fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-04-30 15:52:17 +09:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'develop' into next

Browse source
This commit is contained in:
bnu 2015-02-09 11:22:02 +09:00
commit 2bbe9603a2
44 changed files with 420 additions and 311 deletions
Download patch file Download diff file Expand all files Collapse all files

18
classes/context/Context.class.php
View file

@ -1240,8 +1240,15 @@ class Context
return;
}
$xml = $GLOBALS['HTTP_RAW_POST_DATA'];
if(Security::detectingXEE($xml))
{
header("HTTP/1.0 400 Bad Request");
exit;
}
$oXml = new XmlParser();
$xml_obj = $oXml->parse();
$xml_obj = $oXml->parse($xml);
$params = $xml_obj->methodcall->params;
unset($params->node_name, $params->attrs, $params->body);
@ -1277,16 +1284,11 @@ class Context
return $stack;
}
$body = $this->_filterRequestVar($key, trim($val->body ? $val->body : ''), 0);
if($body)
{
return $body;
}
$body = $val->body;
unset($val->node_name, $val->attrs, $val->body);
if(!count(get_object_vars($val)))
{
return NULL;
return $this->_filterRequestVar($key, $body, 0);
}
$stack = new stdClass();

2
classes/display/HTMLDisplayHandler.php
View file

@ -432,7 +432,7 @@ class HTMLDisplayHandler
{
$oContext->loadFile(array('./modules/admin/tpl/css/admin.min.css', '', '', 10), true);
$oContext->loadFile(array("./modules/admin/tpl/css/admin_{$lang_type}.css", '', '', 10), true);
$oContext->loadFile(array("./modules/admin/tpl/css/admin.iefix.min.css", '', 'ie', 10), true);
$oContext->loadFile(array("./modules/admin/tpl/css/admin.iefix.css", '', 'ie', 10), true);
$oContext->loadFile('./modules/admin/tpl/js/admin.min.js', true);
$oContext->loadFile(array('./modules/admin/tpl/css/admin.bootstrap.min.css', '', '', 1), true);
$oContext->loadFile(array('./modules/admin/tpl/js/jquery.tmpl.js', '', '', 1), true);

4
classes/display/VirtualXMLDisplayHandler.php
View file

@ -14,8 +14,8 @@ class VirtualXMLDisplayHandler
$message = $oModule->getMessage();
$redirect_url = $oModule->get('redirect_url');
$request_uri = Context::get('xeRequestURI');
$request_url = Context::get('xeVirtualRequestUrl');
$output = new stdClass;
$request_url = Context::getRequestUri();
$output = new stdClass();
if(substr_compare($request_url, '/', -1) !== 0)
{

2
classes/extravar/Extravar.class.php
View file

@ -297,7 +297,7 @@ class ExtraItem
return ($value) ? sprintf('<a href="mailto:%s">%s</a>', $value, $value) : "";
case 'tel' :
return sprintf('%s - %s - %s', $value[0], $value[1], $value[2]);
return sprintf('%s-%s-%s', $value[0], $value[1], $value[2]);
case 'textarea' :
return nl2br($value);

17
classes/file/FileHandler.class.php
View file

@ -635,18 +635,13 @@ class FileHandler
*/
function returnBytes($val)
{
$last = strtolower(substr(trim($val), -1));
switch ($last)
$unit = strtoupper(substr($val, -1));
$val = (int)$val;
switch ($unit)
{
case 'g':
$val *= 1024 * 1024 * 1024;
break;
case 'm':
$val *= 1024 * 1024;
break;
case 'k':
$val *= 1024;
break;
case 'G': $val *= 1024;
case 'M': $val *= 1024;
case 'K': $val *= 1024;
}
return $val;

49
classes/security/Security.class.php
View file

@ -175,6 +175,55 @@ class Security
return $var;
}
/**
* @brief check XML External Entity
*
* @see from drupal. https://github.com/drupal/drupal/commit/90e884ad0f7f2cf269d953f7d70966de9fd821ff
*
* @param string $xml
* @return bool
*/
static function detectingXEE($xml)
{
if(!$xml) return FALSE;
if(strpos($xml, '<!ENTITY') !== FALSE)
{
return TRUE;
}
// Strip XML declaration.
$header = preg_replace('/<\?xml.*?\?'.'>/s', '', substr($xml, 0, 100), 1);
$xml = trim(substr_replace($xml, $header, 0, 100));
if($xml == '')
{
return TRUE;
}
// Strip DTD.
$header = preg_replace('/^<!DOCTYPE[^>]*+>/i', '', substr($xml, 0, 200), 1);
$xml = trim(substr_replace($xml, $header, 0, 200));
if($xml == '')
{
return TRUE;
}
// Confirm the XML now starts with a valid root tag. A root tag can end in [> \t\r\n]
$root_tag = substr($xml, 0, strcspn(substr($xml, 0, 20), "> \t\r\n"));
// Reject a second DTD.
if(strtoupper($root_tag) == '<!DOCTYPE')
{
return TRUE;
}
if(!in_array($root_tag, array('<methodCall', '<methodResponse', '<fault')))
{
return TRUE;
}
return FALSE;
}
}
/* End of file : Security.class.php */
/* Location: ./classes/security/Security.class.php */