Merge pull request #11 from xpressengine/develop

Develop

.travis.yml

@@ -27,4 +27,5 @@ script:
 - if [ $(phpenv version-name) != "5.3" ]; then ./vendor/bin/codecept run -d --fail-fast --env travis; fi
 notifications:
   slack:
-    secure: 0HhwktIb65zfge56E4yMfYj0Xj4GeYIaxvh/Obb13BK1/C8RdWBy6u213N5MQ2UHsxYk8wXXzynaCh4psegi2iPy9dbKmkdAdEQMzYoKE2xYVSqZveeVQm0sqFVXAlzggpgs/j5vtvKYjRkQKtTrz0C+p0uJ0bkLcyWGezWTpGc=
+    secure: jpoMjtkveVuPZM4JXJETAPv8QUCtTbI/ZTixdS9HUgxSb9tD2DkoekMaRzXYnXA82Les/gGxTC0fQFcFrls6Ypkbvp1udBPggmAdLiBHubBIz+yd1BGIf/l4I6MY1QmGe1Lx4xlnVlEgLnKXHn+W+ENep4/MzpCEaR9Vw8wfGqY=
+    secure: "gPv4qFmGcXimNlI/OeVk5n4VtRCWbAe7VUtw7Inb3A/ZZaVDo11gtMNkwo/JVKSnXqFkaCQYebcNpj2D9Rb2ZCwgjMSX6wxvpA4/8OLOZpbWqFW6Hz2RKNggubXlnalXkIwFcsvj70rKctbcJFk2C1G9rVvYWdVGD9X4/ozQtAc="

classes/context/Context.class.php

@@ -666,9 +666,21 @@ class Context
 			{
 				$url = base64_decode(self::get('default_url'));
 				$url_info = parse_url($url);
+
+				$oModuleModel = getModel('module');
+				$target_domain = (stripos($url, $default_url) !== 0) ? $url_info['host'] : $default_url;
+				$site_info = $oModuleModel->getSiteInfoByDomain($target_domain);
+				if(!$site_info->site_srl) {
+					$oModuleObject = new ModuleObject();
+					$oModuleObject->stop('msg_invalid_request');
+
+					return false;
+				}
+
 				$url_info['query'].= ($url_info['query'] ? '&' : '') . 'SSOID=' . session_id();
 				$redirect_url = sprintf('%s://%s%s%s?%s', $url_info['scheme'], $url_info['host'], $url_info['port'] ? ':' . $url_info['port'] : '', $url_info['path'], $url_info['query']);
 				header('location:' . $redirect_url);
+
 				return FALSE;
 			}
 			// for sites requesting SSO validation
@@ -1171,7 +1183,7 @@ class Context
 	}
 
 	/**
-	 * handle request areguments for GET/POST
+	 * handle request arguments for GET/POST
 	 *
 	 * @return void
 	 */

classes/db/DB.class.php

@@ -215,16 +215,18 @@ class DB
 	 */
 	function getEnableList()
 	{
-		if(!$this->supported_list)
+		is_a($this, 'DB') ? $self = $this : $self = self::getInstance();
+		
+		if(!$self->supported_list)
 		{
 			$oDB = new DB();
-			$this->supported_list = $oDB->_getSupportedList();
+			$self->supported_list = $oDB->_getSupportedList();
 		}
 
 		$enableList = array();
-		if(is_array($this->supported_list))
+		if(is_array($self->supported_list))
 		{
-			foreach($this->supported_list AS $key => $value)
+			foreach($self->supported_list AS $key => $value)
 			{
 				if($value->enable)
 				{
@@ -242,16 +244,18 @@ class DB
 	 */
 	function getDisableList()
 	{
-		if(!$this->supported_list)
+		is_a($this, 'DB') ? $self = $this : $self = self::getInstance();
+		
+		if(!$self->supported_list)
 		{
 			$oDB = new DB();
-			$this->supported_list = $oDB->_getSupportedList();
+			$self->supported_list = $oDB->_getSupportedList();
 		}
 
 		$disableList = array();
-		if(is_array($this->supported_list))
+		if(is_array($self->supported_list))
 		{
-			foreach($this->supported_list AS $key => $value)
+			foreach($self->supported_list AS $key => $value)
 			{
 				if(!$value->enable)
 				{

classes/module/ModuleHandler.class.php

@@ -116,7 +116,6 @@ class ModuleHandler extends Handler
 	 * */
 	function init()
 	{
-		
 		$oModuleModel = getModel('module');
 		$site_module_info = Context::get('site_module_info');
 
@@ -317,13 +316,13 @@ class ModuleHandler extends Handler
 	function procModule()
 	{
 		$oModuleModel = getModel('module');
+		$display_mode = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
 
 		// If error occurred while preparation, return a message instance
 		if($this->error)
 		{
 			$this->_setInputErrorToContext();
-			$type = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
-			$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 			$oMessageObject->setError(-1);
 			$oMessageObject->setMessage($this->error);
 			$oMessageObject->dispMessage();
@@ -359,8 +358,7 @@ class ModuleHandler extends Handler
 			$this->httpStatusCode = '404';
 
 			$this->_setInputErrorToContext();
-			$type = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
-			$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 			$oMessageObject->setError(-1);
 			$oMessageObject->setMessage($this->error);
 			$oMessageObject->dispMessage();
@@ -397,7 +395,7 @@ class ModuleHandler extends Handler
 			if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList))
 			{
 				$this->error = "msg_invalid_request";
-				$oMessageObject = ModuleHandler::getModuleInstance('message', 'view');
+				$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 				$oMessageObject->setError(-1);
 				$oMessageObject->setMessage($this->error);
 				$oMessageObject->dispMessage();
@@ -410,13 +408,24 @@ class ModuleHandler extends Handler
 			Mobile::setMobile(FALSE);
 		}
 
-		// Admin ip
 		$logged_info = Context::get('logged_info');
+
+		// check CSRF for POST actions
+		if(Context::getRequestMethod() === 'POST' && Context::isInstalled() && $this->act !== 'procFileUpload' && !checkCSRF()) {
+			$this->error = 'msg_invalid_request';
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
+			$oMessageObject->setError(-1);
+			$oMessageObject->setMessage($this->error);
+			$oMessageObject->dispMessage();
+			return $oMessageObject;
+		}
+
+		// Admin ip
 		if($kind == 'admin' && $_SESSION['denied_admin'] == 'Y')
 		{
 			$this->_setInputErrorToContext();
 			$this->error = "msg_not_permitted_act";
-			$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 			$oMessageObject->setError(-1);
 			$oMessageObject->setMessage($this->error);
 			$oMessageObject->dispMessage();
@@ -446,8 +455,7 @@ class ModuleHandler extends Handler
 		if(!is_object($oModule))
 		{
 			$this->_setInputErrorToContext();
-			$type = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
-			$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 			$oMessageObject->setError(-1);
 			$oMessageObject->setMessage($this->error);
 			$oMessageObject->dispMessage();
@@ -466,7 +474,7 @@ class ModuleHandler extends Handler
 			{
 				$this->_setInputErrorToContext();
 				$this->error = 'msg_invalid_request';
-				$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+				$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 				$oMessageObject->setError(-1);
 				$oMessageObject->setMessage($this->error);
 				$oMessageObject->dispMessage();
@@ -495,7 +503,7 @@ class ModuleHandler extends Handler
 				else
 				{
 					$this->error = 'msg_invalid_request';
-					$oMessageObject = ModuleHandler::getModuleInstance('message', 'view');
+					$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 					$oMessageObject->setError(-1);
 					$oMessageObject->setMessage($this->error);
 					$oMessageObject->dispMessage();
@@ -517,6 +525,34 @@ class ModuleHandler extends Handler
 				$tpl_path = $oModule->getTemplatePath();
 				$orig_module = $oModule;
 
+				$xml_info = $oModuleModel->getModuleActionXml($forward->module);
+
+				// SECISSUE also check foward act method
+				// check REQUEST_METHOD in controller
+				if($type == 'controller')
+				{
+					$allowedMethod = $xml_info->action->{$forward->act}->method;
+
+					if(!$allowedMethod)
+					{
+						$allowedMethodList[0] = 'POST';
+					}
+					else
+					{
+						$allowedMethodList = explode('|', strtoupper($allowedMethod));
+					}
+
+					if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList))
+					{
+						$this->error = "msg_invalid_request";
+						$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
+						$oMessageObject->setError(-1);
+						$oMessageObject->setMessage($this->error);
+						$oMessageObject->dispMessage();
+						return $oMessageObject;
+					}
+				}
+
 				if($type == "view" && Mobile::isFromMobilePhone())
 				{
 					$orig_type = "view";
@@ -537,9 +573,8 @@ class ModuleHandler extends Handler
 
 				if(!is_object($oModule))
 				{
-					$type = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
 					$this->_setInputErrorToContext();
-					$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+					$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 					$oMessageObject->setError(-1);
 					$oMessageObject->setMessage('msg_module_is_not_exists');
 					$oMessageObject->dispMessage();
@@ -550,8 +585,6 @@ class ModuleHandler extends Handler
 					return $oMessageObject;
 				}
 
-				$xml_info = $oModuleModel->getModuleActionXml($forward->module);
-
 				if($this->module == "admin" && $type == "view")
 				{
 					if($logged_info->is_admin == 'Y')
@@ -569,7 +602,7 @@ class ModuleHandler extends Handler
 						$this->_setInputErrorToContext();
 
 						$this->error = 'msg_is_not_administrator';
-						$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+						$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 						$oMessageObject->setError(-1);
 						$oMessageObject->setMessage($this->error);
 						$oMessageObject->dispMessage();
@@ -583,7 +616,7 @@ class ModuleHandler extends Handler
 					{
 						$this->_setInputErrorToContext();
 						$this->error = 'msg_is_not_manager';
-						$oMessageObject = ModuleHandler::getModuleInstance('message', 'view');
+						$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 						$oMessageObject->setError(-1);
 						$oMessageObject->setMessage($this->error);
 						$oMessageObject->dispMessage();
@@ -595,7 +628,7 @@ class ModuleHandler extends Handler
 						{
 							$this->_setInputErrorToContext();
 							$this->error = 'msg_is_not_administrator';
-							$oMessageObject = ModuleHandler::getModuleInstance('message', 'view');
+							$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 							$oMessageObject->setError(-1);
 							$oMessageObject->setMessage($this->error);
 							$oMessageObject->dispMessage();

common/js/plugins/ckeditor/ckeditor/adapters/jquery.js

@@ -2,9 +2,9 @@
  Copyright (c) 2003-2015, CKSource - Frederico Knabben. All rights reserved.
  For licensing, see LICENSE.md or http://ckeditor.com/license
 */
-(function(a){CKEDITOR.config.jqueryOverrideVal="undefined"==typeof CKEDITOR.config.jqueryOverrideVal?!0:CKEDITOR.config.jqueryOverrideVal;"undefined"!=typeof a&&(a.extend(a.fn,{ckeditorGet:function(){var a=this.eq(0).data("ckeditorInstance");if(!a)throw"CKEditor is not initialized yet, use ckeditor() with a callback.";return a},ckeditor:function(g,d){if(!CKEDITOR.env.isCompatible)throw Error("The environment is incompatible.");if(!a.isFunction(g))var k=d,d=g,g=k;var i=[],d=d||{};this.each(function(){var b=
-a(this),c=b.data("ckeditorInstance"),f=b.data("_ckeditorInstanceLock"),h=this,j=new a.Deferred;i.push(j.promise());if(c&&!f)g&&g.apply(c,[this]),j.resolve();else if(f)c.once("instanceReady",function(){setTimeout(function(){c.element?(c.element.$==h&&g&&g.apply(c,[h]),j.resolve()):setTimeout(arguments.callee,100)},0)},null,null,9999);else{if(d.autoUpdateElement||"undefined"==typeof d.autoUpdateElement&&CKEDITOR.config.autoUpdateElement)d.autoUpdateElementJquery=!0;d.autoUpdateElement=!1;b.data("_ckeditorInstanceLock",
-!0);c=a(this).is("textarea")?CKEDITOR.replace(h,d):CKEDITOR.inline(h,d);b.data("ckeditorInstance",c);c.on("instanceReady",function(d){var e=d.editor;setTimeout(function(){if(e.element){d.removeListener();e.on("dataReady",function(){b.trigger("dataReady.ckeditor",[e])});e.on("setData",function(a){b.trigger("setData.ckeditor",[e,a.data])});e.on("getData",function(a){b.trigger("getData.ckeditor",[e,a.data])},999);e.on("destroy",function(){b.trigger("destroy.ckeditor",[e])});e.on("save",function(){a(h.form).submit();
-return!1},null,null,20);if(e.config.autoUpdateElementJquery&&b.is("textarea")&&a(h.form).length){var c=function(){b.ckeditor(function(){e.updateElement()})};a(h.form).submit(c);a(h.form).bind("form-pre-serialize",c);b.bind("destroy.ckeditor",function(){a(h.form).unbind("submit",c);a(h.form).unbind("form-pre-serialize",c)})}e.on("destroy",function(){b.removeData("ckeditorInstance")});b.removeData("_ckeditorInstanceLock");b.trigger("instanceReady.ckeditor",[e]);g&&g.apply(e,[h]);j.resolve()}else setTimeout(arguments.callee,
-100)},0)},null,null,9999)}});var f=new a.Deferred;this.promise=f.promise();a.when.apply(this,i).then(function(){f.resolve()});this.editor=this.eq(0).data("ckeditorInstance");return this}}),CKEDITOR.config.jqueryOverrideVal&&(a.fn.val=CKEDITOR.tools.override(a.fn.val,function(g){return function(d){if(arguments.length){var k=this,i=[],f=this.each(function(){var b=a(this),c=b.data("ckeditorInstance");if(b.is("textarea")&&c){var f=new a.Deferred;c.setData(d,function(){f.resolve()});i.push(f.promise());
-return!0}return g.call(b,d)});if(i.length){var b=new a.Deferred;a.when.apply(this,i).done(function(){b.resolveWith(k)});return b.promise()}return f}var f=a(this).eq(0),c=f.data("ckeditorInstance");return f.is("textarea")&&c?c.getData():g.call(f)}})))})(window.jQuery);
+(function(a){if("undefined"==typeof a)throw Error("jQuery should be loaded before CKEditor jQuery adapter.");if("undefined"==typeof CKEDITOR)throw Error("CKEditor should be loaded before CKEditor jQuery adapter.");CKEDITOR.config.jqueryOverrideVal="undefined"==typeof CKEDITOR.config.jqueryOverrideVal?!0:CKEDITOR.config.jqueryOverrideVal;a.extend(a.fn,{ckeditorGet:function(){var a=this.eq(0).data("ckeditorInstance");if(!a)throw"CKEditor is not initialized yet, use ckeditor() with a callback.";return a},
+ckeditor:function(g,d){if(!CKEDITOR.env.isCompatible)throw Error("The environment is incompatible.");if(!a.isFunction(g))var k=d,d=g,g=k;var i=[],d=d||{};this.each(function(){var b=a(this),c=b.data("ckeditorInstance"),f=b.data("_ckeditorInstanceLock"),h=this,j=new a.Deferred;i.push(j.promise());if(c&&!f)g&&g.apply(c,[this]),j.resolve();else if(f)c.once("instanceReady",function(){setTimeout(function(){c.element?(c.element.$==h&&g&&g.apply(c,[h]),j.resolve()):setTimeout(arguments.callee,100)},0)},null,
+null,9999);else{if(d.autoUpdateElement||"undefined"==typeof d.autoUpdateElement&&CKEDITOR.config.autoUpdateElement)d.autoUpdateElementJquery=!0;d.autoUpdateElement=!1;b.data("_ckeditorInstanceLock",!0);c=a(this).is("textarea")?CKEDITOR.replace(h,d):CKEDITOR.inline(h,d);b.data("ckeditorInstance",c);c.on("instanceReady",function(d){var e=d.editor;setTimeout(function(){if(e.element){d.removeListener();e.on("dataReady",function(){b.trigger("dataReady.ckeditor",[e])});e.on("setData",function(a){b.trigger("setData.ckeditor",
+[e,a.data])});e.on("getData",function(a){b.trigger("getData.ckeditor",[e,a.data])},999);e.on("destroy",function(){b.trigger("destroy.ckeditor",[e])});e.on("save",function(){a(h.form).submit();return!1},null,null,20);if(e.config.autoUpdateElementJquery&&b.is("textarea")&&a(h.form).length){var c=function(){b.ckeditor(function(){e.updateElement()})};a(h.form).submit(c);a(h.form).bind("form-pre-serialize",c);b.bind("destroy.ckeditor",function(){a(h.form).unbind("submit",c);a(h.form).unbind("form-pre-serialize",
+c)})}e.on("destroy",function(){b.removeData("ckeditorInstance")});b.removeData("_ckeditorInstanceLock");b.trigger("instanceReady.ckeditor",[e]);g&&g.apply(e,[h]);j.resolve()}else setTimeout(arguments.callee,100)},0)},null,null,9999)}});var f=new a.Deferred;this.promise=f.promise();a.when.apply(this,i).then(function(){f.resolve()});this.editor=this.eq(0).data("ckeditorInstance");return this}});CKEDITOR.config.jqueryOverrideVal&&(a.fn.val=CKEDITOR.tools.override(a.fn.val,function(g){return function(d){if(arguments.length){var k=
+this,i=[],f=this.each(function(){var b=a(this),c=b.data("ckeditorInstance");if(b.is("textarea")&&c){var f=new a.Deferred;c.setData(d,function(){f.resolve()});i.push(f.promise());return!0}return g.call(b,d)});if(i.length){var b=new a.Deferred;a.when.apply(this,i).done(function(){b.resolveWith(k)});return b.promise()}return f}var f=a(this).eq(0),c=f.data("ckeditorInstance");return f.is("textarea")&&c?c.getData():g.call(f)}}))})(window.jQuery);

common/js/plugins/ckeditor/ckeditor/build-config.js

@@ -42,6 +42,7 @@ var CKBUILDER_CONFIG = {
 		'.jscsrc',
 		'.jshintignore',
 		'.jshintrc',
+		'less',
 		'.mailmap',
 		'node_modules',
 		'package.json',

common/js/plugins/ckeditor/ckeditor/contents.css

@@ -94,8 +94,6 @@ pre
 	white-space: pre-wrap; /* CSS 2.1 */
 	word-wrap: break-word; /* IE7 */
 	-moz-tab-size: 4;
-	-o-tab-size: 4;
-	-webkit-tab-size: 4;
 	tab-size: 4;
 }
 

common/js/plugins/ckeditor/ckeditor/plugins/a11yhelp/dialogs/lang/fo.js

@@ -0,0 +1,11 @@
+/*
+ Copyright (c) 2003-2015, CKSource - Frederico Knabben. All rights reserved.
+ For licensing, see LICENSE.md or http://ckeditor.com/license
+*/
+CKEDITOR.plugins.setLang("a11yhelp","fo",{title:"Accessibility Instructions",contents:"Help Contents. To close this dialog press ESC.",legend:[{name:"General",items:[{name:"Editor Toolbar",legend:"Press ${toolbarFocus} to navigate to the toolbar. Move to the next and previous toolbar group with TAB and SHIFT+TAB. Move to the next and previous toolbar button with RIGHT ARROW or LEFT ARROW. Press SPACE or ENTER to activate the toolbar button."},{name:"Editor Dialog",legend:"Inside a dialog, press TAB to navigate to the next dialog element, press SHIFT+TAB to move to the previous dialog element, press ENTER to submit the dialog, press ESC to cancel the dialog. When a dialog has multiple tabs, the tab list can be reached either with ALT+F10 or with TAB as part of the dialog tabbing order. With tab list focused, move to the next and previous tab with RIGHT and LEFT ARROW, respectively."},
+{name:"Editor Context Menu",legend:"Press ${contextMenu} or APPLICATION KEY to open context-menu. Then move to next menu option with TAB or DOWN ARROW. Move to previous option with SHIFT+TAB or UP ARROW. Press SPACE or ENTER to select the menu option. Open sub-menu of current option with SPACE or ENTER or RIGHT ARROW. Go back to parent menu item with ESC or LEFT ARROW. Close context menu with ESC."},{name:"Editor List Box",legend:"Inside a list-box, move to next list item with TAB OR DOWN ARROW. Move to previous list item with SHIFT+TAB or UP ARROW. Press SPACE or ENTER to select the list option. Press ESC to close the list-box."},
+{name:"Editor Element Path Bar",legend:"Press ${elementsPathFocus} to navigate to the elements path bar. Move to next element button with TAB or RIGHT ARROW. Move to previous button with SHIFT+TAB or LEFT ARROW. Press SPACE or ENTER to select the element in editor."}]},{name:"Commands",items:[{name:" Undo command",legend:"Press ${undo}"},{name:" Redo command",legend:"Press ${redo}"},{name:" Bold command",legend:"Press ${bold}"},{name:" Italic command",legend:"Press ${italic}"},{name:" Underline command",
+legend:"Press ${underline}"},{name:" Link command",legend:"Press ${link}"},{name:" Toolbar Collapse command",legend:"Press ${toolbarCollapse}"},{name:" Access previous focus space command",legend:"Press ${accessPreviousSpace} to access the closest unreachable focus space before the caret, for example: two adjacent HR elements. Repeat the key combination to reach distant focus spaces."},{name:" Access next focus space command",legend:"Press ${accessNextSpace} to access the closest unreachable focus space after the caret, for example: two adjacent HR elements. Repeat the key combination to reach distant focus spaces."},
+{name:" Accessibility Help",legend:"Press ${a11yHelp}"}]}],backspace:"Backspace",tab:"Tab",enter:"Enter",shift:"Shift",ctrl:"Ctrl",alt:"Alt",pause:"Pause",capslock:"Caps Lock",escape:"Escape",pageUp:"Page Up",pageDown:"Page Down",end:"End",home:"Home",leftArrow:"Left Arrow",upArrow:"Up Arrow",rightArrow:"Right Arrow",downArrow:"Down Arrow",insert:"Insert","delete":"Delete",leftWindowKey:"Left Windows key",rightWindowKey:"Right Windows key",selectKey:"Select key",numpad0:"Numpad 0",numpad1:"Numpad 1",
+numpad2:"Numpad 2",numpad3:"Numpad 3",numpad4:"Numpad 4",numpad5:"Numpad 5",numpad6:"Numpad 6",numpad7:"Numpad 7",numpad8:"Numpad 8",numpad9:"Numpad 9",multiply:"Falda",add:"Pluss",subtract:"Frádráttar",decimalPoint:"Decimal Point",divide:"Býta",f1:"F1",f2:"F2",f3:"F3",f4:"F4",f5:"F5",f6:"F6",f7:"F7",f8:"F8",f9:"F9",f10:"F10",f11:"F11",f12:"F12",numLock:"Num Lock",scrollLock:"Scroll Lock",semiColon:"Semikolon",equalSign:"Javnatekn",comma:"Komma",dash:"Dash",period:"Punktum",forwardSlash:"Forward Slash",
+graveAccent:"Grave Accent",openBracket:"Open Bracket",backSlash:"Backslash",closeBracket:"Close Bracket",singleQuote:"Single Quote"});

config/config.inc.php

@@ -29,7 +29,7 @@ define('__ZBXE__', __XE__);
 /**
  * Display XE's full version.
  */
-define('__XE_VERSION__', '1.8.8');
+define('__XE_VERSION__', '1.8.13');
 define('__XE_VERSION_ALPHA__', (stripos(__XE_VERSION__, 'alpha') !== false));
 define('__XE_VERSION_BETA__', (stripos(__XE_VERSION__, 'beta') !== false));
 define('__XE_VERSION_RC__', (stripos(__XE_VERSION__, 'rc') !== false));
@@ -351,7 +351,7 @@ $GLOBALS['__xe_autoload_file_map'] = array_change_key_case(array(
 	'TemplateHandler' => 'classes/template/TemplateHandler.class.php',
 	'Validator' => 'classes/validator/Validator.class.php',
 	'WidgetHandler' => 'classes/widget/WidgetHandler.class.php',
-	'GeneralXmlParser' => 'classes/widget/GeneralXmlParser.class.php',
+	'GeneralXmlParser' => 'classes/xml/GeneralXmlParser.class.php',
 	'Xml_Node_' => 'classes/xml/XmlParser.class.php',
 	'XmlGenerator' => 'classes/xml/XmlGenerator.class.php',
 	'XmlJsFilter' => 'classes/xml/XmlJsFilter.class.php',

modules/board/board.class.php

@@ -18,6 +18,21 @@ class board extends ModuleObject
 	var $page_count = 10; ///< page number
 	var $category_list = NULL; ///< category list
 
+	/**
+	 * constructor
+	 *
+	 * @return void
+	 */
+	function board()
+	{
+		if(!Context::isInstalled()) return;
+
+		if(!Context::isExistsSSLAction('dispBoardWrite') && Context::getSslStatus() == 'optional')
+		{
+			$ssl_actions = array('dispBoardWrite', 'dispBoardWriteComment', 'dispBoardReplyComment', 'dispBoardModifyComment', 'dispBoardDeleteComment', 'procBoardInsertDocument', 'procBoardDeleteDocument', 'procBoardInsertComment', 'procBoardDeleteComment', 'procBoardVerificationPassword');
+			Context::addSSLActions($ssl_actions);
+		}
+	}
 
 	/**
 	 * @brief install the module

modules/communication/communication.model.php

@@ -44,7 +44,7 @@ class communicationModel extends communication
 
 		if(!$communication_config->editor_skin)
 		{
-			$communication_config->editor_skin = 'default';
+			$communication_config->editor_skin = 'ckeditor';
 		}
 
 		if(!$communication_config->mskin)

modules/document/document.controller.php

@@ -274,6 +274,7 @@ class documentController extends document
 			$obj->homepage = $logged_info->homepage;
 		}
 		// If the tile is empty, extract string from the contents.
+		$obj->title = htmlspecialchars($obj->title);
 		settype($obj->title, "string");
 		if($obj->title == '') $obj->title = cut_str(trim(strip_tags(nl2br($obj->content))),20,'...');
 		// If no tile extracted from the contents, leave it untitled.

modules/editor/components/image_gallery/image_gallery.class.php

@@ -43,18 +43,24 @@ class image_gallery extends EditorHandler
 	 */
 	function transHTML($xml_obj)
 	{
-		$gallery_info = new stdClass;
-		$gallery_info->srl = rand(111111,999999);
-		$gallery_info->border_thickness = $xml_obj->attrs->border_thickness;
+		$gallery_info = new stdClass();
+		$gallery_info->srl = rand(111111, 999999);
+		$gallery_info->border_thickness = (int)$xml_obj->attrs->border_thickness;
 		$gallery_info->gallery_style = $xml_obj->attrs->gallery_style;
 		$color_preg = "/^([a-fA-F0-9]{6})/";
 		$gallery_info->border_color = preg_replace($color_preg,"#$1",$xml_obj->attrs->border_color);
 		$gallery_info->bg_color = preg_replace($color_preg,"#$1",$xml_obj->attrs->bg_color);
 		$gallery_info->gallery_align = $xml_obj->attrs->gallery_align;
 
+		if(!in_array($gallery_info->gallery_align, array('left', 'center', 'right'))) {
+			$gallery_info->gallery_align = 'center';
+		}
+
 		$images_list = $xml_obj->attrs->images_list;
-		$images_list = preg_replace('/\.(gif|jpg|jpeg|png) /i',".\\1\n",$images_list);
-		$gallery_info->images_list = explode("\n",trim($images_list));
+		$images_list = preg_replace('/\.(gif|jpe?g|png) /i', ".\\1\n", $images_list);
+		$images_list = explode("\n", trim($images_list));
+		$gallery_info->images_list = preg_grep("/^[a-z0-9\/]+\.(gif|jpe?g|png)+$/", $images_list);
+
 		// If you set the output to output the XML code generated a list of the image
 		if(Context::getResponseMethod() == 'XMLRPC')
 		{

modules/file/conf/module.xml

@@ -13,7 +13,7 @@
         <action name="procFileImageResize" type="controller" ruleset="imageResize" />
         <action name="procFileDelete" type="controller" />
         <action name="procFileDownload" type="controller" method="GET|POST" />
-        <action name="procFileOutput" type="controller" />
+        <action name="procFileOutput" type="controller" method="GET|POST" />
         <action name="procFileAdminDeleteChecked" type="controller" ruleset="deleteChecked" />
         <action name="procFileAdminInsertConfig" type="controller" ruleset="insertConfig" />
         <action name="procFileAdminInsertModuleConfig" type="controller" ruleset="fileModuleConfig" />

modules/file/file.controller.php

@@ -112,11 +112,11 @@ class fileController extends file
 		$source_src = $fileInfo->uploaded_filename;
 		$output_src = $source_src . '.resized' . strrchr($source_src,'.');
 
-		$type = 'ratio';
 		if(!$height) $height = $width-1;
 
 		if(FileHandler::createImageFile($source_src,$output_src,$width,$height,'','ratio'))
 		{
+			$output = new stdClass();
 			$output->info = getimagesize($output_src);
 			$output->src = $output_src;
 		}

modules/member/conf/module.xml

@@ -62,8 +62,8 @@
 		<action name="procMemberSaveDocument" type="controller" standalone="true" />
 		<action name="procMemberDeleteSavedDocument" type="controller" standalone="true" />
 
-		<action name="procMemberFindAccount" type="controller" ruleset="findAccount" standalone="true" />
-		<action name="procMemberFindAccountByQuestion" type="controller" standalone="true" />
+		<action name="procMemberFindAccount" type="controller" method="GET|POST" ruleset="findAccount" standalone="true" />
+		<action name="procMemberFindAccountByQuestion" type="controller" method="GET|POST" standalone="true" />
 		<action name="procMemberAuthAccount" type="controller" method="GET|POST" standalone="true" />
 		<action name="procMemberAuthEmailAddress" type="controller" method="GET|POST" standalone="true" />
 		<action name="procMemberResendAuthMail" type="controller" ruleset="resendAuthMail" standalone="true" />

modules/member/tpl/group_list.html

@@ -15,7 +15,7 @@
 <div cond="$XE_VALIDATOR_MESSAGE && $XE_VALIDATOR_ID == 'modules/member/tpl/1'" class="message {$XE_VALIDATOR_MESSAGE_TYPE}">
 	<p>{$XE_VALIDATOR_MESSAGE}</p>
 </div>
-<form action="" method="post" ruleset="insertGroupConfig">
+<form action="" method="post" id="fo_member_group" ruleset="insertGroupConfig">
 	<input type="hidden" name="module" value="member" />
 	<input type="hidden" name="act" value="procMemberAdminGroupConfig" />
 	<input type="hidden" name="xe_validator_id" value="modules/member/tpl/1" />

modules/menu/menu.admin.controller.php

@@ -732,7 +732,7 @@ class menuAdminController extends menu
 		unset($args->group_srls);
 		$args->open_window = $request->menu_open_window;
 		$args->expand = $request->menu_expand;
-		$output = executeQuery('menu.updateMenuItem', $args);
+		$output = $this->_updateMenuItem($args);
 
 		$this->makeXmlFile($args->menu_srl);
 
@@ -790,7 +790,7 @@ class menuAdminController extends menu
 			$item_info->active_btn = '';
 		}
 
-		$output = executeQuery('menu.updateMenuItem', $item_info);
+		$output = $this->_updateMenuItem($item_info);
 
 		// recreate menu cache file
 		$this->makeXmlFile($args->menu_srl);
@@ -798,13 +798,20 @@ class menuAdminController extends menu
 
 	public function updateMenuItem($itemInfo)
 	{
-		$output = executeQuery('menu.updateMenuItem', $itemInfo);
+		$output = $this->_updateMenuItem($itemInfo);
 
 		// recreate menu cache file
 		$this->makeXmlFile($itemInfo->menu_srl);
 		return $output;
 	}
 
+	public function _updateMenuItem($itemInfo)
+	{
+		$output = executeQuery('menu.updateMenuItem', $itemInfo);
+
+		return $output;
+	}
+
 	/**
 	 * Delete menu item(menu of the menu)
 	 * @return void|Object
@@ -961,7 +968,7 @@ class menuAdminController extends menu
 			{
 				$output->data->url = '';
 				$referenceItem = $output->data;
-				$output = executeQuery('menu.updateMenuItem', $referenceItem);
+				$output = $this->_updateMenuItem($referenceItem);
 				if(!$output->toBool())
 				{
 					$oDB->rollback();
@@ -1085,7 +1092,7 @@ class menuAdminController extends menu
 				$args = new stdClass();
 				$args->menu_srl = $menu_srl;
 				$args->menu_item_srl = $node['node_srl'];
-				$output = executeQuery('menu.updateMenuItemNode', $args);
+				$output = $this->_updateMenuItem($args);
 
 				//module's menu_srl move also
 				if($node['is_shortcut'] == 'N' && !empty($node['url']))
@@ -1249,7 +1256,7 @@ class menuAdminController extends menu
 				$update_item_info->normal_btn = $copied_info['normal_btn'];
 				$update_item_info->hover_btn = $copied_info['hover_btn'];
 				$update_item_info->active_btn = $copied_info['active_btn'];
-				executeQuery('menu.updateMenuItem', $update_item_info);
+				$output = $this->_updateMenuItem($update_item_info);
 			}
 			$this->insertedMenuItemSrlList[] = $insertedMenuItemSrl;
 		}
@@ -1629,7 +1636,7 @@ class menuAdminController extends menu
 		// Update if exists
 		if($item_info->menu_item_srl == $args->menu_item_srl)
 		{
-			$output = executeQuery('menu.updateMenuItem', $args);
+			$output = $this->_updateMenuItem($args);
 			if(!$output->toBool()) return $output;
 		}
 		// Insert if not exist
@@ -1680,7 +1687,7 @@ class menuAdminController extends menu
 			if($exposure) $args->group_srls = implode(',', $exposure);
 		}
 
-		$output = executeQuery('menu.updateMenuItem', $args);
+		$output = $this->_updateMenuItem($args);
 		if(!$output->toBool())
 		{
 			return $output;

modules/module/module.controller.php

@@ -441,6 +441,8 @@ class moduleController extends module
 
 		unset($output);
 
+		$args->browser_title = strip_tags($args->browser_title);
+
 		if($isMenuCreate == TRUE)
 		{
 			$menuArgs = new stdClass;
@@ -476,8 +478,8 @@ class moduleController extends module
 			}
 		}
 
-		$args->menu_srl = $menuArgs->menu_srl;
 		// Insert a module
+		$args->menu_srl = $menuArgs->menu_srl;
 		$output = executeQuery('module.insertModule', $args);
 		if(!$output->toBool())
 		{
@@ -521,6 +523,8 @@ class moduleController extends module
 			if(!$args->browser_title) $args->browser_title = $module_info->browser_title;
 		}
 
+		$args->browser_title = strip_tags($args->browser_title);
+
 		$output = executeQuery('module.isExistsModuleName', $args);
 		if(!$output->toBool() || $output->data->count)
 		{
@@ -977,7 +981,7 @@ class moduleController extends module
 			}
 		}
 
-		$oDB->commit;
+		$oDB->commit();
 
 		return new Object();
 	}

modules/module/module.model.php

@@ -77,7 +77,7 @@ class moduleModel extends module
 	}
 
 	/**
-	 * @brief Get the defaul mid according to the domain
+	 * @brief Get the default mid according to the domain
 	 */
 	function getDefaultMid()
 	{