makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-29 06:38:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/security/235] Apply wildcard char count patch

Browse source 
SECURITY-235
This commit is contained in:
Derky 2019-03-14 21:46:02 +01:00
parent df93420bcd
commit 56060caa4c
1 changed files with 15 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
phpBB/phpbb/search/fulltext_native.php
View file

@ -224,12 +224,10 @@ class fulltext_native extends \phpbb\search\base
$keywords[$i] = '|'; $keywords[$i] = '|';
break; break;
case '*': case '*':
if ($i === 0 || ($keywords[$i - 1] !== '*' && strcspn($keywords[$i - 1], $tokens) === 0)) // $i can never be 0 here since $open_bracket is initialised to false
if (strpos($tokens, $keywords[$i - 1]) !== false && ($i + 1 === $n || strpos($tokens, $keywords[$i + 1]) !== false))
{ {
if ($i === $n - 1 || ($keywords[$i + 1] !== '*' && strcspn($keywords[$i + 1], $tokens) === 0)) $keywords[$i] = '|';
{
$keywords = substr($keywords, 0, $i) . substr($keywords, $i + 1);
}
} }
break; break;
} }
@ -264,7 +262,7 @@ class fulltext_native extends \phpbb\search\base
} }
} }
if ($open_bracket) if ($open_bracket !== false)
{ {
$keywords .= ')'; $keywords .= ')';
} }
@ -408,10 +406,18 @@ class fulltext_native extends \phpbb\search\base
foreach ($word as $i => $word_part) foreach ($word as $i => $word_part)
{ {
if (strpos($word_part, '*') !== false) if (strpos($word_part, '*') !== false)
{
$len = utf8_strlen(str_replace('*', '', $word_part));
if ($len >= $this->word_length['min'] && $len <= $this->word_length['max'])
{ {
$id_words[] = '\'' . $this->db->sql_escape(str_replace('*', '%', $word_part)) . '\''; $id_words[] = '\'' . $this->db->sql_escape(str_replace('*', '%', $word_part)) . '\'';
$non_common_words[] = $word_part; $non_common_words[] = $word_part;
} }
else
{
$this->common_words[] = $word_part;
}
}
else if (isset($words[$word_part])) else if (isset($words[$word_part]))
{ {
$id_words[] = $words[$word_part]; $id_words[] = $words[$word_part];