if ($type == 'string')
{
- $result = trim(str_replace(array("\r\n", "\r", "\0"), array("\n", "\n", ''), $result));
+ $result = str_replace(array("\r\n", "\r", "\0"), array("\n", "\n", ''), $result);
+
+ if ($trim)
+ {
+ $result = trim($result);
+ }
+
$result = htmlspecialchars($result, ENT_COMPAT, 'UTF-8');
if ($multibyte)
@@ -141,8 +149,10 @@ class phpbb_request_type_cast_helper implements phpbb_request_type_cast_helper_i
* @param bool $multibyte Indicates whether string keys and values may contain UTF-8 characters.
* Default is false, causing all bytes outside the ASCII range (0-127) to
* be replaced with question marks.
+ * @param bool $trim Indicates whether trim() should be applied to string values.
+ * Default is true.
*/
- public function recursive_set_var(&$var, $default, $multibyte)
+ public function recursive_set_var(&$var, $default, $multibyte, $trim = true)
{
if (is_array($var) !== is_array($default))
{
@@ -153,7 +163,7 @@ class phpbb_request_type_cast_helper implements phpbb_request_type_cast_helper_i
if (!is_array($default))
{
$type = gettype($default);
- $this->set_var($var, $var, $type, $multibyte);
+ $this->set_var($var, $var, $type, $multibyte, $trim);
}
else
{
@@ -174,9 +184,9 @@ class phpbb_request_type_cast_helper implements phpbb_request_type_cast_helper_i
foreach ($_var as $k => $v)
{
- $this->set_var($k, $k, $key_type, $multibyte, $multibyte);
+ $this->set_var($k, $k, $key_type, $multibyte);
- $this->recursive_set_var($v, $default_value, $multibyte);
+ $this->recursive_set_var($v, $default_value, $multibyte, $trim);
$var[$k] = $v;
}
}
diff --git a/phpBB/includes/search/fulltext_mysql.php b/phpBB/includes/search/fulltext_mysql.php
index cf89ab1c24..7cd06dee19 100644
--- a/phpBB/includes/search/fulltext_mysql.php
+++ b/phpBB/includes/search/fulltext_mysql.php
@@ -27,9 +27,9 @@ class phpbb_search_fulltext_mysql extends phpbb_search_base
protected $config;
protected $db;
protected $user;
- public $word_length = array();
- public $search_query;
- public $common_words = array();
+ protected $word_length = array();
+ protected $search_query;
+ protected $common_words = array();
/**
* Constructor
@@ -59,6 +59,36 @@ class phpbb_search_fulltext_mysql extends phpbb_search_base
}
/**
+ * Returns the search_query
+ *
+ * @return string search query
+ */
+ public function get_search_query()
+ {
+ return $this->search_query;
+ }
+
+ /**
+ * Returns the common_words array
+ *
+ * @return array common words that are ignored by search backend
+ */
+ public function get_common_words()
+ {
+ return $this->common_words;
+ }
+
+ /**
+ * Returns the word_length array
+ *
+ * @return array min and max word length for searching
+ */
+ public function get_word_length()
+ {
+ return $this->word_length;
+ }
+
+ /**
* Checks for correct MySQL version and stores min/max word length in the config
*
* @return string|bool Language key of the error/incompatiblity occured
diff --git a/phpBB/includes/search/fulltext_native.php b/phpBB/includes/search/fulltext_native.php
index 96b3f02ec6..bbc2236b3c 100644
--- a/phpBB/includes/search/fulltext_native.php
+++ b/phpBB/includes/search/fulltext_native.php
@@ -23,9 +23,9 @@ if (!defined('IN_PHPBB'))
class phpbb_search_fulltext_native extends phpbb_search_base
{
protected $stats = array();
- public $word_length = array();
- public $search_query;
- public $common_words = array();
+ protected $word_length = array();
+ protected $search_query;
+ protected $common_words = array();
protected $must_contain_ids = array();
protected $must_not_contain_ids = array();
@@ -74,6 +74,36 @@ class phpbb_search_fulltext_native extends phpbb_search_base
}
/**
+ * Returns the search_query
+ *
+ * @return string search query
+ */
+ public function get_search_query()
+ {
+ return $this->search_query;
+ }
+
+ /**
+ * Returns the common_words array
+ *
+ * @return array common words that are ignored by search backend
+ */
+ public function get_common_words()
+ {
+ return $this->common_words;
+ }
+
+ /**
+ * Returns the word_length array
+ *
+ * @return array min and max word length for searching
+ */
+ public function get_word_length()
+ {
+ return $this->word_length;
+ }
+
+ /**
* This function fills $this->search_query with the cleaned user search query.
*
* If $terms is 'any' then the words will be extracted from the search query
diff --git a/phpBB/includes/search/fulltext_postgres.php b/phpBB/includes/search/fulltext_postgres.php
index 50ed785093..38989a9d9a 100644
--- a/phpBB/includes/search/fulltext_postgres.php
+++ b/phpBB/includes/search/fulltext_postgres.php
@@ -31,9 +31,9 @@ class phpbb_search_fulltext_postgres extends phpbb_search_base
protected $config;
protected $db;
protected $user;
- public $search_query;
- public $common_words = array();
- public $word_length = array();
+ protected $search_query;
+ protected $common_words = array();
+ protected $word_length = array();
/**
* Constructor
@@ -73,6 +73,36 @@ class phpbb_search_fulltext_postgres extends phpbb_search_base
}
/**
+ * Returns the search_query
+ *
+ * @return string search query
+ */
+ public function get_search_query()
+ {
+ return $this->search_query;
+ }
+
+ /**
+ * Returns the common_words array
+ *
+ * @return array common words that are ignored by search backend
+ */
+ public function get_common_words()
+ {
+ return $this->common_words;
+ }
+
+ /**
+ * Returns the word_length array
+ *
+ * @return array min and max word length for searching
+ */
+ public function get_word_length()
+ {
+ return $this->word_length;
+ }
+
+ /**
* Returns if phrase search is supported or not
*
* @return bool
diff --git a/phpBB/includes/search/fulltext_sphinx.php b/phpBB/includes/search/fulltext_sphinx.php
index 288c0b5940..0a230f0e98 100644
--- a/phpBB/includes/search/fulltext_sphinx.php
+++ b/phpBB/includes/search/fulltext_sphinx.php
@@ -42,8 +42,8 @@ class phpbb_search_fulltext_sphinx
protected $dbtype;
protected $user;
protected $config_file_data = '';
- public $search_query;
- public $common_words = array();
+ protected $search_query;
+ protected $common_words = array();
/**
* Constructor
@@ -87,7 +87,7 @@ class phpbb_search_fulltext_sphinx
$error = false;
}
-
+
/**
* Returns the name of this search backend to be displayed to administrators
*
@@ -99,6 +99,36 @@ class phpbb_search_fulltext_sphinx
}
/**
+ * Returns the search_query
+ *
+ * @return string search query
+ */
+ public function get_search_query()
+ {
+ return $this->search_query;
+ }
+
+ /**
+ * Returns false as there is no word_len array
+ *
+ * @return false
+ */
+ public function get_word_length()
+ {
+ return false;
+ }
+
+ /**
+ * Returns the common_words array
+ *
+ * @return array common words that are ignored by search backend
+ */
+ public function get_common_words()
+ {
+ return $this->common_words;
+ }
+
+ /**
* Checks permissions and paths, if everything is correct it generates the config file
*
* @return string|bool Language key of the error/incompatiblity encountered, or false if successful
diff --git a/phpBB/includes/ucp/ucp_profile.php b/phpBB/includes/ucp/ucp_profile.php
index 2ac82fb52f..89bf20a30f 100644
--- a/phpBB/includes/ucp/ucp_profile.php
+++ b/phpBB/includes/ucp/ucp_profile.php
@@ -46,9 +46,9 @@ class ucp_profile
$data = array(
'username' => utf8_normalize_nfc(request_var('username', $user->data['username'], true)),
'email' => strtolower(request_var('email', $user->data['user_email'])),
- 'new_password' => request_var('new_password', '', true),
- 'cur_password' => request_var('cur_password', '', true),
- 'password_confirm' => request_var('password_confirm', '', true),
+ 'new_password' => $request->variable('new_password', '', true),
+ 'cur_password' => $request->variable('cur_password', '', true),
+ 'password_confirm' => $request->variable('password_confirm', '', true),
);
add_form_key('ucp_reg_details');
diff --git a/phpBB/includes/ucp/ucp_register.php b/phpBB/includes/ucp/ucp_register.php
index 6ce53a79ab..c57aec00a0 100644
--- a/phpBB/includes/ucp/ucp_register.php
+++ b/phpBB/includes/ucp/ucp_register.php
@@ -170,8 +170,8 @@ class ucp_register
$data = array(
'username' => utf8_normalize_nfc(request_var('username', '', true)),
- 'new_password' => request_var('new_password', '', true),
- 'password_confirm' => request_var('password_confirm', '', true),
+ 'new_password' => $request->variable('new_password', '', true),
+ 'password_confirm' => $request->variable('password_confirm', '', true),
'email' => strtolower(request_var('email', '')),
'lang' => basename(request_var('lang', $user->lang_name)),
'tz' => request_var('tz', $timezone),
diff --git a/phpBB/install/convertors/convert_phpbb20.php b/phpBB/install/convertors/convert_phpbb20.php
index 79c20b718d..68acea02b3 100644
--- a/phpBB/install/convertors/convert_phpbb20.php
+++ b/phpBB/install/convertors/convert_phpbb20.php
@@ -32,7 +32,7 @@ $convertor_data = array(
'forum_name' => 'phpBB 2.0.x',
'version' => '1.0.3',
'phpbb_version' => '3.1.0-dev',
- 'author' => '<a href="http://www.phpbb.com/">phpBB Group</a>',
+ 'author' => '<a href="https://www.phpbb.com/">phpBB Group</a>',
'dbms' => $dbms,
'dbhost' => $dbhost,
'dbport' => $dbport,
diff --git a/phpBB/install/database_update.php b/phpBB/install/database_update.php
index 1d65fd14ff..542685a69d 100644
--- a/phpBB/install/database_update.php
+++ b/phpBB/install/database_update.php
@@ -617,7 +617,7 @@ function _print_footer()
</div>
<div id="page-footer">
- Powered by <a href="http://www.phpbb.com/">phpBB</a>&reg; Forum Software &copy; phpBB Group
+ Powered by <a href="https://www.phpbb.com/">phpBB</a>&reg; Forum Software &copy; phpBB Group
</div>
</div>
diff --git a/phpBB/install/index.php b/phpBB/install/index.php
index 3c1d60f554..4f1fbee7ad 100644
--- a/phpBB/install/index.php
+++ b/phpBB/install/index.php
@@ -594,7 +594,7 @@ class module
echo ' </div>';
echo ' </div>';
echo ' <div id="page-footer">';
- echo ' Powered by <a href="http://www.phpbb.com/">phpBB</a>&reg; Forum Software &copy; phpBB Group';
+ echo ' Powered by <a href="https://www.phpbb.com/">phpBB</a>&reg; Forum Software &copy; phpBB Group';
echo ' </div>';
echo '</div>';
echo '</body>';
diff --git a/phpBB/install/install_update.php b/phpBB/install/install_update.php
index 88b00f1cf1..8c044550f3 100644
--- a/phpBB/install/install_update.php
+++ b/phpBB/install/install_update.php
@@ -862,7 +862,14 @@ class install_update extends module
$test_connection = false;
if ($test_ftp_connection || $submit)
{
- $transfer = new $method(request_var('host', ''), request_var('username', ''), request_var('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));
+ $transfer = new $method(
+ request_var('host', ''),
+ request_var('username', ''),
+ htmlspecialchars_decode($request->untrimmed_variable('password', '')),
+ request_var('root_path', ''),
+ request_var('port', ''),
+ request_var('timeout', '')
+ );
$test_connection = $transfer->open_session();
// Make sure that the directory is correct by checking for the existence of common.php
@@ -948,7 +955,14 @@ class install_update extends module
}
else
{
- $transfer = new $method(request_var('host', ''), request_var('username', ''), request_var('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));
+ $transfer = new $method(
+ request_var('host', ''),
+ request_var('username', ''),
+ htmlspecialchars_decode($request->untrimmed_variable('password', '')),
+ request_var('root_path', ''),
+ request_var('port', ''),
+ request_var('timeout', '')
+ );
$transfer->open_session();
}
diff --git a/phpBB/language/en/acp/board.php b/phpBB/language/en/acp/board.php
index a4597a1014..a4380486cc 100644
--- a/phpBB/language/en/acp/board.php
+++ b/phpBB/language/en/acp/board.php
@@ -57,7 +57,7 @@ $lang = array_merge($lang, array(
'SYSTEM_TIMEZONE' => 'Guest timezone',
'SYSTEM_TIMEZONE_EXPLAIN' => 'Timezone to use for displaying times to users who are not logged in (guests, bots). Logged in users set their timezone during registration and can change it in their user control panel.',
'WARNINGS_EXPIRE' => 'Warning duration',
- 'WARNINGS_EXPIRE_EXPLAIN' => 'Number of days that will elapse before the warning will automatically expire from a user’s record. Set this value to 0 to make warnings permanent.',
+ 'WARNINGS_EXPIRE_EXPLAIN' => 'Number of days that will elapse before a warning will automatically expire from a user’s record. Set this value to 0 to make warnings permanent.',
));
// Board Features
diff --git a/phpBB/search.php b/phpBB/search.php
index 190da5247f..7eda3c4d1d 100644
--- a/phpBB/search.php
+++ b/phpBB/search.php
@@ -287,14 +287,24 @@ if ($keywords || $author || $author_id || $search_id || $submit)
trigger_error($error);
}
+ $common_words = $search->get_common_words();
+
// let the search module split up the keywords
if ($keywords)
{
$correct_query = $search->split_keywords($keywords, $search_terms);
- if (!$correct_query || (empty($search->search_query) && !sizeof($author_id_ary) && !$search_id))
+ if (!$correct_query || (!$search->get_search_query() && !sizeof($author_id_ary) && !$search_id))
{
- $ignored = (sizeof($search->common_words)) ? sprintf($user->lang['IGNORED_TERMS_EXPLAIN'], implode(' ', $search->common_words)) . '<br />' : '';
- trigger_error($ignored . $user->lang('NO_KEYWORDS', $user->lang('CHARACTERS', (int) $search->word_length['min']), $user->lang('CHARACTERS', (int) $search->word_length['max'])));
+ $ignored = (sizeof($common_words)) ? sprintf($user->lang['IGNORED_TERMS_EXPLAIN'], implode(' ', $common_words)) . '<br />' : '';
+ $word_length = $search->get_word_length();
+ if ($word_length)
+ {
+ trigger_error($ignored . $user->lang('NO_KEYWORDS', $user->lang('CHARACTERS', (int) $word_length['min']), $user->lang('CHARACTERS', (int) $word_length['max'])));
+ }
+ else
+ {
+ trigger_error($ignored);
+ }
}
}
@@ -526,7 +536,7 @@ if ($keywords || $author || $author_id || $search_id || $submit)
sort($m_approve_fid_ary);
sort($author_id_ary);
- if (!empty($search->search_query))
+ if ($search->get_search_query())
{
$total_match_count = $search->keyword_search($show_results, $search_fields, $search_terms, $sort_by_sql, $sort_key, $sort_dir, $sort_days, $ex_fid_ary, $m_approve_fid_ary, $topic_id, $author_id_ary, $sql_author_match, $id_ary, $start, $per_page);
}
@@ -609,8 +619,8 @@ if ($keywords || $author || $author_id || $search_id || $submit)
'SEARCH_TITLE' => $l_search_title,
'SEARCH_MATCHES' => $l_search_matches,
'SEARCH_WORDS' => $keywords,
- 'SEARCHED_QUERY' => $search->search_query,
- 'IGNORED_WORDS' => (sizeof($search->common_words)) ? implode(' ', $search->common_words) : '',
+ 'SEARCHED_QUERY' => $search->get_search_query(),
+ 'IGNORED_WORDS' => (sizeof($common_words)) ? implode(' ', $common_words) : '',
'PAGE_NUMBER' => phpbb_on_page($template, $user, $u_search, $total_match_count, $per_page, $start),
'PHRASE_SEARCH_DISABLED' => $phrase_search_disabled,
diff --git a/phpBB/styles/prosilver/template/ucp_pm_viewmessage_print.html b/phpBB/styles/prosilver/template/ucp_pm_viewmessage_print.html
index 43e7de2e12..a024a170a7 100644
--- a/phpBB/styles/prosilver/template/ucp_pm_viewmessage_print.html
+++ b/phpBB/styles/prosilver/template/ucp_pm_viewmessage_print.html
@@ -42,7 +42,7 @@
<div id="page-footer">
<div class="page-number">{S_TIMEZONE}<br />{PAGE_NUMBER}</div>
- <div class="copyright">Powered by phpBB&reg; Forum Software &copy; phpBB Group<br />http://www.phpbb.com/</div>
+ <div class="copyright">Powered by phpBB&reg; Forum Software &copy; phpBB Group<br />https://www.phpbb.com/</div>
</div>
</div>
diff --git a/phpBB/styles/prosilver/template/viewtopic_print.html b/phpBB/styles/prosilver/template/viewtopic_print.html
index b28608d6f1..88d65ea407 100644
--- a/phpBB/styles/prosilver/template/viewtopic_print.html
+++ b/phpBB/styles/prosilver/template/viewtopic_print.html
@@ -38,7 +38,7 @@
<div id="page-footer">
<div class="page-number">{S_TIMEZONE}<br />{PAGE_NUMBER}</div>
- <div class="copyright">Powered by phpBB&reg; Forum Software &copy; phpBB Group<br />http://www.phpbb.com/</div>
+ <div class="copyright">Powered by phpBB&reg; Forum Software &copy; phpBB Group<br />https://www.phpbb.com/</div>
</div>
</div>
diff --git a/phpBB/styles/prosilver/theme/stylesheet.css b/phpBB/styles/prosilver/theme/stylesheet.css
index 419de4e6ec..48a00c6803 100644
--- a/phpBB/styles/prosilver/theme/stylesheet.css
+++ b/phpBB/styles/prosilver/theme/stylesheet.css
@@ -3,7 +3,7 @@
Style name: prosilver (the default phpBB 3.1.x style)
Based on style:
Original author: Tom Beddard ( http://www.subblue.com/ )
- Modified by: phpBB Group ( http://www.phpbb.com/ )
+ Modified by: phpBB Group ( https://www.phpbb.com/ )
--------------------------------------------------------------
*/
diff --git a/phpBB/styles/subsilver2/template/simple_footer.html b/phpBB/styles/subsilver2/template/simple_footer.html
index 6082b71891..38a86c5001 100644
--- a/phpBB/styles/subsilver2/template/simple_footer.html
+++ b/phpBB/styles/subsilver2/template/simple_footer.html
@@ -2,7 +2,7 @@
</div>
<div id="wrapfooter">
- <span class="copyright">{CREDIT_LINE}
+ <span class="copyright">{CREDIT_LINE}</span>
</div>
<script type="text/javascript" src="{T_JQUERY_LINK}"></script>
diff --git a/phpBB/styles/subsilver2/template/ucp_pm_viewmessage_print.html b/phpBB/styles/subsilver2/template/ucp_pm_viewmessage_print.html
index 7c368c8124..041fca48a7 100644
--- a/phpBB/styles/subsilver2/template/ucp_pm_viewmessage_print.html
+++ b/phpBB/styles/subsilver2/template/ucp_pm_viewmessage_print.html
@@ -112,7 +112,7 @@ hr.sep {
<td align="{S_CONTENT_FLOW_END}"><span class="gensmall">{S_TIMEZONE}</span></td>
</tr>
<tr>
- <td colspan="2" align="center"><span class="gensmall">Powered by phpBB&reg; Forum Software &copy; phpBB Group<br />http://www.phpbb.com/</span></td>
+ <td colspan="2" align="center"><span class="gensmall">Powered by phpBB&reg; Forum Software &copy; phpBB Group<br />https://www.phpbb.com/</span></td>
</tr>
</table>
diff --git a/phpBB/styles/subsilver2/template/viewtopic_print.html b/phpBB/styles/subsilver2/template/viewtopic_print.html
index 07da8ef752..7e84b6fdad 100644
--- a/phpBB/styles/subsilver2/template/viewtopic_print.html
+++ b/phpBB/styles/subsilver2/template/viewtopic_print.html
@@ -126,7 +126,7 @@ hr.sep {
<td align="{S_CONTENT_FLOW_END}"><span class="gensmall">{S_TIMEZONE}</span></td>
</tr>
<tr>
- <td colspan="2" align="center"><span class="gensmall">Powered by phpBB&reg; Forum Software &copy; phpBB Group<br />http://www.phpbb.com/</span></td>
+ <td colspan="2" align="center"><span class="gensmall">Powered by phpBB&reg; Forum Software &copy; phpBB Group<br />https://www.phpbb.com/</span></td>
</tr>
</table>
diff --git a/phpBB/styles/subsilver2/theme/stylesheet.css b/phpBB/styles/subsilver2/theme/stylesheet.css
index 9e258ea778..977e5c20c6 100644
--- a/phpBB/styles/subsilver2/theme/stylesheet.css
+++ b/phpBB/styles/subsilver2/theme/stylesheet.css
@@ -3,7 +3,7 @@
Style name: subsilver2
Based on style: subSilver (the default phpBB 2.0.x style)
Original author: Tom Beddard ( http://www.subblue.com/ )
- Modified by: phpBB Group ( http://www.phpbb.com/ )
+ Modified by: phpBB Group ( https://www.phpbb.com/ )
--------------------------------------------------------------
*/
diff --git a/tests/request/type_cast_helper_test.php b/tests/request/type_cast_helper_test.php
index d553d5b8cd..f41db005af 100644
--- a/tests/request/type_cast_helper_test.php
+++ b/tests/request/type_cast_helper_test.php
@@ -48,4 +48,24 @@ class phpbb_type_cast_helper_test extends phpbb_test_case
$this->assertEquals($expected, $data);
}
+
+ public function test_simple_untrimmed_recursive_set_var()
+ {
+ $data = " eviL<3\t\t";
+ $expected = " eviL&lt;3\t\t";
+
+ $this->type_cast_helper->recursive_set_var($data, '', true, false);
+
+ $this->assertEquals($expected, $data);
+ }
+
+ public function test_nested_untrimmed_recursive_set_var()
+ {
+ $data = array(" eviL<3\t\t");
+ $expected = array(" eviL&lt;3\t\t");
+
+ $this->type_cast_helper->recursive_set_var($data, array(0 => ''), true, false);
+
+ $this->assertEquals($expected, $data);
+ }
}