makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 06:08:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/security/243] Limit size BBCode to 4 numeric characters

Browse source 
SECURITY-243
This commit is contained in:
Marc Alexander 2019-07-17 22:02:32 +02:00
parent b5a997ce18
commit c934d3fcfd
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
3 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
phpBB/phpbb/textformatter/s9e/factory.php
View file

@ -110,7 +110,7 @@ class factory implements \phpbb\textformatter\cache_interface
'i' => '<span style="font-style: italic"><xsl:apply-templates/></span>', 'i' => '<span style="font-style: italic"><xsl:apply-templates/></span>',
'u' => '<span style="text-decoration: underline"><xsl:apply-templates/></span>', 'u' => '<span style="text-decoration: underline"><xsl:apply-templates/></span>',
'img' => '<img src="{IMAGEURL}" class="postimage" alt="{L_IMAGE}"/>', 'img' => '<img src="{IMAGEURL}" class="postimage" alt="{L_IMAGE}"/>',
'size' => '<span style="font-size: {FONTSIZE}%; line-height: normal"><xsl:apply-templates/></span>', 'size' => '<span><xsl:attribute name="style"><xsl:text>font-size: </xsl:text><xsl:value-of select="substring(@FONTSIZE, 1, 4)"/><xsl:text>%; line-height: normal</xsl:text></xsl:attribute><xsl:apply-templates/></span>',
'color' => '<span style="color: {COLOR}"><xsl:apply-templates/></span>', 'color' => '<span style="color: {COLOR}"><xsl:apply-templates/></span>',
'email' => '<a> 'email' => '<a>
<xsl:attribute name="href"> <xsl:attribute name="href">

2
phpBB/phpbb/textformatter/s9e/parser.php
View file

@ -339,7 +339,7 @@ class parser implements \phpbb\textformatter\parser_interface
*/ */
static public function filter_font_size($size, $max_size, Logger $logger) static public function filter_font_size($size, $max_size, Logger $logger)
{ {
if (!is_int($size)) if (!is_numeric($size))
{ {
$logger->err('INVALID_FONT_SIZE', ['invalid_size' => htmlspecialchars($size)]); $logger->err('INVALID_FONT_SIZE', ['invalid_size' => htmlspecialchars($size)]);

2
phpBB/styles/prosilver/template/bbcode.html
View file

@ -64,7 +64,7 @@
<!-- BEGIN color --><span style="color: {COLOR}">{TEXT}</span><!-- END color --> <!-- BEGIN color --><span style="color: {COLOR}">{TEXT}</span><!-- END color -->
<!-- BEGIN size --><span style="font-size: {SIZE}%; line-height: 116%;">{TEXT}</span><!-- END size --> <!-- BEGIN size --><span><xsl:attribute name="style"><xsl:text>font-size: </xsl:text><xsl:value-of select="substring(@size, 1, 4)"/><xsl:text>%; line-height: normal</xsl:text></xsl:attribute><xsl:apply-templates/></span><!-- END size -->
<!-- BEGIN img --><img src="{URL}" class="postimage" alt="{L_IMAGE}" /><!-- END img --> <!-- BEGIN img --><img src="{URL}" class="postimage" alt="{L_IMAGE}" /><!-- END img -->