From f2d3879da419624a817b247efac73bad27887498 Mon Sep 17 00:00:00 2001 From: Nathan Guse Date: Sun, 9 Mar 2014 11:26:06 -0500 Subject: [PATCH 1/6] [ticket/12202] Apply htmlspecialchars to style.cfg data PHPBB3-12202 --- phpBB/includes/functions.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php index eef4ade4e7..81a7dc5cbd 100644 --- a/phpBB/includes/functions.php +++ b/phpBB/includes/functions.php @@ -3367,8 +3367,8 @@ function parse_cfg_file($filename, $lines = false) } // Determine first occurrence, since in values the equal sign is allowed - $key = strtolower(trim(substr($line, 0, $delim_pos))); - $value = trim(substr($line, $delim_pos + 1)); + $key = htmlspecialchars(strtolower(trim(substr($line, 0, $delim_pos)))); + $value = htmlspecialchars(trim(substr($line, $delim_pos + 1))); if (in_array($value, array('off', 'false', '0'))) { @@ -3384,7 +3384,7 @@ function parse_cfg_file($filename, $lines = false) } else if (($value[0] == "'" && $value[sizeof($value) - 1] == "'") || ($value[0] == '"' && $value[sizeof($value) - 1] == '"')) { - $value = substr($value, 1, sizeof($value)-2); + $value = htmlspecialchars(substr($value, 1, sizeof($value)-2)); } $parsed_items[$key] = $value; From 224e3f139fa34781341f33707268f5a4f3cf61df Mon Sep 17 00:00:00 2001 From: Nathan Guse Date: Sun, 9 Mar 2014 15:20:18 -0500 Subject: [PATCH 2/6] [ticket/12202] Use copyright symbol in style.cfg files PHPBB3-12202 --- phpBB/styles/prosilver/style.cfg | 4 ++-- phpBB/styles/subsilver2/style.cfg | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/phpBB/styles/prosilver/style.cfg b/phpBB/styles/prosilver/style.cfg index 811e5f4376..abd5a5dd22 100644 --- a/phpBB/styles/prosilver/style.cfg +++ b/phpBB/styles/prosilver/style.cfg @@ -18,5 +18,5 @@ # General Information about this style name = prosilver -copyright = © phpBB Group, 2007 -version = 3.0.12 \ No newline at end of file +copyright = © phpBB Group, 2007 +version = 3.0.12 diff --git a/phpBB/styles/subsilver2/style.cfg b/phpBB/styles/subsilver2/style.cfg index b99c433ff1..b0fe5e6639 100644 --- a/phpBB/styles/subsilver2/style.cfg +++ b/phpBB/styles/subsilver2/style.cfg @@ -18,5 +18,5 @@ # General Information about this style name = subsilver2 -copyright = © 2005 phpBB Group +copyright = © 2005 phpBB Group version = 3.0.12 From 49734db9cd2ad8ab6eb6a97f56f7ab712899e281 Mon Sep 17 00:00:00 2001 From: Nathan Guse Date: Sun, 9 Mar 2014 15:20:42 -0500 Subject: [PATCH 3/6] [ticket/12202] Test for parse_cfg_file PHPBB3-12202 --- tests/functions/parse_cfg_file_test.php | 97 +++++++++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 tests/functions/parse_cfg_file_test.php diff --git a/tests/functions/parse_cfg_file_test.php b/tests/functions/parse_cfg_file_test.php new file mode 100644 index 0000000000..daa0062c96 --- /dev/null +++ b/tests/functions/parse_cfg_file_test.php @@ -0,0 +1,97 @@ + 'prosilver', + 'copyright' => '© phpBB Group, 2007', + 'version' => '3.0.12', + ), + ), + array( + 'name = subsilver2 +copyright = © 2005 phpBB Group +version = 3.0.12', + array( + 'name' => 'subsilver2', + 'copyright' => '© 2005 phpBB Group', + 'version' => '3.0.12', + ), + ), + array( + 'foo = yes +foo1 = true +foo2 = 1 +bar = no +bar1 = false +bar2 = 0 +foobar = +foobar1 = "asdf" +foobar2 = \'qwer\'', + array( + 'foo' => true, + 'foo1' => true, + 'foo2' => true, + 'bar' => false, + 'bar1' => false, + 'bar2' => false, + 'foobar' => '', + 'foobar1' => 'asdf', + 'foobar2' => 'qwer', + ), + ), + array( + 'foo = & bar +bar = Test', + array( + 'foo' => '&amp; bar', + 'bar' => '<a href='test'>Test</a>', + ), + ), + ); + } + + /** + * @dataprovider parse_cfg_file_data + */ + public function test_parse_cfg_file($file_contents, $expected) + { + $lines = explode("\n", $file_contents); + $this->assertEquals($expected, parse_cfg_file(false, $lines)); + } +} From 50dd76aef356e38cd774e1fb4b29b59453233418 Mon Sep 17 00:00:00 2001 From: Nathaniel Guse Date: Sun, 9 Mar 2014 17:16:45 -0500 Subject: [PATCH 4/6] [ticket/12202] Fix tests PHPBB3-12202 --- tests/functions/parse_cfg_file_test.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/functions/parse_cfg_file_test.php b/tests/functions/parse_cfg_file_test.php index daa0062c96..43a90ded4f 100644 --- a/tests/functions/parse_cfg_file_test.php +++ b/tests/functions/parse_cfg_file_test.php @@ -54,10 +54,10 @@ version = 3.0.12', ), ), array( - 'foo = yes + 'foo = on foo1 = true foo2 = 1 -bar = no +bar = off bar1 = false bar2 = 0 foobar = @@ -80,15 +80,15 @@ foobar2 = \'qwer\'', bar = Test', array( 'foo' => '&amp; bar', - 'bar' => '<a href='test'>Test</a>', + 'bar' => '<a href="test">Test</a>', ), ), ); } /** - * @dataprovider parse_cfg_file_data - */ + * @dataProvider parse_cfg_file_data + */ public function test_parse_cfg_file($file_contents, $expected) { $lines = explode("\n", $file_contents); From f3d8dfd1e32fd0c58b601d8a7131fa959bff7b53 Mon Sep 17 00:00:00 2001 From: Nathaniel Guse Date: Sun, 9 Mar 2014 17:17:33 -0500 Subject: [PATCH 5/6] [ticket/12202] Can't call htmlspecialchars before checking for quotes PHPBB3-12202 --- phpBB/includes/functions.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php index 81a7dc5cbd..f0657b9016 100644 --- a/phpBB/includes/functions.php +++ b/phpBB/includes/functions.php @@ -3368,7 +3368,7 @@ function parse_cfg_file($filename, $lines = false) // Determine first occurrence, since in values the equal sign is allowed $key = htmlspecialchars(strtolower(trim(substr($line, 0, $delim_pos)))); - $value = htmlspecialchars(trim(substr($line, $delim_pos + 1))); + $value = trim(substr($line, $delim_pos + 1)); if (in_array($value, array('off', 'false', '0'))) { @@ -3386,6 +3386,10 @@ function parse_cfg_file($filename, $lines = false) { $value = htmlspecialchars(substr($value, 1, sizeof($value)-2)); } + else + { + $value = htmlspecialchars($value); + } $parsed_items[$key] = $value; } From 1f8ab1c196351e4adecf63bc102771010b821fda Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Fri, 14 Mar 2014 13:18:30 +0100 Subject: [PATCH 6/6] [ticket/12202] Use an array in the data provider instead of exploding manually PHPBB3-12202 --- tests/functions/parse_cfg_file_test.php | 82 +++++++++++++------------ 1 file changed, 44 insertions(+), 38 deletions(-) diff --git a/tests/functions/parse_cfg_file_test.php b/tests/functions/parse_cfg_file_test.php index 43a90ded4f..69000ddf72 100644 --- a/tests/functions/parse_cfg_file_test.php +++ b/tests/functions/parse_cfg_file_test.php @@ -15,28 +15,29 @@ class phpbb_functions_parse_cfg_file extends phpbb_test_case { return array( array( - '# -# phpBB Style Configuration File -# -# @package phpBB3 -# @copyright (c) 2005 phpBB Group -# @license http://opensource.org/licenses/gpl-license.php GNU Public License -# -# -# At the left is the name, please do not change this -# At the right the value is entered -# For on/off options the valid values are on, off, 1, 0, true and false -# -# Values get trimmed, if you want to add a space in front or at the end of -# the value, then enclose the value with single or double quotes. -# Single and double quotes do not need to be escaped. -# -# - -# General Information about this style -name = prosilver -copyright = © phpBB Group, 2007 -version = 3.0.12', + array( + '#', + '# phpBB Style Configuration File', + '#', + '# @package phpBB3', + '# @copyright (c) 2005 phpBB Group', + '# @license http://opensource.org/licenses/gpl-license.php GNU Public License', + '#', + '#', + '# At the left is the name, please do not change this', + '# At the right the value is entered', + '# For on/off options the valid values are on, off, 1, 0, true and false', + '#', + '# Values get trimmed, if you want to add a space in front or at the end of', + '# the value, then enclose the value with single or double quotes.', + '# Single and double quotes do not need to be escaped.', + '#', + '', + '# General Information about this style', + 'name = prosilver', + 'copyright = © phpBB Group, 2007', + 'version = 3.0.12', + ), array( 'name' => 'prosilver', 'copyright' => '© phpBB Group, 2007', @@ -44,9 +45,11 @@ version = 3.0.12', ), ), array( - 'name = subsilver2 -copyright = © 2005 phpBB Group -version = 3.0.12', + array( + 'name = subsilver2', + 'copyright = © 2005 phpBB Group', + 'version = 3.0.12', + ), array( 'name' => 'subsilver2', 'copyright' => '© 2005 phpBB Group', @@ -54,15 +57,17 @@ version = 3.0.12', ), ), array( - 'foo = on -foo1 = true -foo2 = 1 -bar = off -bar1 = false -bar2 = 0 -foobar = -foobar1 = "asdf" -foobar2 = \'qwer\'', + array( + 'foo = on', + 'foo1 = true', + 'foo2 = 1', + 'bar = off', + 'bar1 = false', + 'bar2 = 0', + 'foobar =', + 'foobar1 = "asdf"', + 'foobar2 = \'qwer\'', + ), array( 'foo' => true, 'foo1' => true, @@ -76,8 +81,10 @@ foobar2 = \'qwer\'', ), ), array( - 'foo = & bar -bar = Test', + array( + 'foo = & bar', + 'bar = Test', + ), array( 'foo' => '&amp; bar', 'bar' => '<a href="test">Test</a>', @@ -91,7 +98,6 @@ bar = Test', */ public function test_parse_cfg_file($file_contents, $expected) { - $lines = explode("\n", $file_contents); - $this->assertEquals($expected, parse_cfg_file(false, $lines)); + $this->assertEquals($expected, parse_cfg_file(false, $file_contents)); } }