diff --git a/.htaccess b/.htaccess
index 792ea9532..c0ea1b7bb 100644
--- a/.htaccess
+++ b/.htaccess
@@ -2,9 +2,8 @@ RewriteEngine On
# block direct access to templates, XML schema files, config files, dotfiles, environment, etc.
RewriteCond %{REQUEST_URI} !/modules/editor/(skins|styles)/
-RewriteCond %{REQUEST_URI} !/common/manual/
RewriteRule ^(addons|common/tpl|files/ruleset|(m\.)?layouts|modules|plugins|themes|widgets|widgetstyles)/.+\.(html|xml)$ - [L,F]
-RewriteRule ^files/(attach|config|cache/store)/.+\.php$ - [L,F]
+RewriteRule ^files/(attach|config|cache/store)/.+\.(ph(p|t|ar)?[0-9]?|p?html?|cgi|pl|exe|[aj]spx?|inc|bak)$ - [L,F]
RewriteRule ^files/(env|member_extra_info/(new_message_flags|point))/ - [L,F]
RewriteRule ^(\.git|\.ht|\.travis|codeception\.|composer\.|Gruntfile\.js|package\.json|CONTRIBUTING|COPYRIGHT|LICENSE|README) - [L,F]
diff --git a/.travis.yml b/.travis.yml
index bf48be3e3..438a2011b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,18 +5,15 @@ php:
- 7.0
- 7.1
- 7.2
- - nightly
-matrix:
- allow_failures:
- - php: nightly
+ - 7.3
services:
- mysql
before_script:
- npm install grunt grunt-cli grunt-contrib-jshint grunt-contrib-csslint grunt-phplint --save-dev
- mysql -u root -e "CREATE DATABASE rhymix CHARSET utf8mb4 COLLATE utf8mb4_unicode_ci"
- mysql -u root -e "GRANT ALL PRIVILEGES ON rhymix.* TO travis@localhost"
- - mysql -u root -e "UPDATE mysql.user SET Password = PASSWORD('travis') WHERE User = 'travis'; FLUSH PRIVILEGES"
- - if [[ $TRAVIS_PHP_VERSION != "nightly" ]]; then phpenv config-rm xdebug.ini; fi
+ - mysql -u root -e "SET PASSWORD FOR travis@localhost = PASSWORD('travis'); FLUSH PRIVILEGES"
+ - if [[ $TRAVIS_PHP_VERSION != "7.3" ]]; then phpenv config-rm xdebug.ini; fi
- wget https://codeception.com/releases/2.3.9/codecept.phar
- php -S localhost:8000 &
script:
diff --git a/README.md b/README.md
index 4cece3e7f..9f043be7f 100644
--- a/README.md
+++ b/README.md
@@ -47,11 +47,11 @@ devops@rhymix.org로 알려 주시면 감사하겠습니다.
### 공식 홈페이지
-- Rhymix : https://www.rhymix.org
+- Rhymix : https://rhymix.org
### 커뮤니티
-- XETOWN : https://www.xetown.com
+- XETOWN : https://xetown.com
### 저작권 및 라이선스
@@ -118,11 +118,11 @@ If you have found a security vulnerability, please let us know at devops@rhymix.
### Official Website
-- Rhymix : https://www.rhymix.org
+- Rhymix : https://rhymix.org
### Community
-- XETOWN (Korean) : https://www.xetown.com
+- XETOWN (Korean) : https://xetown.com
### Copyright and License
diff --git a/addons/photoswipe/conf/info.xml b/addons/photoswipe/conf/info.xml
index c48bf732f..82d6b2a96 100644
--- a/addons/photoswipe/conf/info.xml
+++ b/addons/photoswipe/conf/info.xml
@@ -20,4 +20,16 @@
Rhymix contributors
Rhymix contributors
-
\ No newline at end of file
+
+
+ 파일이름 출력 설정
+ 넘겨보기 실행시 하단에 파일이름을 출력할 것인지 여부를 선택합니다. 기본값은 사용하도록 되어있습니다.
+
+ 사용
+
+
+ 사용 안함
+
+
+
+
diff --git a/addons/photoswipe/photoswipe.addon.php b/addons/photoswipe/photoswipe.addon.php
index 4a1afbf86..87ebe03ed 100644
--- a/addons/photoswipe/photoswipe.addon.php
+++ b/addons/photoswipe/photoswipe.addon.php
@@ -21,7 +21,10 @@ if($called_position == 'after_module_proc' && Context::getResponseMethod() == "H
Context::loadFile(array('./addons/photoswipe/rx_photoswipe.js', 'body', '', null), true);
$footer = FileHandler::readFile('./addons/photoswipe/PhotoSwipe/pswp.html');
- Context::addHtmlFooter($footer);
+
+ $style_display = isset($addon_info->display_name) ? "" : '';
+
+ Context::addHtmlFooter($style_display . $footer);
}
/* End of file photoswipe.addon.php */
diff --git a/addons/recaptcha/recaptcha.class.php b/addons/recaptcha/recaptcha.class.php
index dbf2bf86c..11177627b 100644
--- a/addons/recaptcha/recaptcha.class.php
+++ b/addons/recaptcha/recaptcha.class.php
@@ -18,7 +18,7 @@ class reCAPTCHA
$response = Context::get('g-recaptcha-response');
if (!$response)
{
- return new BaseObject(-1, 'recaptcha.msg_recaptcha_invalid_response');
+ throw new Rhymix\Framework\Exception('recaptcha.msg_recaptcha_invalid_response');
}
try
@@ -31,17 +31,17 @@ class reCAPTCHA
}
catch (\Requests_Exception $e)
{
- return new BaseObject(-1, 'recaptcha.msg_recaptcha_connection_error');
+ throw new Rhymix\Framework\Exception('recaptcha.msg_recaptcha_connection_error');
}
$verify = @json_decode($verify_request->body, true);
if ($verify && isset($verify['error-codes']) && in_array('invalid-input-response', $verify['error-codes']))
{
- return new BaseObject(-1, 'recaptcha.msg_recaptcha_invalid_response');
+ throw new Rhymix\Framework\Exception('recaptcha.msg_recaptcha_invalid_response');
}
elseif (!$verify || !$verify['success'] || (isset($verify['error-codes']) && $verify['error-codes']))
{
- return new BaseObject(-1, 'recaptcha.msg_recaptcha_server_error');
+ throw new Rhymix\Framework\Exception('recaptcha.msg_recaptcha_server_error');
}
else
{
diff --git a/classes/context/Context.class.php b/classes/context/Context.class.php
index ee68ccb23..7377cecf1 100644
--- a/classes/context/Context.class.php
+++ b/classes/context/Context.class.php
@@ -117,10 +117,10 @@ class Context
public $is_site_locked = FALSE;
/**
- * Check init
- * @var bool FALSE if init fail
+ * Result of initial security check
+ * @var string|bool
*/
- public $isSuccessInit = TRUE;
+ public $security_check = 'OK';
/**
* Singleton instance
@@ -173,8 +173,9 @@ class Context
* @var array
*/
private static $_check_patterns = array(
- '@<(?:\?|%)@',
- '@ 'DENY ALL',
+ '@ 'DENY ALL',
+ '@ 'ALLOW ADMIN ONLY',
);
/**
@@ -256,14 +257,6 @@ class Context
// If Rhymix is installed, get virtual site information.
if(self::isInstalled())
{
- $oModuleModel = getModel('module');
- $site_module_info = $oModuleModel->getDefaultMid() ?: new stdClass;
- self::set('site_module_info', $site_module_info);
- self::set('_default_timezone', ($site_module_info->settings && $site_module_info->settings->timezone) ? $site_module_info->settings->timezone : null);
- self::set('_default_url', self::$_instance->db_info->default_url = self::getDefaultUrl($site_module_info));
- self::set('_http_port', self::$_instance->db_info->http_port = $site_module_info->http_port ?: null);
- self::set('_https_port', self::$_instance->db_info->https_port = $site_module_info->https_port ?: null);
- self::set('_use_ssl', self::$_instance->db_info->use_ssl = $site_module_info->security ?: 'none');
if (PHP_SAPI === 'cli')
{
self::set('_default_url', $default_url = config('url.default'));
@@ -272,6 +265,14 @@ class Context
define('RX_BASEURL', parse_url($default_url, PHP_URL_PATH));
}
}
+ $oModuleModel = getModel('module');
+ $site_module_info = $oModuleModel->getDefaultMid() ?: new stdClass;
+ self::set('site_module_info', $site_module_info);
+ self::set('_default_timezone', ($site_module_info->settings && $site_module_info->settings->timezone) ? $site_module_info->settings->timezone : null);
+ self::set('_default_url', self::$_instance->db_info->default_url = self::getDefaultUrl($site_module_info));
+ self::set('_http_port', self::$_instance->db_info->http_port = $site_module_info->http_port ?: null);
+ self::set('_https_port', self::$_instance->db_info->https_port = $site_module_info->https_port ?: null);
+ self::set('_use_ssl', self::$_instance->db_info->use_ssl = $site_module_info->security ?: 'none');
}
else
{
@@ -294,13 +295,14 @@ class Context
// Load language support.
$enabled_langs = self::loadLangSelected();
+ $set_lang_cookie = false;
self::set('lang_supported', $enabled_langs);
if($lang_type = self::get('l'))
{
if($_COOKIE['lang_type'] !== $lang_type)
{
- setcookie('lang_type', $lang_type, time() + 86400 * 365, '/', null, !!config('session.use_ssl_cookies'));
+ $set_lang_cookie = true;
}
}
elseif($_COOKIE['lang_type'])
@@ -316,12 +318,18 @@ class Context
if(!strncasecmp($lang_code, $_SERVER['HTTP_ACCEPT_LANGUAGE'], strlen($lang_code)))
{
$lang_type = $lang_code;
- setcookie('lang_type', $lang_type, time() + 86400 * 365, '/', null, !!config('session.use_ssl_cookies'));
+ $set_lang_cookie = true;
}
}
}
}
+ $lang_type = preg_replace('/[^a-zA-Z0-9_-]/', '', $lang_type);
+ if ($set_lang_cookie)
+ {
+ setcookie('lang_type', $lang_type, time() + 86400 * 365, '/', null, !!config('session.use_ssl_cookies'));
+ }
+
if(!$lang_type || !isset($enabled_langs[$lang_type]))
{
if($site_module_info->settings->language)
@@ -351,6 +359,7 @@ class Context
{
$oSessionModel = getModel('session');
$oSessionController = getController('session');
+ ini_set('session.serialize_handler', 'php');
session_set_save_handler(
array(&$oSessionController, 'open'), array(&$oSessionController, 'close'), array(&$oSessionModel, 'read'), array(&$oSessionController, 'write'), array(&$oSessionController, 'destroy'), array(&$oSessionController, 'gc')
);
@@ -794,7 +803,7 @@ class Context
return '';
}
getController('module')->replaceDefinedLangCode(self::$_instance->browser_title);
- return htmlspecialchars(self::$_instance->browser_title, ENT_COMPAT | ENT_HTML401, 'UTF-8', FALSE);
+ return htmlspecialchars(self::$_instance->browser_title, ENT_QUOTES, 'UTF-8', FALSE);
}
/**
@@ -885,6 +894,7 @@ class Context
{
self::$_instance->db_info = new stdClass;
}
+
self::$_instance->db_info->lang_type = $lang_type;
self::$_instance->lang_type = $lang_type;
self::set('lang_type', $lang_type);
@@ -1070,7 +1080,7 @@ class Context
{
if (!self::_recursiveCheckVar($_SERVER['HTTP_HOST']) || preg_match("/[\,\"\'\{\}\[\]\(\);$]/", $_SERVER['HTTP_HOST']))
{
- self::$_instance->isSuccessInit = FALSE;
+ self::$_instance->security_check = 'DENY ALL';
}
}
@@ -1205,7 +1215,7 @@ class Context
{
if(self::getRequestMethod() === 'XMLRPC')
{
- if(!Rhymix\Framework\Security::checkXEE($GLOBALS['HTTP_RAW_POST_DATA']))
+ if(!Rhymix\Framework\Security::checkXXE($GLOBALS['HTTP_RAW_POST_DATA']))
{
header("HTTP/1.0 400 Bad Request");
exit;
@@ -1261,10 +1271,16 @@ class Context
$tmp_name = $val['tmp_name'];
if(!is_array($tmp_name))
{
- if(!$tmp_name || !is_uploaded_file($tmp_name) || $val['size'] <= 0)
+ if($val['name'] === '' && $val['size'] == 0)
{
continue;
}
+ if(!UploadFileFilter::check($tmp_name, $val['name']))
+ {
+ self::$_instance->security_check = 'DENY ALL';
+ unset($_FILES[$key]);
+ continue;
+ }
$val['name'] = escape($val['name'], false);
self::set($key, $val, true);
self::set('is_uploaded', true);
@@ -1275,16 +1291,24 @@ class Context
$files = array();
foreach ($tmp_name as $i => $j)
{
- if($val['size'][$i] > 0)
+ if($val['name'][$i] === '' && $val['size'][$i] == 0)
{
- $file = array();
- $file['name'] = $val['name'][$i];
- $file['type'] = $val['type'][$i];
- $file['tmp_name'] = $val['tmp_name'][$i];
- $file['error'] = $val['error'][$i];
- $file['size'] = $val['size'][$i];
- $files[] = $file;
+ continue;
}
+ if(!UploadFileFilter::check($val['tmp_name'][$i], $val['name'][$i]))
+ {
+ self::$_instance->security_check = 'DENY ALL';
+ $files = array();
+ unset($_FILES[$key]);
+ break;
+ }
+ $file = array();
+ $file['name'] = $val['name'][$i];
+ $file['type'] = $val['type'][$i];
+ $file['tmp_name'] = $val['tmp_name'][$i];
+ $file['error'] = $val['error'][$i];
+ $file['size'] = $val['size'][$i];
+ $files[] = $file;
}
if(count($files))
{
@@ -1304,12 +1328,15 @@ class Context
{
if(is_string($val))
{
- foreach(self::$_check_patterns as $pattern)
+ foreach(self::$_check_patterns as $pattern => $status)
{
if(preg_match($pattern, $val))
{
- self::$_instance->isSuccessInit = false;
- return false;
+ self::$_instance->security_check = $status;
+ if($status === 'DENY ALL')
+ {
+ return false;
+ }
}
}
}
@@ -1403,20 +1430,17 @@ class Context
}
elseif($_val = trim($_val))
{
- if(in_array($key, array('page', 'cpage')) || ends_with('srl', $key, false))
+ if(in_array($key, array('page', 'cpage')) || ends_with('srl', $key, false) && preg_match('/[^0-9,]/', $_val))
{
- if(preg_match('/[^0-9,]/', $_val))
- {
- $_val = (int)$_val;
- }
+ $_val = (int)$_val;
}
- elseif(in_array($key, array('mid', 'search_keyword', 'xe_validator_id')))
+ elseif(in_array($key, array('mid', 'vid', 'search_target', 'search_keyword', 'xe_validator_id')) || $_SERVER['REQUEST_METHOD'] === 'GET')
{
$_val = escape($_val, false);
- }
- elseif($key === 'vid')
- {
- $_val = urlencode($_val);
+ if(ends_with('url', $key, false))
+ {
+ $_val = strtr($_val, array('&' => '&'));
+ }
}
}
$result[escape($_key)] = $_val;
@@ -1699,23 +1723,41 @@ class Context
// If using SSL always
if($site_module_info->security == 'always')
{
- $query = self::getRequestUri(ENFORCE_SSL, $domain) . $query;
+ if(!$domain && RX_SSL)
+ {
+ $query = RX_BASEURL . $query;
+ }
+ else
+ {
+ $query = self::getRequestUri(ENFORCE_SSL, $domain) . $query;
+ }
}
// optional SSL use
elseif($site_module_info->security == 'optional')
{
$ssl_mode = ((self::get('module') === 'admin') || ($get_vars['module'] === 'admin') || (isset($get_vars['act']) && self::isExistsSSLAction($get_vars['act']))) ? ENFORCE_SSL : RELEASE_SSL;
- $query = self::getRequestUri($ssl_mode, $domain) . $query;
+ if(!$domain && (RX_SSL && ENFORCE_SSL) || (!RX_SSL && RELEASE_SSL))
+ {
+ $query = RX_BASEURL . $query;
+ }
+ else
+ {
+ $query = self::getRequestUri($ssl_mode, $domain) . $query;
+ }
}
// no SSL
else
{
// currently on SSL but target is not based on SSL
- if(RX_SSL)
+ if(!$domain && RX_SSL)
+ {
+ $query = RX_BASEURL . $query;
+ }
+ elseif(RX_SSL)
{
$query = self::getRequestUri(ENFORCE_SSL, $domain) . $query;
}
- else if($domain) // if $domain is set
+ elseif($domain)
{
$query = self::getRequestUri(FOLLOW_REQUEST_SSL, $domain) . $query;
}
@@ -1732,7 +1774,7 @@ class Context
if(!$autoEncode)
{
- return htmlspecialchars($query, ENT_COMPAT | ENT_HTML401, 'UTF-8', FALSE);
+ return htmlspecialchars($query, ENT_QUOTES, 'UTF-8', FALSE);
}
$output = array();
@@ -1748,7 +1790,7 @@ class Context
$encode_queries[] = $key . '=' . $value;
}
- return htmlspecialchars($parsedUrl['path'] . '?' . join('&', $encode_queries), ENT_COMPAT | ENT_HTML401, 'UTF-8', FALSE);
+ return htmlspecialchars($parsedUrl['path'] . '?' . join('&', $encode_queries), ENT_QUOTES, 'UTF-8', FALSE);
}
/**
@@ -1810,6 +1852,12 @@ class Context
*/
public static function set($key, $val, $set_to_get_vars = false)
{
+ if(empty($key))
+ {
+ trigger_error('Called Context::set() with an empty key', \E_USER_WARNING);
+ return;
+ }
+
self::$_tpl_vars->{$key} = $val;
if($set_to_get_vars || isset(self::$_get_vars->{$key}))
@@ -1833,6 +1881,12 @@ class Context
*/
public static function get($key)
{
+ if(empty($key))
+ {
+ trigger_error('Called Context::get() with an empty key', \E_USER_WARNING);
+ return;
+ }
+
if(isset(self::$_tpl_vars->{$key}))
{
return self::$_tpl_vars->{$key};
diff --git a/classes/db/DB.class.php b/classes/db/DB.class.php
index 2d0a3e6af..244f73f1d 100644
--- a/classes/db/DB.class.php
+++ b/classes/db/DB.class.php
@@ -122,7 +122,8 @@ class DB
}
if(!$db_type && Context::isInstalled())
{
- return new BaseObject(-1, 'msg_db_not_setted');
+ Rhymix\Framework\Debug::displayError(lang('msg_db_not_setted'));
+ exit;
}
if(!strncmp($db_type, 'mysql', 5))
{
@@ -139,7 +140,8 @@ class DB
$class_file = RX_BASEDIR . "classes/db/$class_name.class.php";
if(!file_exists($class_file))
{
- return new BaseObject(-1, 'msg_db_not_setted');
+ Rhymix\Framework\Debug::displayError(sprintf('DB type "%s" is not supported.', $db_type));
+ exit;
}
// get a singletone instance of the database driver class
diff --git a/classes/db/DBMysql.class.php b/classes/db/DBMysql.class.php
index 533cba998..ac6a978a6 100644
--- a/classes/db/DBMysql.class.php
+++ b/classes/db/DBMysql.class.php
@@ -73,16 +73,16 @@ class DBMySQL extends DB
// Check connection error
if($mysqli->connect_errno)
{
- $this->setError($mysqli->connect_errno, $mysqli->connect_error());
- return;
+ Rhymix\Framework\Debug::displayError(sprintf('DB ERROR %d : %s', $mysqli->connect_errno, $mysqli->connect_error));
+ exit;
}
// Check DB version
$this->db_version = $mysqli->server_info;
if (version_compare($this->db_version, '5.0.7', '<'))
{
- $this->setError(-1, 'Rhymix requires MySQL 5.0.7 or later. Current MySQL version is ' . $this->db_version);
- return;
+ Rhymix\Framework\Debug::displayError('Rhymix requires MySQL 5.0.7 or later. Current MySQL version is ' . $this->db_version);
+ exit;
}
// Set DB charset
diff --git a/classes/db/queryparts/Query.class.php b/classes/db/queryparts/Query.class.php
index 681c5f5d9..229a3b8fc 100644
--- a/classes/db/queryparts/Query.class.php
+++ b/classes/db/queryparts/Query.class.php
@@ -157,7 +157,7 @@ class Query extends BaseObject
foreach($this->columnList as $columnName)
{
- $columnName = $dbParser->escapeColumn($columnName);
+ $columnName = $dbParser->escapeColumnExpression($columnName);
$selectColumns[] = new SelectExpression($columnName);
}
unset($this->columns);
@@ -586,6 +586,11 @@ class Query extends BaseObject
*/
function getHavingString($with_values = TRUE)
{
+ if(!is_array($this->having))
+ {
+ return '';
+ }
+
$having = '';
$condition_count = 0;
diff --git a/classes/display/DisplayHandler.class.php b/classes/display/DisplayHandler.class.php
index 005dfe8db..674750681 100644
--- a/classes/display/DisplayHandler.class.php
+++ b/classes/display/DisplayHandler.class.php
@@ -157,16 +157,22 @@ class DisplayHandler extends Handler
}
// Do not display debugging information if there is no output.
- $display_type = config('debug.display_type');
- if ($output === null && $display_type !== 'file')
+ $display_types = config('debug.display_type');
+ if (!is_array($display_types))
+ {
+ $display_types = array($display_types);
+ }
+ if ($output === null && !in_array('file', $display_types))
{
return;
}
// Print debug information.
- switch ($display_type)
+ $debug_output = '';
+ foreach ($display_types as $display_type)
{
- case 'panel':
+ if ($display_type === 'panel')
+ {
$data = Rhymix\Framework\Debug::getDebugData();
$display_content = array_fill_keys(config('debug.display_content'), true);
if (count($display_content) && !isset($display_content['entries']))
@@ -220,7 +226,7 @@ class DisplayHandler extends Handler
$panel_script .= "\n";
$body_end_position = strrpos($output, '') ?: strlen($output);
$output = substr($output, 0, $body_end_position) . "\n$panel_script\n" . substr($output, $body_end_position);
- return;
+ break;
case 'JSON':
if (RX_POST && preg_match('/^proc/', Context::get('act')))
{
@@ -236,17 +242,16 @@ class DisplayHandler extends Handler
{
$output = $matches[1] . ',"_rx_debug":' . json_encode($data) . '}';
}
- return;
+ break;
default:
- return;
+ break;
}
-
- case 'comment':
- case 'file':
- default:
+ }
+ else
+ {
if ($display_type === 'comment' && Context::getResponseMethod() !== 'HTML')
{
- return;
+ break;
}
ob_start();
$data = Rhymix\Framework\Debug::getDebugData();
@@ -272,13 +277,16 @@ class DisplayHandler extends Handler
$phpheader = '';
}
FileHandler::writeFile($log_filename, $phpheader . $content . PHP_EOL, 'a');
- return '';
+ $debug_output .= '';
}
else
{
- return '';
+ $debug_output .= '' . PHP_EOL;
}
+ }
}
+
+ return $debug_output;
}
/**
diff --git a/classes/display/HTMLDisplayHandler.php b/classes/display/HTMLDisplayHandler.php
index 3df435402..6eb810ec9 100644
--- a/classes/display/HTMLDisplayHandler.php
+++ b/classes/display/HTMLDisplayHandler.php
@@ -19,7 +19,7 @@ class HTMLDisplayHandler
* List of scripts to block loading
*/
public static $blockedScripts = array(
- '@(?:^|/)j[Qq]uery(?:-[0-9]+(?:\.[0-9x]+)*)?(?:\.min)?\.js$@',
+ '@(?:^|/)j[Qq]uery(?:-[0-9]+(?:\.[0-9x]+)*|-latest)?(?:\.min)?\.js$@',
);
/**
@@ -157,6 +157,21 @@ class HTMLDisplayHandler
}
}
}
+
+ // Add OpenGraph metadata
+ if (config('seo.og_enabled') && Context::get('module') !== 'admin')
+ {
+ $this->_addOpenGraphMetadata();
+ }
+
+ // set icon
+ $site_module_info = Context::get('site_module_info');
+ $oAdminModel = getAdminModel('admin');
+ $favicon_url = $oAdminModel->getFaviconUrl($site_module_info->domain_srl);
+ $mobicon_url = $oAdminModel->getMobileIconUrl($site_module_info->domain_srl);
+ Context::set('favicon_url', $favicon_url);
+ Context::set('mobicon_url', $mobicon_url);
+
return $output;
}
@@ -220,20 +235,6 @@ class HTMLDisplayHandler
// Remove unnecessary information
$output = preg_replace('/member\_\-([0-9]+)/s', 'member_0', $output);
-
- // Add OpenGraph metadata
- if (config('seo.og_enabled') && Context::get('module') !== 'admin')
- {
- $this->_addOpenGraphMetadata();
- }
-
- // set icon
- $site_module_info = Context::get('site_module_info');
- $oAdminModel = getAdminModel('admin');
- $favicon_url = $oAdminModel->getFaviconUrl($site_module_info->domain_srl);
- $mobicon_url = $oAdminModel->getMobileIconUrl($site_module_info->domain_srl);
- Context::set('favicon_url', $favicon_url);
- Context::set('mobicon_url', $mobicon_url);
// convert the final layout
Context::set('content', $output);
@@ -581,6 +582,7 @@ class HTMLDisplayHandler
Context::loadFile(array('./common/css/rhymix.less', '', '', -1600000000), true);
$original_file_list = array(
'plugins/jquery.migrate/jquery-migrate-1.4.1.min.js',
+ 'plugins/cookie/js.cookie.min.js',
'plugins/blankshield/blankshield.min.js',
'plugins/uri/URI.min.js',
'x.js',
diff --git a/classes/extravar/Extravar.class.php b/classes/extravar/Extravar.class.php
index 803c77bf3..ae7751652 100644
--- a/classes/extravar/Extravar.class.php
+++ b/classes/extravar/Extravar.class.php
@@ -209,7 +209,7 @@ class ExtraItem
{
$value = 'http://' . $value;
}
- return htmlspecialchars($value, ENT_COMPAT | ENT_HTML401, 'UTF-8', false);
+ return escape($value, false);
case 'tel' :
if(is_array($value))
@@ -232,7 +232,7 @@ class ExtraItem
$values = array_values($values);
for($i = 0, $c = count($values); $i < $c; $i++)
{
- $values[$i] = trim(htmlspecialchars($values[$i], ENT_COMPAT | ENT_HTML401, 'UTF-8', false));
+ $values[$i] = trim(escape($values[$i], false));
}
return $values;
@@ -259,7 +259,7 @@ class ExtraItem
$values = array_values($values);
for($i = 0, $c = count($values); $i < $c; $i++)
{
- $values[$i] = trim(htmlspecialchars($values[$i], ENT_COMPAT | ENT_HTML401, 'UTF-8', false));
+ $values[$i] = trim(escape($values[$i], false));
}
return $values;
@@ -280,7 +280,7 @@ class ExtraItem
$values = array_values($values);
for($i = 0, $c = count($values); $i < $c; $i++)
{
- $values[$i] = trim(htmlspecialchars($values[$i], ENT_COMPAT | ENT_HTML401, 'UTF-8', false));
+ $values[$i] = trim(escape($values[$i], false));
}
return $values;
@@ -290,7 +290,7 @@ class ExtraItem
//case 'textarea' :
//case 'password' :
default :
- return htmlspecialchars($value, ENT_COMPAT | ENT_HTML401, 'UTF-8', false);
+ return escape($value, false);
}
}
@@ -404,7 +404,7 @@ class ExtraItem
// Temporary ID for labeling
$tmp_id = $column_name . '-' . $id_num++;
- $buff[] ='