From 882a3c383103802c491404032c5d267e4f5271a0 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Sat, 22 Jul 2017 17:26:41 +0200 Subject: [ticket/security/211] Make sure website URL only uses http & https schemes SECURITY-211 --- phpBB/phpbb/profilefields/type/type_url.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/phpbb') diff --git a/phpBB/phpbb/profilefields/type/type_url.php b/phpBB/phpbb/profilefields/type/type_url.php index 375cf5b19a..2bc0002262 100644 --- a/phpBB/phpbb/profilefields/type/type_url.php +++ b/phpBB/phpbb/profilefields/type/type_url.php @@ -64,7 +64,7 @@ class type_url extends type_string return false; } - if (!preg_match('#^' . get_preg_expression('url') . '$#iu', $field_value)) + if (!preg_match('#^' . get_preg_expression('url_http') . '$#iu', $field_value)) { return $this->user->lang('FIELD_INVALID_URL', $this->get_field_name($field_data['lang_name'])); } -- cgit v1.2.1 From 2749bfe26ccae7db4174cdd83453d79366113c28 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Sun, 23 Jul 2017 10:40:30 +0200 Subject: [ticket/security/211] Only run make_clickable() on URL type profile fields SECURITY-211 --- phpBB/phpbb/profilefields/type/type_string_common.php | 1 - phpBB/phpbb/profilefields/type/type_url.php | 15 +++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) (limited to 'phpBB/phpbb') diff --git a/phpBB/phpbb/profilefields/type/type_string_common.php b/phpBB/phpbb/profilefields/type/type_string_common.php index f5e1992044..2648d03930 100644 --- a/phpBB/phpbb/profilefields/type/type_string_common.php +++ b/phpBB/phpbb/profilefields/type/type_string_common.php @@ -108,7 +108,6 @@ abstract class type_string_common extends type_base return null; } - $field_value = make_clickable($field_value); $field_value = censor_text($field_value); $field_value = bbcode_nl2br($field_value); return $field_value; diff --git a/phpBB/phpbb/profilefields/type/type_url.php b/phpBB/phpbb/profilefields/type/type_url.php index 2bc0002262..7bdd60e19d 100644 --- a/phpBB/phpbb/profilefields/type/type_url.php +++ b/phpBB/phpbb/profilefields/type/type_url.php @@ -71,4 +71,19 @@ class type_url extends type_string return false; } + + /** + * {@inheritDoc} + */ + public function get_profile_value($field_value, $field_data) + { + if (!preg_match('#^' . get_preg_expression('url_http') . '$#iu', $field_value)) + { + return null; + } + + $field_value = make_clickable($field_value); + + return parent::get_profile_value($field_value, $field_data); + } } -- cgit v1.2.1