makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-11 22:08:54 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #46 from phpbb/ticket/security/231

Browse source 
[ticket/security/231] Disable remote avatar functionality & add warning
This commit is contained in:
Marc Alexander 2019-04-27 13:23:07 +02:00
commit db43961de6
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
4 changed files with 39 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
phpBB/includes/acp/acp_board.php
View file

@ -125,6 +125,7 @@ class acp_board
$avatar_vars = array();
foreach ($avatar_drivers as $current_driver)
{
/** @var \phpbb\avatar\driver\driver_interface $driver */
$driver = $phpbb_avatar_manager->get_driver($current_driver, false);
/*
@ -733,7 +734,7 @@ class acp_board
$template->assign_block_vars('options', array(
'KEY' => $config_key,
'TITLE' => (isset($user->lang[$vars['lang']])) ? $user->lang[$vars['lang']] : $vars['lang'],
'S_EXPLAIN' => $vars['explain'],
'S_EXPLAIN' => $vars['explain'] && !empty($l_explain),
'TITLE_EXPLAIN' => $l_explain,
'CONTENT' => $content,
)

4
phpBB/language/en/acp/board.php
View file

@ -111,9 +111,9 @@ $lang = array_merge($lang, array(
'ALLOW_GRAVATAR' => 'Enable gravatar avatars',
'ALLOW_LOCAL' => 'Enable gallery avatars',
'ALLOW_REMOTE' => 'Enable remote avatars',
'ALLOW_REMOTE_EXPLAIN' => 'Avatars linked to from another website.',
'ALLOW_REMOTE_EXPLAIN' => 'Avatars linked to from another website.<br><em><strong class="error">Warning:</strong> Enabling this feature might allow users to check for the existence of files and services that are only accessible on the local network.</em>',
'ALLOW_REMOTE_UPLOAD' => 'Enable remote avatar uploading',
'ALLOW_REMOTE_UPLOAD_EXPLAIN' => 'Allow uploading of avatars from another website.',
'ALLOW_REMOTE_UPLOAD_EXPLAIN' => 'Allow uploading of avatars from another website.<br><em><strong class="error">Warning:</strong> Enabling this feature might allow users to check for the existence of files and services that are only accessible on the local network.</em>',
'ALLOW_UPLOAD' => 'Enable avatar uploading',
'AVATAR_GALLERY_PATH' => 'Avatar gallery path',
'AVATAR_GALLERY_PATH_EXPLAIN' => 'Path under your phpBB root directory for pre-loaded images, e.g. <samp>images/avatars/gallery</samp>.<br>Double dots like <samp>../</samp> will be stripped from the path for security reasons.',

2
phpBB/phpbb/avatar/manager.php
View file

@ -271,7 +271,7 @@ class manager
$config_name = $driver->get_config_name();
return array(
'allow_avatar_' . $config_name => array('lang' => 'ALLOW_' . strtoupper(str_replace('\\', '_', $config_name)), 'validate' => 'bool', 'type' => 'radio:yes_no', 'explain' => false),
'allow_avatar_' . $config_name => array('lang' => 'ALLOW_' . strtoupper(str_replace('\\', '_', $config_name)), 'validate' => 'bool', 'type' => 'radio:yes_no', 'explain' => true),
);
}

34
phpBB/phpbb/db/migration/data/v32x/disable_remote_avatar.php Normal file
View file

@ -0,0 +1,34 @@
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\db\migration\data\v32x;
use phpbb\db\migration\migration;
class disable_remote_avatar extends migration
{
static public function depends_on()
{
return array(
'\phpbb\db\migration\data\v32x\v325',
);
}
public function update_data()
{
return array(
array('config.update', array('allow_avatar_remote', '0')),
array('config.update', array('allow_avatar_remote_upload', '0')),
);
}
}