From 291a1fff1f8db54a0d2c59faa689f23f3e35f4fe Mon Sep 17 00:00:00 2001 From: Ruslan Uzdenov Date: Mon, 15 Nov 2010 23:27:57 +0100 Subject: [PATCH 1/4] [ticket/9903] Fix XSS in BBcode-parser's Flash-BBcode. Fix XSS in Flash-BBcode by validating that the supplied argument is a URL. PHPBB3-9903 --- phpBB/includes/message_parser.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/phpBB/includes/message_parser.php b/phpBB/includes/message_parser.php index 952b55cc8c..b2d0b6c566 100644 --- a/phpBB/includes/message_parser.php +++ b/phpBB/includes/message_parser.php @@ -352,6 +352,15 @@ class bbcode_firstpass extends bbcode return '[flash=' . $width . ',' . $height . ']' . $in . '[/flash]'; } + $in = str_replace(' ', '%20', $in); + + // Make sure $in is a URL. + if (!preg_match('#^' . get_preg_expression('url') . '$#i', $in) && + !preg_match('#^' . get_preg_expression('www_url') . '$#i', $in)) + { + return '[flash=' . $width . ',' . $height . ']' . $in . '[/flash]'; + } + // Apply the same size checks on flash files as on images if ($config['max_' . $this->mode . '_img_height'] || $config['max_' . $this->mode . '_img_width']) { From e043dc316ab323d874d6c75c6c6fa59c9adaf761 Mon Sep 17 00:00:00 2001 From: Chris Sfanos Date: Fri, 19 Nov 2010 10:19:17 +0100 Subject: [PATCH 2/4] [ticket/9904] Update WebPI Parameters.xml to work with WebMatrix. PHPBB3-9904 --- build/webpi/parameters.xml | 112 +++++++++++++++++++++++-------------- 1 file changed, 71 insertions(+), 41 deletions(-) diff --git a/build/webpi/parameters.xml b/build/webpi/parameters.xml index 994247e48e..be4d374632 100644 --- a/build/webpi/parameters.xml +++ b/build/webpi/parameters.xml @@ -9,7 +9,7 @@ scope="iisapp" match="phpBB3" /> - + + match="phpBB3/cache$" /> + match="phpBB3/files$" /> + match="phpBB3/store$" /> + match="phpBB3/images/avatars/upload$" /> + match="phpBB3/config.php$" /> - + + + + + + + + + name="SQL DatabaseName" description="Database name for your application." defaultValue="phpbb" tags="SQL, dbName"> - + + + + + @@ -113,9 +114,13 @@ scope="install/mssql.sql" match="PlaceHolderForUser" /> - + + + + + @@ -129,10 +134,16 @@ match="PlaceHolderForPassword" /> + + + + + + + + + + + + @@ -171,22 +188,13 @@ scope="install/mysql.sql" match="PlaceHolderForDb" /> - - + + + - - - @@ -196,6 +204,10 @@ scope="install/mysql.sql" match="PlaceHolderForUser" /> + + + + + + + + + + + + + + + Date: Mon, 15 Nov 2010 22:49:28 +0100 Subject: [PATCH 3/4] [ticket/9903] Script for detecting potentially malicious flash bbcodes PHPBB3-9903 --- phpBB/develop/check_flash_bbcodes.php | 163 ++++++++++++++++++++++++++ 1 file changed, 163 insertions(+) create mode 100644 phpBB/develop/check_flash_bbcodes.php diff --git a/phpBB/develop/check_flash_bbcodes.php b/phpBB/develop/check_flash_bbcodes.php new file mode 100644 index 0000000000..b0fa399209 --- /dev/null +++ b/phpBB/develop/check_flash_bbcodes.php @@ -0,0 +1,163 @@ + ''"; + + $result = $db->sql_query($sql); + while ($row = $db->sql_fetchrow($result)) + { + $uid = $row[$uid_field]; + + // thanks support toolkit + $content = html_entity_decode_utf8($row[$content_field]); + set_var($content, $content, 'string', true); + $content = utf8_normalize_nfc($content); + + $bitfield_data = $row[$bitfield_field]; + + if (!is_valid_flash_bbcode($content, $uid) && has_flash_enabled($bitfield_data)) + { + $ids[] = (int) $row[$id_field]; + } + } + $db->sql_freeresult($result); + + return $ids; +} + +function get_flash_regex($uid) +{ + return "#\[flash=([0-9]+),([0-9]+):$uid\](.*?)\[/flash:$uid\]#"; +} + +// extract all valid flash bbcodes +// check if the bbcode content is a valid URL for each match +function is_valid_flash_bbcode($cleaned_content, $uid) +{ + $regex = get_flash_regex($uid); + + $url_regex = get_preg_expression('url'); + $www_url_regex = get_preg_expression('www_url'); + + if (preg_match_all($regex, $cleaned_content, $matches)) + { + foreach ($matches[3] as $flash_url) + { + if (!preg_match("#^($url_regex|$www_url_regex)$#i", $flash_url)) + { + return false; + } + } + } + + return true; +} + +// check if a bitfield includes flash +// 11 = flash bit +function has_flash_enabled($bitfield_data) +{ + $bitfield = new bitfield($bitfield_data); + return $bitfield->get(11); +} + +// taken from support toolkit +function html_entity_decode_utf8($string) +{ + static $trans_tbl; + + // replace numeric entities + $string = preg_replace('~&#x([0-9a-f]+);~ei', 'code2utf8(hexdec("\\1"))', $string); + $string = preg_replace('~&#([0-9]+);~e', 'code2utf8(\\1)', $string); + + // replace literal entities + if (!isset($trans_tbl)) + { + $trans_tbl = array(); + + foreach (get_html_translation_table(HTML_ENTITIES) as $val=>$key) + $trans_tbl[$key] = utf8_encode($val); + } + return strtr($string, $trans_tbl); +} + +// taken from support toolkit +// Returns the utf string corresponding to the unicode value (from php.net, courtesy - romans@void.lv) +function code2utf8($num) +{ + if ($num < 128) return chr($num); + if ($num < 2048) return chr(($num >> 6) + 192) . chr(($num & 63) + 128); + if ($num < 65536) return chr(($num >> 12) + 224) . chr((($num >> 6) & 63) + 128) . chr(($num & 63) + 128); + if ($num < 2097152) return chr(($num >> 18) + 240) . chr((($num >> 12) & 63) + 128) . chr((($num >> 6) & 63) + 128) . chr(($num & 63) + 128); + return ''; +} From af4c2a3eb15fc4318b23dcb7794c230cf3ec2a0f Mon Sep 17 00:00:00 2001 From: Nils Adermann Date: Fri, 19 Nov 2010 11:36:14 +0100 Subject: [PATCH 4/4] [prep-release-3.0.8] Incrementing version number to 3.0.8 and update changelog --- build/build.xml | 6 +++--- phpBB/docs/CHANGELOG.html | 12 ++++++++++++ phpBB/includes/constants.php | 2 +- phpBB/install/database_update.php | 16 +++++++++++----- phpBB/install/schemas/schema_data.sql | 2 +- 5 files changed, 28 insertions(+), 10 deletions(-) diff --git a/build/build.xml b/build/build.xml index 69caa897c3..bf77d82f6c 100644 --- a/build/build.xml +++ b/build/build.xml @@ -2,9 +2,9 @@ - - - + + + diff --git a/phpBB/docs/CHANGELOG.html b/phpBB/docs/CHANGELOG.html index f5d6da94b9..66915b18fa 100644 --- a/phpBB/docs/CHANGELOG.html +++ b/phpBB/docs/CHANGELOG.html @@ -90,6 +90,12 @@

1.i. Changes since 3.0.7-PL1

+

Security +

+
    +
  • [PHPBB3-9903] - Execute javascript in [flash=] BBCode +
    • +

Bug

@@ -404,6 +410,8 @@
  • [PHPBB3-9891] - Updater drops language-selection after database-update
    • +
  • [PHPBB3-9509] - phpBB Coding Guidelines state subversion as the version control system for phpBB +

    • Improvement @@ -467,6 +475,8 @@
  • [PHPBB3-9880] - Rename all mentions of CAPTCHA or visual confirmation to anti-bot
    • +
  • [PHPBB3-9899] - Change the style in the ACP for the recaptcha to match that displayed on prosilver +

    • New Feature @@ -509,6 +519,8 @@
  • [PHPBB3-9868] - Make the test suite run and pass using the mssqlnative driver
    • +
  • [PHPBB3-9904] - Update WebPI Parameters.xml +

    • Sub-task diff --git a/phpBB/includes/constants.php b/phpBB/includes/constants.php index a4635895b0..af2a6ebd24 100644 --- a/phpBB/includes/constants.php +++ b/phpBB/includes/constants.php @@ -25,7 +25,7 @@ if (!defined('IN_PHPBB')) */ // phpBB Version -define('PHPBB_VERSION', '3.0.8-RC1'); +define('PHPBB_VERSION', '3.0.8'); // QA-related // define('PHPBB_QA', 1); diff --git a/phpBB/install/database_update.php b/phpBB/install/database_update.php index 01e8ef7658..0ec9f24190 100644 --- a/phpBB/install/database_update.php +++ b/phpBB/install/database_update.php @@ -8,7 +8,7 @@ * */ -$updates_to_version = '3.0.8-RC1'; +$updates_to_version = '3.0.8'; // Enter any version to update from to test updates. The version within the db will not be updated. $debug_from_version = false; @@ -914,6 +914,8 @@ function database_update_info() '3.0.7' => array(), // No changes from 3.0.7-PL1 to 3.0.8-RC1 '3.0.7-PL1' => array(), + // No changes from 3.0.8-RC1 to 3.0.8 + '3.0.8-RC1' => array(), ); } @@ -1672,7 +1674,7 @@ function change_database_data(&$no_updates, $version) "{$phpbb_root_path}language/$lang_dir/install.$phpEx", "{$phpbb_root_path}language/$lang_dir/acp/attachments.$phpEx", ); - + foreach ($lang_files as $lang_file) { if (!file_exists($lang_file)) @@ -1852,6 +1854,10 @@ function change_database_data(&$no_updates, $version) $no_updates = false; break; + + // No changes from 3.0.8-RC1 to 3.0.8 + case '3.0.8-RC1': + break; } } @@ -1998,7 +2004,7 @@ class updater_db_tools 'VCHAR_CI' => '[varchar] (255)', 'VARBINARY' => '[varchar] (255)', ), - + 'mssqlnative' => array( 'INT:' => '[int]', 'BINT' => '[float]', @@ -2028,7 +2034,7 @@ class updater_db_tools 'VCHAR_CI' => '[varchar] (255)', 'VARBINARY' => '[varchar] (255)', ), - + 'oracle' => array( 'INT:' => 'number(%d)', 'BINT' => 'number(20)', @@ -2175,7 +2181,7 @@ class updater_db_tools case 'mssql_odbc': $this->sql_layer = 'mssql'; break; - + case 'mssqlnative': $this->sql_layer = 'mssqlnative'; break; diff --git a/phpBB/install/schemas/schema_data.sql b/phpBB/install/schemas/schema_data.sql index cbee2c9ba1..e3c9d1e13a 100644 --- a/phpBB/install/schemas/schema_data.sql +++ b/phpBB/install/schemas/schema_data.sql @@ -242,7 +242,7 @@ INSERT INTO phpbb_config (config_name, config_value) VALUES ('topics_per_page', INSERT INTO phpbb_config (config_name, config_value) VALUES ('tpl_allow_php', '0'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('upload_icons_path', 'images/upload_icons'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('upload_path', 'files'); -INSERT INTO phpbb_config (config_name, config_value) VALUES ('version', '3.0.8-RC1'); +INSERT INTO phpbb_config (config_name, config_value) VALUES ('version', '3.0.8'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('warnings_expire_days', '90'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('warnings_gc', '14400');