From 3ecd2f150d488debf10747df19af10a41646c0e1 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Sat, 2 May 2020 14:24:06 +0200 Subject: [PATCH 1/4] [ticket/security/257] Enforce http(s) for URLs in image BBCode SECURITY-257 --- phpBB/includes/message_parser.php | 2 +- tests/bbcode/parser_test.php | 5 +++++ tests/text_formatter/s9e/default_formatting_test.php | 4 ++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/phpBB/includes/message_parser.php b/phpBB/includes/message_parser.php index e1c28223dc..2c55d7b260 100644 --- a/phpBB/includes/message_parser.php +++ b/phpBB/includes/message_parser.php @@ -390,7 +390,7 @@ class bbcode_firstpass extends bbcode $in = str_replace(' ', '%20', $in); // Checking urls - if (!preg_match('#^' . get_preg_expression('url') . '$#iu', $in) && !preg_match('#^' . get_preg_expression('www_url') . '$#iu', $in)) + if (!preg_match('#^' . get_preg_expression('url_http') . '$#iu', $in) && !preg_match('#^' . get_preg_expression('www_url') . '$#iu', $in)) { return '[img]' . $in . '[/img]'; } diff --git a/tests/bbcode/parser_test.php b/tests/bbcode/parser_test.php index b569d371f1..ecd946c59f 100644 --- a/tests/bbcode/parser_test.php +++ b/tests/bbcode/parser_test.php @@ -120,6 +120,11 @@ class phpbb_bbcode_parser_test extends \phpbb_test_case '[img]https://area51.phpbb.com/images/area51.png[/img]', '[img:]https://area51.phpbb.com/images/area51.png[/img:]', ), + array( + 'Test default bbcodes: img with unsupported protocol', + '[img]foo://foo/bar[/img]', + '[img]foo://foo/bar[/img]', + ), array( 'Test default bbcodes: simple url', '[url]https://area51.phpbb.com/[/url]', diff --git a/tests/text_formatter/s9e/default_formatting_test.php b/tests/text_formatter/s9e/default_formatting_test.php index ce15a52adc..80c06196ca 100644 --- a/tests/text_formatter/s9e/default_formatting_test.php +++ b/tests/text_formatter/s9e/default_formatting_test.php @@ -132,6 +132,10 @@ class phpbb_textformatter_s9e_default_formatting_test extends phpbb_test_case '[img]https://area51.phpbb.com/images/area51.png[/img]', 'Image' ), + array( + '[img]foo://area51.phpbb.com/images/area51.png[/img]', + '[img]foo://area51.phpbb.com/images/area51.png[/img]' + ), array( '[url]https://area51.phpbb.com/[/url]', 'https://area51.phpbb.com/' From d0e2023a63d7a158f275a79a57356f769c54ee01 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Thu, 25 Jun 2020 22:20:58 +0200 Subject: [PATCH 2/4] [ticket/security-259] Stop checking image size of images in img bbcode SECURITY-259 --- phpBB/includes/message_parser.php | 26 ---------------- phpBB/phpbb/textformatter/s9e/factory.php | 2 -- phpBB/phpbb/textformatter/s9e/parser.php | 28 ++--------------- tests/text_processing/message_parser_test.php | 30 ------------------- 4 files changed, 2 insertions(+), 84 deletions(-) diff --git a/phpBB/includes/message_parser.php b/phpBB/includes/message_parser.php index e1c28223dc..7bd444b4a3 100644 --- a/phpBB/includes/message_parser.php +++ b/phpBB/includes/message_parser.php @@ -401,32 +401,6 @@ class bbcode_firstpass extends bbcode $in = 'http://' . $in; } - if ($config['max_' . $this->mode . '_img_height'] || $config['max_' . $this->mode . '_img_width']) - { - $imagesize = new \FastImageSize\FastImageSize(); - $size_info = $imagesize->getImageSize(htmlspecialchars_decode($in)); - - if ($size_info === false) - { - $error = true; - $this->warn_msg[] = $user->lang['UNABLE_GET_IMAGE_SIZE']; - } - else - { - if ($config['max_' . $this->mode . '_img_height'] && $config['max_' . $this->mode . '_img_height'] < $size_info['height']) - { - $error = true; - $this->warn_msg[] = $user->lang('MAX_IMG_HEIGHT_EXCEEDED', (int) $config['max_' . $this->mode . '_img_height']); - } - - if ($config['max_' . $this->mode . '_img_width'] && $config['max_' . $this->mode . '_img_width'] < $size_info['width']) - { - $error = true; - $this->warn_msg[] = $user->lang('MAX_IMG_WIDTH_EXCEEDED', (int) $config['max_' . $this->mode . '_img_width']); - } - } - } - if ($error || $this->path_in_domain($in)) { return '[img]' . $in . '[/img]'; diff --git a/phpBB/phpbb/textformatter/s9e/factory.php b/phpBB/phpbb/textformatter/s9e/factory.php index 725844e2d3..7b79405f7e 100644 --- a/phpBB/phpbb/textformatter/s9e/factory.php +++ b/phpBB/phpbb/textformatter/s9e/factory.php @@ -273,8 +273,6 @@ class factory implements \phpbb\textformatter\cache_interface ->add('#imageurl', __NAMESPACE__ . '\\parser::filter_img_url') ->addParameterByName('urlConfig') ->addParameterByName('logger') - ->addParameterByName('max_img_height') - ->addParameterByName('max_img_width') ->markAsSafeAsURL() ->setJS('UrlFilter.filter'); diff --git a/phpBB/phpbb/textformatter/s9e/parser.php b/phpBB/phpbb/textformatter/s9e/parser.php index 1151f09898..590afc0ebc 100644 --- a/phpBB/phpbb/textformatter/s9e/parser.php +++ b/phpBB/phpbb/textformatter/s9e/parser.php @@ -380,11 +380,10 @@ class parser implements \phpbb\textformatter\parser_interface * @param string $url Original URL * @param array $url_config Config used by the URL filter * @param Logger $logger - * @param integer $max_height Maximum height allowed - * @param integer $max_width Maximum width allowed + * * @return string|bool Original value if valid, FALSE otherwise */ - static public function filter_img_url($url, array $url_config, Logger $logger, $max_height, $max_width) + static public function filter_img_url($url, array $url_config, Logger $logger) { // Validate the URL $url = UrlFilter::filter($url, $url_config, $logger); @@ -393,29 +392,6 @@ class parser implements \phpbb\textformatter\parser_interface return false; } - if ($max_height || $max_width) - { - $imagesize = new \FastImageSize\FastImageSize(); - $size_info = $imagesize->getImageSize($url); - if ($size_info === false) - { - $logger->err('UNABLE_GET_IMAGE_SIZE'); - return false; - } - - if ($max_height && $max_height < $size_info['height']) - { - $logger->err('MAX_IMG_HEIGHT_EXCEEDED', array('max_height' => $max_height)); - return false; - } - - if ($max_width && $max_width < $size_info['width']) - { - $logger->err('MAX_IMG_WIDTH_EXCEEDED', array('max_width' => $max_width)); - return false; - } - } - return $url; } diff --git a/tests/text_processing/message_parser_test.php b/tests/text_processing/message_parser_test.php index a3dbf644f6..d302ee9504 100644 --- a/tests/text_processing/message_parser_test.php +++ b/tests/text_processing/message_parser_test.php @@ -342,26 +342,6 @@ class phpbb_text_processing_message_parser_test extends phpbb_test_case }, array('You may only use fonts up to size 120.') ), - array( - '[img]http://example.org/100x100.png[/img]', - '[img]http://example.org/100x100.png[/img]', - array(true, true, true, true, true, true, true), - function ($phpbb_container) - { - $phpbb_container->get('config')->set('max_post_img_height', 12); - }, - array('Your images may only be up to 12 pixels high.') - ), - array( - '[img]http://example.org/100x100.png[/img]', - '[img]http://example.org/100x100.png[/img]', - array(true, true, true, true, true, true, true), - function ($phpbb_container) - { - $phpbb_container->get('config')->set('max_post_img_width', 34); - }, - array('Your images may only be up to 34 pixels wide.') - ), array( '[img]http://example.org/100x100.png[/img]', '[img]http://example.org/100x100.png[/img]', @@ -392,16 +372,6 @@ class phpbb_text_processing_message_parser_test extends phpbb_test_case $phpbb_container->get('config')->set('max_sig_img_width', 34); } ), - array( - '[img]http://example.org/404.png[/img]', - '[img]http://example.org/404.png[/img]', - array(true, true, true, true, true, true, true), - function ($phpbb_container) - { - $phpbb_container->get('config')->set('max_post_img_height', 12); - }, - array('It was not possible to determine the dimensions of the image.') - ), array( '[flash=999,999]http://example.org/foo.swf[/flash]', '[flash=999,999]http://example.org/foo.swf[/flash]', From b0b78ee144fa2aaf1378d1b01f4fa58721ea91a9 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Thu, 25 Jun 2020 22:28:03 +0200 Subject: [PATCH 3/4] [ticket/security-259] Adjust wording of setting in ACP SECURITY-259 --- phpBB/language/en/acp/board.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/phpBB/language/en/acp/board.php b/phpBB/language/en/acp/board.php index e237446dde..61a3fa5e29 100644 --- a/phpBB/language/en/acp/board.php +++ b/phpBB/language/en/acp/board.php @@ -183,10 +183,10 @@ $lang = array_merge($lang, array( 'MAX_POLL_OPTIONS' => 'Maximum number of poll options', 'MAX_POST_FONT_SIZE' => 'Maximum font size per post', 'MAX_POST_FONT_SIZE_EXPLAIN' => 'Maximum font size allowed in a post. Set to 0 for unlimited font size.', - 'MAX_POST_IMG_HEIGHT' => 'Maximum image height per post', - 'MAX_POST_IMG_HEIGHT_EXPLAIN' => 'Maximum height of an image/flash file in postings. Set to 0 for unlimited size.', - 'MAX_POST_IMG_WIDTH' => 'Maximum image width per post', - 'MAX_POST_IMG_WIDTH_EXPLAIN' => 'Maximum width of an image/flash file in postings. Set to 0 for unlimited size.', + 'MAX_POST_IMG_HEIGHT' => 'Maximum flash height per post', + 'MAX_POST_IMG_HEIGHT_EXPLAIN' => 'Maximum height of a flash file in postings. Set to 0 for unlimited size.', + 'MAX_POST_IMG_WIDTH' => 'Maximum flash width per post', + 'MAX_POST_IMG_WIDTH_EXPLAIN' => 'Maximum width of a flash file in postings. Set to 0 for unlimited size.', 'MAX_POST_URLS' => 'Maximum links per post', 'MAX_POST_URLS_EXPLAIN' => 'Maximum number of URLs in a post. Set to 0 for unlimited links.', 'MIN_CHAR_LIMIT' => 'Minimum characters per post/message', From f3093a3740fd2f72ba3c4d30b12e62ac08bb9cd6 Mon Sep 17 00:00:00 2001 From: rxu Date: Sun, 29 Mar 2020 02:22:47 +0700 Subject: [PATCH 4/4] [ticket/16417] Fix CLI database migration for phpBB 3.0.x PHPBB3-16417 --- phpBB/bin/phpbbcli.php | 2 +- phpBB/install/phpbbcli.php | 5 ++++- phpBB/phpbb/console/application.php | 23 +++++++++++++++++++---- 3 files changed, 24 insertions(+), 6 deletions(-) diff --git a/phpBB/bin/phpbbcli.php b/phpBB/bin/phpbbcli.php index 5ae18334d9..bee58f2bb9 100755 --- a/phpBB/bin/phpbbcli.php +++ b/phpBB/bin/phpbbcli.php @@ -84,7 +84,7 @@ $user = $phpbb_container->get('user'); $user->data['user_id'] = ANONYMOUS; $user->ip = '127.0.0.1'; -$application = new \phpbb\console\application('phpBB Console', PHPBB_VERSION, $language); +$application = new \phpbb\console\application('phpBB Console', PHPBB_VERSION, $language, $config); $application->setDispatcher($phpbb_container->get('dispatcher')); $application->register_container_commands($phpbb_container->get('console.command_collection')); $application->run($input); diff --git a/phpBB/install/phpbbcli.php b/phpBB/install/phpbbcli.php index 2afe776f85..857070c795 100755 --- a/phpBB/install/phpbbcli.php +++ b/phpBB/install/phpbbcli.php @@ -42,11 +42,14 @@ $phpbb_installer_container->get('request')->enable_super_globals(); /** @var \phpbb\filesystem\filesystem $phpbb_filesystem */ $phpbb_filesystem = $phpbb_installer_container->get('filesystem'); +/** @var \phpbb\config\config $config */ +$config = $phpbb_installer_container->get('config'); + /** @var \phpbb\language\language $language */ $language = $phpbb_installer_container->get('language'); $language->add_lang(array('common', 'acp/common', 'acp/board', 'install', 'posting', 'cli')); -$application = new \phpbb\console\application('phpBB Installer', PHPBB_VERSION, $language); +$application = new \phpbb\console\application('phpBB Installer', PHPBB_VERSION, $language, $config); $application->setDispatcher($phpbb_installer_container->get('dispatcher')); $application->register_container_commands($phpbb_installer_container->get('console.installer.command_collection')); $application->run($input); diff --git a/phpBB/phpbb/console/application.php b/phpBB/phpbb/console/application.php index dc9b8016b2..830ed1b2c1 100644 --- a/phpBB/phpbb/console/application.php +++ b/phpBB/phpbb/console/application.php @@ -27,7 +27,12 @@ class application extends \Symfony\Component\Console\Application protected $in_shell = false; /** - * @var \phpbb\language\language User object + * @var \phpbb\config\config Config object + */ + protected $config; + + /** + * @var \phpbb\language\language Language object */ protected $language; @@ -35,10 +40,12 @@ class application extends \Symfony\Component\Console\Application * @param string $name The name of the application * @param string $version The version of the application * @param \phpbb\language\language $language The user which runs the application (used for translation) + * @param \phpbb\config\config $config Config object */ - public function __construct($name, $version, \phpbb\language\language $language) + public function __construct($name, $version, \phpbb\language\language $language, \phpbb\config\config $config) { $this->language = $language; + $this->config = $config; parent::__construct($name, $version); } @@ -97,9 +104,17 @@ class application extends \Symfony\Component\Console\Application */ public function register_container_commands(\phpbb\di\service_collection $command_collection) { - foreach ($command_collection as $service_command) + $commands_list = array_keys($command_collection->getArrayCopy()); + foreach ($commands_list as $service_command) { - $this->add($service_command); + // config_text DB table does not exist in phpBB prior to 3.1 + // Hence skip cron tasks as they include reparser cron as it uses config_text table + if (phpbb_version_compare($this->config['version'], '3.1.0', '<') && strpos($service_command, 'cron') !== false) + { + continue; + } + $this->add($command_collection[$service_command]); + } }