Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
path: root/phpBB
diff options
context:
space:
mode:
Diffstat (limited to 'phpBB')
-rw-r--r--phpBB/docs/CHANGELOG.html25
-rw-r--r--phpBB/includes/acp/acp_main.php4
-rw-r--r--phpBB/includes/functions_privmsgs.php5
-rw-r--r--phpBB/includes/ucp/ucp_groups.php17
-rw-r--r--phpBB/includes/ucp/ucp_pm.php7
-rw-r--r--phpBB/includes/ucp/ucp_pm_compose.php12
-rw-r--r--phpBB/includes/ucp/ucp_pm_viewfolder.php7
-rwxr-xr-xphpBB/install/phpbbcli.php2
-rw-r--r--phpBB/phpbb/db/migration/data/v32x/v329.php37
-rw-r--r--phpBB/styles/prosilver/template/mcp_front.html2
10 files changed, 108 insertions, 10 deletions
diff --git a/phpBB/docs/CHANGELOG.html b/phpBB/docs/CHANGELOG.html
index 33faa961a1..45300c4986 100644
--- a/phpBB/docs/CHANGELOG.html
+++ b/phpBB/docs/CHANGELOG.html
@@ -50,6 +50,7 @@
<ol>
<li><a href="#changelog">Changelog</a>
<ul>
+ <li><a href="#v329rc1">Changes since 3.2.9-RC1</a></li>
<li><a href="#v328">Changes since 3.2.8</a></li>
<li><a href="#v328rc1">Changes since 3.2.8-RC1</a></li>
<li><a href="#v327">Changes since 3.2.7</a></li>
@@ -141,6 +142,30 @@
<div class="inner">
<div class="content">
+ <a name="v329rc1"></a><h3>Changes since 3.2.9-RC1</h3>
+ <h4>Bug</h4>
+ <ul>
+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-15592">PHPBB3-15592</a>] - &quot;Place inline&quot; button appears when BBcode is disabled (Post settings)</li>
+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16269">PHPBB3-16269</a>] - Sphinx backend indexes HTML markup as keywords</li>
+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16282">PHPBB3-16282</a>] - Default jQuery CDN URL is outdated on new installs</li>
+ </ul>
+ <h4>Improvement</h4>
+ <ul>
+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16271">PHPBB3-16271</a>] - Add support for 3.3.x API documentation</li>
+ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16279">PHPBB3-16279</a>] - Add permission for Emojii in topic title</li>
+ </ul>
+ <h4>Security</h4>
+ <ul>
+ <li>[SECURITY-249] - Group avatar overwrite on invalid submit</li>
+ <li>[SECURITY-250] - Group leader can be tricked into approving user</li>
+ </ul>
+ <h4>Hardening</h4>
+ <ul>
+ <li>[SECURITY-251] - Unwanted move of PMs to folders</li>
+ <li>[SECURITY-252] - PMs of unsuspecting users can be marked as important</li>
+ <li>[SECURITY-253] - PM export without proper validation</li>
+ </ul>
+
<a name="v328"></a><h3>Changes since 3.2.8</h3>
<h4>Bug</h4>
<ul>
diff --git a/phpBB/includes/acp/acp_main.php b/phpBB/includes/acp/acp_main.php
index 8f169d15a7..08ba060207 100644
--- a/phpBB/includes/acp/acp_main.php
+++ b/phpBB/includes/acp/acp_main.php
@@ -429,11 +429,11 @@ class acp_main
// Version check
$user->add_lang('install');
- if ($auth->acl_get('a_server') && version_compare(PHP_VERSION, '5.4.0', '<'))
+ if ($auth->acl_get('a_server') && version_compare(PHP_VERSION, '7.1.3', '<'))
{
$template->assign_vars(array(
'S_PHP_VERSION_OLD' => true,
- 'L_PHP_VERSION_OLD' => sprintf($user->lang['PHP_VERSION_OLD'], PHP_VERSION, '5.4.0', '<a href="https://www.phpbb.com/support/docs/en/3.2/ug/quickstart/requirements">', '</a>'),
+ 'L_PHP_VERSION_OLD' => sprintf($user->lang['PHP_VERSION_OLD'], PHP_VERSION, '7.1.3', '<a href="https://www.phpbb.com/support/docs/en/3.3/ug/quickstart/requirements">', '</a>'),
));
}
diff --git a/phpBB/includes/functions_privmsgs.php b/phpBB/includes/functions_privmsgs.php
index f07512d623..436b437cfa 100644
--- a/phpBB/includes/functions_privmsgs.php
+++ b/phpBB/includes/functions_privmsgs.php
@@ -958,6 +958,11 @@ function handle_mark_actions($user_id, $mark_action)
{
case 'mark_important':
+ if (!check_form_key('ucp_pm_view'))
+ {
+ trigger_error('FORM_INVALID');
+ }
+
$sql = 'UPDATE ' . PRIVMSGS_TO_TABLE . "
SET pm_marked = 1 - pm_marked
WHERE folder_id = $cur_folder_id
diff --git a/phpBB/includes/ucp/ucp_groups.php b/phpBB/includes/ucp/ucp_groups.php
index 2423af86be..cf6e049748 100644
--- a/phpBB/includes/ucp/ucp_groups.php
+++ b/phpBB/includes/ucp/ucp_groups.php
@@ -534,7 +534,12 @@ class ucp_groups
'teampage' => $group_row['group_teampage'],
);
- if ($config['allow_avatar'])
+ if (!check_form_key('ucp_groups'))
+ {
+ $error[] = $user->lang['FORM_INVALID'];
+ }
+
+ if (!count($error) && $config['allow_avatar'])
{
// Handle avatar
$driver_name = $phpbb_avatar_manager->clean_driver_name($request->variable('avatar_driver', ''));
@@ -556,11 +561,6 @@ class ucp_groups
$error = array_merge($error, $phpbb_avatar_manager->localize_errors($user, $avatar_error));
}
- if (!check_form_key('ucp_groups'))
- {
- $error[] = $user->lang['FORM_INVALID'];
- }
-
// Validate submitted colour value
if ($colour_error = validate_data($submit_ary, array('colour' => array('hex_colour', true))))
{
@@ -875,6 +875,11 @@ class ucp_groups
trigger_error($user->lang['NO_GROUP'] . $return_page);
}
+ if (!check_form_key('ucp_groups'))
+ {
+ trigger_error($user->lang('FORM_INVALID') . $return_page);
+ }
+
if (!($row = group_memberships($group_id, $user->data['user_id'])))
{
trigger_error($user->lang['NOT_MEMBER_OF_GROUP'] . $return_page);
diff --git a/phpBB/includes/ucp/ucp_pm.php b/phpBB/includes/ucp/ucp_pm.php
index 4d02620e89..3f982c8dd0 100644
--- a/phpBB/includes/ucp/ucp_pm.php
+++ b/phpBB/includes/ucp/ucp_pm.php
@@ -193,6 +193,8 @@ class ucp_pm
trigger_error('NO_AUTH_READ_HOLD_MESSAGE');
}
+ add_form_key('ucp_pm_view');
+
// First Handle Mark actions and moving messages
$submit_mark = (isset($_POST['submit_mark'])) ? true : false;
$move_pm = (isset($_POST['move_pm'])) ? true : false;
@@ -210,6 +212,11 @@ class ucp_pm
// Move PM
if ($move_pm)
{
+ if (!check_form_key('ucp_pm_view'))
+ {
+ trigger_error('FORM_INVALID');
+ }
+
$move_msg_ids = (isset($_POST['marked_msg_id'])) ? $request->variable('marked_msg_id', array(0)) : array();
$cur_folder_id = $request->variable('cur_folder_id', PRIVMSGS_NO_BOX);
diff --git a/phpBB/includes/ucp/ucp_pm_compose.php b/phpBB/includes/ucp/ucp_pm_compose.php
index 87a8c91fd2..2e1ad3fdcf 100644
--- a/phpBB/includes/ucp/ucp_pm_compose.php
+++ b/phpBB/includes/ucp/ucp_pm_compose.php
@@ -665,6 +665,12 @@ function compose_pm($id, $mode, $action, $user_folders = array())
$subject = (!$subject && $action != 'post') ? $user->lang['NEW_MESSAGE'] : $subject;
$message = $request->variable('message', '', true);
+ /**
+ * Replace Emojis and other 4bit UTF-8 chars not allowed by MySQL to UCR/NCR.
+ * Using their Numeric Character Reference's Hexadecimal notation.
+ */
+ $subject = utf8_encode_ucr($subject);
+
if ($subject && $message)
{
if (confirm_box(true))
@@ -870,6 +876,12 @@ function compose_pm($id, $mode, $action, $user_folders = array())
'address_list' => $address_list
);
+ /**
+ * Replace Emojis and other 4bit UTF-8 chars not allowed by MySQL to UCR/NCR.
+ * Using their Numeric Character Reference's Hexadecimal notation.
+ */
+ $subject = utf8_encode_ucr($subject);
+
// ((!$message_subject) ? $subject : $message_subject)
$msg_id = submit_pm($action, $subject, $pm_data);
diff --git a/phpBB/includes/ucp/ucp_pm_viewfolder.php b/phpBB/includes/ucp/ucp_pm_viewfolder.php
index 09e7bf4d7c..4b6377e0b7 100644
--- a/phpBB/includes/ucp/ucp_pm_viewfolder.php
+++ b/phpBB/includes/ucp/ucp_pm_viewfolder.php
@@ -32,6 +32,8 @@ function view_folder($id, $mode, $folder_id, $folder)
$folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']);
+ add_form_key('ucp_pm_view');
+
if (!$submit_export)
{
$user->add_lang('viewforum');
@@ -197,6 +199,11 @@ function view_folder($id, $mode, $folder_id, $folder)
$enclosure = $request->variable('enclosure', '');
$delimiter = $request->variable('delimiter', '');
+ if (!check_form_key('ucp_pm_view'))
+ {
+ trigger_error('FORM_INVALID');
+ }
+
if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === ''))
{
$template->assign_var('PROMPT', true);
diff --git a/phpBB/install/phpbbcli.php b/phpBB/install/phpbbcli.php
index dbc8a17f8c..86ec87b38f 100755
--- a/phpBB/install/phpbbcli.php
+++ b/phpBB/install/phpbbcli.php
@@ -23,7 +23,7 @@ if (php_sapi_name() !== 'cli')
define('IN_PHPBB', true);
define('IN_INSTALL', true);
define('PHPBB_ENVIRONMENT', 'production');
-define('PHPBB_VERSION', '3.2.9-RC1');
+define('PHPBB_VERSION', '3.2.9');
$phpbb_root_path = __DIR__ . '/../';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
diff --git a/phpBB/phpbb/db/migration/data/v32x/v329.php b/phpBB/phpbb/db/migration/data/v32x/v329.php
new file mode 100644
index 0000000000..e88e264aef
--- /dev/null
+++ b/phpBB/phpbb/db/migration/data/v32x/v329.php
@@ -0,0 +1,37 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\db\migration\data\v32x;
+
+class v329 extends \phpbb\db\migration\migration
+{
+ public function effectively_installed()
+ {
+ return phpbb_version_compare($this->config['version'], '3.2.9', '>=');
+ }
+
+ static public function depends_on()
+ {
+ return array(
+ '\phpbb\db\migration\data\v32x\v329rc1',
+ '\phpbb\db\migration\data\v32x\user_emoji_permission',
+ );
+ }
+
+ public function update_data()
+ {
+ return array(
+ array('config.update', array('version', '3.2.9')),
+ );
+ }
+}
diff --git a/phpBB/styles/prosilver/template/mcp_front.html b/phpBB/styles/prosilver/template/mcp_front.html
index 90793d072b..3eba12fe74 100644
--- a/phpBB/styles/prosilver/template/mcp_front.html
+++ b/phpBB/styles/prosilver/template/mcp_front.html
@@ -91,7 +91,7 @@
</div>
</dt>
<dd class="moderation">
- <span>{L_REPORTED} {L_POST_BY_AUTHOR} {report.REPORTER_FULL} {L_REPORTED_ON_DATE} <br />
+ <span>{L_REPORTED} {L_POST_BY_AUTHOR} {report.REPORTER_FULL} {L_REPORTED_ON_DATE} {{ report.REPORT_TIME }}<br />
{L_FORUM}{L_COLON} <a href="{report.U_FORUM}">{report.FORUM_NAME}</a></span>
</dd>
</dl>