Commit graph

2632 commits

Author SHA1 Message Date
Kijin Sung
e8f5c04df6
Merge pull request #1980 from bjrambo/pr/colorset-
관리자 페이지에서 사이트의 컬러 설정이 안먹는 문제 고침
2022-08-11 00:12:35 +09:00
Kijin Sung
e33a071f3e Add authoritative list of default plugins #1967 2022-08-06 13:30:48 +09:00
Johnny
6a47800917 관리자 페이지에서 사이트의 컬러 설정이 안먹는 문제 고침 2022-07-26 07:54:49 +09:00
Kijin Sung
1e27bae404 Fix not recognizing CSRF token submitted as part of JSON body 2022-07-25 14:05:01 +09:00
Kijin Sung
099d8397c9 Prevent path conversion of data: URL in <img> tag 2022-07-11 21:55:09 +09:00
Kijin Sung
ba0e0f07d1 Fix #1970 invalid default value for extravar of 'date' type 2022-07-04 22:10:56 +09:00
Kijin Sung
6e3c9a7c0e Merge branch 'security/pollskin' into develop 2022-07-04 00:46:36 +09:00
Kijin Sung
59a1215c87 Fix #1934 add 'default' option to domain timezone 2022-07-03 01:03:00 +09:00
Kijin Sung
a5f056284c Fix #1936 don't convert date-only timestamps in extra vars and member birthday column 2022-07-03 00:45:35 +09:00
Kijin Sung
e258cf7525 Fix #1926 add @charset UTF-8 to beginning of concatenated CSS file 2022-07-02 23:55:45 +09:00
Kijin Sung
1c33529377 RVE-2022-3 filter tpl_path in TemplateHandler class
- $tpl_path에 템플릿 문법으로 오인할 수 있는 특수문자가 포함된 경우 삭제
- path traversal은 여기에서 방어하지 않음
2022-06-29 15:36:23 +09:00
Kijin Sung
0f3f3a6bfa Prevent deprecation warning about dynamic properties in PHP 8.2 2022-06-27 16:18:10 +09:00
Kijin Sung
a823d604de Fix #1905 array to string conversion in Extravar.class.php 2022-04-25 02:21:40 +09:00
dewekk
3de0a17170
날짜 확장변수에서 자동 완성 기능과 겹치는 문제 수정 2022-04-18 15:41:41 +09:00
Kijin Sung
5e2d517296 Fix incorrect parsing of JSON request body containing multiple levels of objects 2022-03-28 15:33:21 +09:00
Kijin Sung
65dd68f9f3 Merge branch 'security/opage' into develop 2022-03-16 10:29:43 +09:00
Kijin Sung
9ce7593820 Fix error when loading external page in document root folder 2022-03-16 00:54:10 +09:00
Kijin Sung
b91fb3ee7a Fix error when using a namespaced module with forwarded action from another module 2022-03-15 16:42:06 +09:00
Kijin Sung
f373e38d6d Fix #1893 duplicate function call when loop="" template syntax is used 2022-03-14 01:53:27 +09:00
conory
34c46a08c6 Correct the URL regex 2022-02-21 21:11:42 +09:00
Kijin Sung
0c31234e09 Fix isset(), unset() and empty() not working in template syntax 2022-02-16 13:15:31 +09:00
Kijin Sung
7e82d37cfa Fix PHP warnings due to unitiated variables #1866 thanks to @Erictoby 2022-02-04 01:41:56 +09:00
Kijin Sung
70cfe24cdd Use $this->user instead of $logged_info more consistently #1866 2022-02-04 01:19:30 +09:00
Kijin Sung
29c851d124 Fix #1855 incorrect type hint in comment for XeXmlParser 2022-01-27 21:43:05 +09:00
Kijin Sung
8310f82a1a Fix #1856 missing IDN support in URL validator 2022-01-27 21:37:19 +09:00
Kijin Sung
4ac3d91ef0 Set $kind = 'admin' if class name of action contains 'admin' 2021-12-31 00:26:13 +09:00
conory
8644227a03 움직이는 webp 이미지를 처리하지 못하면서 발생하는 오류 수정
TypeError #0 "imagecopyresampled(): Argument #2 ($src_image) must be of type GdImage, bool given" in modules/document/document.item.php on line 1247 (via classes/file/FileHandler.class.php on line 661)
2021-12-24 18:56:47 +09:00
Kijin Sung
abacd82a6c Fix error when namespaced module (empty type) is used with forwarded action (e.g. file upload) 2021-12-20 16:22:28 +09:00
Kijin Sung
51173863c1 Support calling namespaced class in trigger 2021-12-13 15:21:42 +09:00
Kijin Sung
ae44f26bc5 Fix fatal error in PHP 8.0 when thumbnail size is not given as integer 2021-11-22 15:01:28 +09:00
Kijin Sung
093fa43e37 Fix incorrect variable reference 2021-11-02 20:58:20 +09:00
Kijin Sung
454d2d85ff Fix #1790 duplicate .html extension in TemplateHandler error message 2021-09-28 02:03:07 +09:00
Kijin Sung
22ff33d795 Remove unnecessary 'e' in class name #1791 2021-09-28 01:49:25 +09:00
Kijin Sung
546149a8c0 Fix duplicate class attribute #1791 2021-09-28 01:44:01 +09:00
Kijin Sung
1f1e01917e Support success and error callbacks in rx_ajax submissions using iframe 2021-09-13 10:57:55 +09:00
Kijin Sung
f3918d792a Add rx_ev_* classes to all extra var input fields
서드파티 자료에서 확장변수 입력란 디자인을 커스터마이징하기 쉽도록
각 확장변수의 타입에 맞는 rx_ev_* 클래스를 추가해 주도록 함.
예: 한줄 입력란은 rx_ev_text, 체크박스 컨테이너(ul/div)는 rx_ev_checkbox 등
2021-09-13 01:32:55 +09:00
Kijin Sung
263dc79090 Use https in AJAX URL if site is accessed over https
https를 사용하지 않는 것으로 설정되어 있더라도 실제로 https로 접속했다면
https를 사용하는 것으로 간주하고, AJAX URL을 https로 생성하도록 합니다.

기대되는 효과:

1. 설정이 잘못되어서 로그인이 되지 않거나 AJAX 요청에 실패할 가능성 제거
2. https 접속이 가능한 사이트라면 최대한 https를 사용하도록 유도
2021-09-13 01:10:36 +09:00
Kijin Sung
15c43f13d2 Add option to disable automatically adding hidden inputs for mid, act, error-return-url to forms 2021-08-26 01:09:45 +09:00
Kijin Sung
7367ad2645 Support HTTP status codes 301, 302, 303, 307, 308 when setting redirect URL 2021-08-13 15:55:56 +09:00
Kijin Sung
9b085df3b4 Fix incorrect rewrite level after module=admin (#1643 regression)
https://xetown.com/questions/1600064
2021-08-09 10:34:13 +09:00
Johnny
f4d51ee69b
Merge pull request #1762 from wstackme/fix/extra-vars-timezone
Fix unclosed select tag of select timezone
2021-08-04 16:18:01 +09:00
Ji Yong, Kim
49b7cbd657
Fix unclosed select tag of select timezone 2021-08-04 03:29:50 +09:00
Chanyoung Oh
d3ee5083f0
Change ModuleHandler to update value of is_mobile when calling Mobile::setMobile (#1746) 2021-07-16 10:00:57 +09:00
conory
faea821e78 Fix warning in PHP 8.0 2021-07-05 14:19:06 +09:00
Kijin Sung
ef2cdb56b0 Fix warning in PHP 8.0 2021-07-01 15:16:12 +09:00
Kijin Sung
f1c839042c Fix warning in PHP 8.0 2021-07-01 14:39:47 +09:00
Kijin Sung
d78ba8c77c Fix #1734 out-of-order loading of external CSS resource 2021-07-01 14:36:35 +09:00
Kijin Sung
664a68fc2a Fix #1727 Recompile SCSS/LESS files when imported file is changed
- import된 파일 목록을 따로 보관해 두었다가, 그 중 하나라도 변경되었다면 다시 컴파일
- PHP의 stat cache 덕분에 성능 영향은 크지 않을 것으로 보이나, 모니터링 필요
2021-06-20 22:02:26 +09:00
Kijin Sung
93fa7a46ce Fix FileHandler::checkMemoryLoadImage() returning false if memory_limit is actually unlimited 2021-06-19 23:16:08 +09:00
Kijin Sung
633bc340e7 Fix #1707 support thumbnail height value of 'auto' in any type 2021-06-19 23:11:59 +09:00