From f7723b3e959b0cfd5ae738f9745f367aef1f0d47 Mon Sep 17 00:00:00 2001 From: Josh Woody Date: Wed, 5 Jan 2011 18:48:57 -0600 Subject: [ticket/9970] User language input is checked for existance Users could select a language which did not exist in the database by altering form fields because there was no back-end verification. PHPBB3-9970 --- phpBB/includes/functions_user.php | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'phpBB/includes/functions_user.php') diff --git a/phpBB/includes/functions_user.php b/phpBB/includes/functions_user.php index 0420aa70ab..7bab51323b 100644 --- a/phpBB/includes/functions_user.php +++ b/phpBB/includes/functions_user.php @@ -1421,6 +1421,36 @@ function validate_match($string, $optional = false, $match = '') return false; } +/** +* Validate Language string +* +* Tests whether a language string is valid and exists on the disk +* This is the same criteria used to determine whether to include it or not. +* +* @param $lang - The language string to test +* +* @return boolean|string Either false if validation succeeded or a string which will be used as the error message (with the variable name appended) +*/ +function validate_language($lang) +{ + global $phpbb_root_path; + + // Note: Two language strings are identical here because the English + // version "Language you specified is not valid" is correct for both + // cases + if (!preg_match('#^[a-z_\-]{2,}$#i', $lang)) + { + return 'WRONG_DATA'; + } + + if (!file_exists($phpbb_root_path . 'language/' . $lang . '/')) + { + return 'WRONG_DATA'; + } + + return false; +} + /** * Check to see if the username has been taken, or if it is disallowed. * Also checks if it includes the " character, which we don't allow in usernames. -- cgit v1.2.1 From 405ef3982891712b0d88a04502ee2ad0141d571f Mon Sep 17 00:00:00 2001 From: Andreas Fischer Date: Sun, 6 Mar 2011 23:47:47 +0100 Subject: [ticket/9970] Check whether language pack is installed. PHPBB3-9970 --- phpBB/includes/functions_user.php | 33 ++++++++++++++------------------- 1 file changed, 14 insertions(+), 19 deletions(-) (limited to 'phpBB/includes/functions_user.php') diff --git a/phpBB/includes/functions_user.php b/phpBB/includes/functions_user.php index 7bab51323b..9b0175694d 100644 --- a/phpBB/includes/functions_user.php +++ b/phpBB/includes/functions_user.php @@ -1422,33 +1422,28 @@ function validate_match($string, $optional = false, $match = '') } /** -* Validate Language string +* Validate Language Pack ISO Name * -* Tests whether a language string is valid and exists on the disk -* This is the same criteria used to determine whether to include it or not. +* Tests whether a language name is valid and installed * -* @param $lang - The language string to test +* @param string $lang The language string to test * -* @return boolean|string Either false if validation succeeded or a string which will be used as the error message (with the variable name appended) +* @return bool|string Either false if validation succeeded or +* a string which will be used as the error message +* (with the variable name appended) */ function validate_language($lang) { - global $phpbb_root_path; - - // Note: Two language strings are identical here because the English - // version "Language you specified is not valid" is correct for both - // cases - if (!preg_match('#^[a-z_\-]{2,}$#i', $lang)) - { - return 'WRONG_DATA'; - } + global $db; - if (!file_exists($phpbb_root_path . 'language/' . $lang . '/')) - { - return 'WRONG_DATA'; - } + $sql = 'SELECT lang_id + FROM ' . LANG_TABLE . " + WHERE lang_iso = '" . $db->sql_escape($lang) . "'"; + $result = $db->sql_query($sql); + $lang_id = (int) $db->sql_fetchfield('lang_id'); + $db->sql_freeresult($result); - return false; + return ($lang_id) ? false : 'WRONG_DATA'; } /** -- cgit v1.2.1 From ac9019068202efde7c532462ca5fce8523956db7 Mon Sep 17 00:00:00 2001 From: Andreas Fischer Date: Mon, 7 Mar 2011 00:23:49 +0100 Subject: [ticket/9970] Rename validate_language() to validate_language_iso_name(). PHPBB3-9970 --- phpBB/includes/functions_user.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'phpBB/includes/functions_user.php') diff --git a/phpBB/includes/functions_user.php b/phpBB/includes/functions_user.php index 9b0175694d..8a204995aa 100644 --- a/phpBB/includes/functions_user.php +++ b/phpBB/includes/functions_user.php @@ -1426,19 +1426,19 @@ function validate_match($string, $optional = false, $match = '') * * Tests whether a language name is valid and installed * -* @param string $lang The language string to test +* @param string $lang_iso The language string to test * -* @return bool|string Either false if validation succeeded or -* a string which will be used as the error message -* (with the variable name appended) +* @return bool|string Either false if validation succeeded or +* a string which will be used as the error message +* (with the variable name appended) */ -function validate_language($lang) +function validate_language_iso_name($lang_iso) { global $db; $sql = 'SELECT lang_id FROM ' . LANG_TABLE . " - WHERE lang_iso = '" . $db->sql_escape($lang) . "'"; + WHERE lang_iso = '" . $db->sql_escape($lang_iso) . "'"; $result = $db->sql_query($sql); $lang_id = (int) $db->sql_fetchfield('lang_id'); $db->sql_freeresult($result); -- cgit v1.2.1