From ef7a7cac6dc3f313960a70462b084fbeaff9d4bd Mon Sep 17 00:00:00 2001 From: Bruno Ais Date: Fri, 19 Jul 2013 18:27:25 +0100 Subject: [PATCH 1/5] [ticket/11655] generate_text_for_display on ucp_pm_viewmessage.php sub-task of ticket PHPBB3-11635: find and fix all bypasses of generate_text_for_* PHPBB3-11655 --- phpBB/includes/ucp/ucp_pm_viewmessage.php | 28 ++--------------------- 1 file changed, 2 insertions(+), 26 deletions(-) diff --git a/phpBB/includes/ucp/ucp_pm_viewmessage.php b/phpBB/includes/ucp/ucp_pm_viewmessage.php index b7d2dd6821..0a8a3d55ab 100644 --- a/phpBB/includes/ucp/ucp_pm_viewmessage.php +++ b/phpBB/includes/ucp/ucp_pm_viewmessage.php @@ -76,17 +76,7 @@ function view_message($id, $mode, $folder_id, $msg_id, $folder, $message_row) $user_info = get_user_information($author_id, $message_row); // Parse the message and subject - $message = censor_text($message_row['message_text']); - - // Second parse bbcode here - if ($message_row['bbcode_bitfield']) - { - $bbcode->bbcode_second_pass($message, $message_row['bbcode_uid'], $message_row['bbcode_bitfield']); - } - - // Always process smilies after parsing bbcodes - $message = bbcode_nl2br($message); - $message = smiley_text($message); + $message = generate_text_for_display($message_row['message_text'], $message_row['bbcode_uid'], $message_row['bbcode_bitfield'], ($message_row['bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES, true); // Replace naughty words such as farty pants $message_row['message_subject'] = censor_text($message_row['message_subject']); @@ -160,21 +150,7 @@ function view_message($id, $mode, $folder_id, $msg_id, $folder, $message_row) // End signature parsing, only if needed if ($signature) { - $signature = censor_text($signature); - - if ($user_info['user_sig_bbcode_bitfield']) - { - if ($bbcode === false) - { - include($phpbb_root_path . 'includes/bbcode.' . $phpEx); - $bbcode = new bbcode($user_info['user_sig_bbcode_bitfield']); - } - - $bbcode->bbcode_second_pass($signature, $user_info['user_sig_bbcode_uid'], $user_info['user_sig_bbcode_bitfield']); - } - - $signature = bbcode_nl2br($signature); - $signature = smiley_text($signature); + $signature = generate_text_for_display($signature, $user_info['bbcode_uid'], $user_info['bbcode_bitfield'], ($user_info['bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES, true); } $url = append_sid("{$phpbb_root_path}ucp.$phpEx", 'i=pm'); From 43b172c8aabbfbcc5180a3f3ad5daede45fcc041 Mon Sep 17 00:00:00 2001 From: Bruno Ais Date: Sat, 20 Jul 2013 16:44:24 +0100 Subject: [PATCH 2/5] [ticket/11655] wrong var names for the uid and for the bitfield sub-task of ticket PHPBB3-11635: find and fix all bypasses of generate_text_for_* PHPBB3-11655 --- phpBB/includes/ucp/ucp_pm_viewmessage.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/phpBB/includes/ucp/ucp_pm_viewmessage.php b/phpBB/includes/ucp/ucp_pm_viewmessage.php index 0a8a3d55ab..52a28e3552 100644 --- a/phpBB/includes/ucp/ucp_pm_viewmessage.php +++ b/phpBB/includes/ucp/ucp_pm_viewmessage.php @@ -150,7 +150,7 @@ function view_message($id, $mode, $folder_id, $msg_id, $folder, $message_row) // End signature parsing, only if needed if ($signature) { - $signature = generate_text_for_display($signature, $user_info['bbcode_uid'], $user_info['bbcode_bitfield'], ($user_info['bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES, true); + $signature = generate_text_for_display($signature, $user_info['user_sig_bbcode_uid'], $user_info['user_sig_bbcode_bitfield'], ($user_info['user_sig_bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES, true); } $url = append_sid("{$phpbb_root_path}ucp.$phpEx", 'i=pm'); From c2aff70cf561c1787be6cdaa193432d0cbdf432d Mon Sep 17 00:00:00 2001 From: Bruno Ais Date: Thu, 1 Aug 2013 10:03:04 +0100 Subject: [PATCH 3/5] [ticket/11655] Use $parse_flags sub-task of ticket PHPBB3-11635: find and fix all bypasses of generate_text_for_* PHPBB3-11655 --- phpBB/includes/ucp/ucp_pm_viewmessage.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/phpBB/includes/ucp/ucp_pm_viewmessage.php b/phpBB/includes/ucp/ucp_pm_viewmessage.php index 52a28e3552..8e7ae49fa4 100644 --- a/phpBB/includes/ucp/ucp_pm_viewmessage.php +++ b/phpBB/includes/ucp/ucp_pm_viewmessage.php @@ -76,7 +76,8 @@ function view_message($id, $mode, $folder_id, $msg_id, $folder, $message_row) $user_info = get_user_information($author_id, $message_row); // Parse the message and subject - $message = generate_text_for_display($message_row['message_text'], $message_row['bbcode_uid'], $message_row['bbcode_bitfield'], ($message_row['bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES, true); + $parse_flags = ($message_row['bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES + $message = generate_text_for_display($message_row['message_text'], $message_row['bbcode_uid'], $message_row['bbcode_bitfield'], $parse_flags, true); // Replace naughty words such as farty pants $message_row['message_subject'] = censor_text($message_row['message_subject']); From c806375828c01c011915f1438f718349aaaaf282 Mon Sep 17 00:00:00 2001 From: Bruno Ais Date: Thu, 1 Aug 2013 10:09:11 +0100 Subject: [PATCH 4/5] [ticket/11653] Missing ";" sub-task of ticket PHPBB3-11635: find and fix all bypasses of generate_text_for_* PHPBB3-11653 --- phpBB/includes/ucp/ucp_pm_viewmessage.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/phpBB/includes/ucp/ucp_pm_viewmessage.php b/phpBB/includes/ucp/ucp_pm_viewmessage.php index 8e7ae49fa4..79c4297858 100644 --- a/phpBB/includes/ucp/ucp_pm_viewmessage.php +++ b/phpBB/includes/ucp/ucp_pm_viewmessage.php @@ -76,7 +76,7 @@ function view_message($id, $mode, $folder_id, $msg_id, $folder, $message_row) $user_info = get_user_information($author_id, $message_row); // Parse the message and subject - $parse_flags = ($message_row['bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES + $parse_flags = ($message_row['bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES; $message = generate_text_for_display($message_row['message_text'], $message_row['bbcode_uid'], $message_row['bbcode_bitfield'], $parse_flags, true); // Replace naughty words such as farty pants From 3ae33910fc600ae86f0036370958bd7ec19e7ab9 Mon Sep 17 00:00:00 2001 From: Bruno Ais Date: Thu, 1 Aug 2013 10:14:34 +0100 Subject: [PATCH 5/5] [ticket/11653] Use $parse_flags sub-task of ticket PHPBB3-11635: find and fix all bypasses of generate_text_for_* PHPBB3-11653 --- phpBB/includes/ucp/ucp_pm_viewmessage.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/phpBB/includes/ucp/ucp_pm_viewmessage.php b/phpBB/includes/ucp/ucp_pm_viewmessage.php index 79c4297858..c7b4489daf 100644 --- a/phpBB/includes/ucp/ucp_pm_viewmessage.php +++ b/phpBB/includes/ucp/ucp_pm_viewmessage.php @@ -151,7 +151,8 @@ function view_message($id, $mode, $folder_id, $msg_id, $folder, $message_row) // End signature parsing, only if needed if ($signature) { - $signature = generate_text_for_display($signature, $user_info['user_sig_bbcode_uid'], $user_info['user_sig_bbcode_bitfield'], ($user_info['user_sig_bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES, true); + $parse_flags = ($user_info['user_sig_bbcode_bitfield'] ? OPTION_FLAG_BBCODE : 0) | OPTION_FLAG_SMILIES; + $signature = generate_text_for_display($signature, $user_info['user_sig_bbcode_uid'], $user_info['user_sig_bbcode_bitfield'], $parse_flags, true); } $url = append_sid("{$phpbb_root_path}ucp.$phpEx", 'i=pm');