From: ArthurHoaro <arthur@hoa.ro>
Date: Wed, 31 May 2017 15:52:19 +0000 (+0200)
Subject: Merge pull request #880 from ArthurHoaro/hotfix/allowed-protocols
X-Git-Tag: v0.9.1~1^2~24
X-Git-Url: https://git.immae.eu/?a=commitdiff_plain;h=ac94db1e36c77d52c316b5fa4e8e36b9d1e38b9e;hp=-c;p=github%2Fshaarli%2FShaarli.git

Merge pull request #880 from ArthurHoaro/hotfix/allowed-protocols

Add a whitelist of protocols for URLs
---

ac94db1e36c77d52c316b5fa4e8e36b9d1e38b9e
diff --combined index.php
index 92eb443b,944af674..823eb8de
--- a/index.php
+++ b/index.php
@@@ -790,9 -790,7 +790,9 @@@ function renderPage($conf, $pluginManag
      // -------- Tag cloud
      if ($targetPage == Router::$PAGE_TAGCLOUD)
      {
 -        $tags= $LINKSDB->allTags();
 +        $visibility = ! empty($_SESSION['privateonly']) ? 'private' : 'all';
 +        $filteringTags = isset($_GET['searchtags']) ? explode(' ', $_GET['searchtags']) : [];
 +        $tags = $LINKSDB->linksCountPerTag($filteringTags, $visibility);
  
          // We sort tags alphabetically, then choose a font size according to count.
          // First, find max value.
@@@ -801,7 -799,17 +801,7 @@@
              $maxcount = max($maxcount, $value);
          }
  
 -        // Sort tags alphabetically: case insensitive, support locale if available.
 -        uksort($tags, function($a, $b) {
 -            // Collator is part of PHP intl.
 -            if (class_exists('Collator')) {
 -                $c = new Collator(setlocale(LC_COLLATE, 0));
 -                if (!intl_is_failure(intl_get_error_code())) {
 -                    return $c->compare($a, $b);
 -                }
 -            }
 -            return strcasecmp($a, $b);
 -        });
 +        alphabetical_sort($tags, true, true);
  
          $tagList = array();
          foreach($tags as $key => $value) {
@@@ -816,7 -824,6 +816,7 @@@
          }
  
          $data = array(
 +            'search_tags' => implode(' ', $filteringTags),
              'tags' => $tagList,
          );
          $pluginManager->executeHooks('render_tagcloud', $data, array('loggedin' => isLoggedIn()));
@@@ -825,32 -832,7 +825,32 @@@
              $PAGE->assign($key, $value);
          }
  
 -        $PAGE->renderPage('tagcloud');
 +        $PAGE->renderPage('tag.cloud');
 +        exit;
 +    }
 +
 +    // -------- Tag cloud
 +    if ($targetPage == Router::$PAGE_TAGLIST)
 +    {
 +        $visibility = ! empty($_SESSION['privateonly']) ? 'private' : 'all';
 +        $filteringTags = isset($_GET['searchtags']) ? explode(' ', $_GET['searchtags']) : [];
 +        $tags = $LINKSDB->linksCountPerTag($filteringTags, $visibility);
 +
 +        if (! empty($_GET['sort']) && $_GET['sort'] === 'alpha') {
 +            alphabetical_sort($tags, false, true);
 +        }
 +
 +        $data = [
 +            'search_tags' => implode(' ', $filteringTags),
 +            'tags' => $tags,
 +        ];
 +        $pluginManager->executeHooks('render_taglist', $data, ['loggedin' => isLoggedIn()]);
 +
 +        foreach ($data as $key => $value) {
 +            $PAGE->assign($key, $value);
 +        }
 +
 +        $PAGE->renderPage('tag.list');
          exit;
      }
  
@@@ -1167,7 -1149,6 +1167,7 @@@
      if ($targetPage == Router::$PAGE_CHANGETAG)
      {
          if (empty($_POST['fromtag']) || (empty($_POST['totag']) && isset($_POST['renametag']))) {
 +            $PAGE->assign('fromtag', ! empty($_GET['fromtag']) ? escape($_GET['fromtag']) : '');
              $PAGE->renderPage('changetag');
              exit;
          }
@@@ -1256,13 -1237,7 +1256,7 @@@
          // Remove duplicates.
          $tags = implode(' ', array_unique(explode(' ', $tags)));
  
-         $url = trim($_POST['lf_url']);
-         if (! startsWith($url, 'http:') && ! startsWith($url, 'https:')
-             && ! startsWith($url, 'ftp:') && ! startsWith($url, 'magnet:')
-             && ! startsWith($url, '?') && ! startsWith($url, 'javascript:')
-         ) {
-             $url = 'http://' . $url;
-         }
+         $url = whitelist_protocols(trim($_POST['lf_url']), $conf->get('security.allowed_protocols'));
  
          $link = array(
              'id' => $id,
@@@ -1327,21 -1302,18 +1321,21 @@@
      // -------- User clicked the "Delete" button when editing a link: Delete link from database.
      if ($targetPage == Router::$PAGE_DELETELINK)
      {
 -        // We do not need to ask for confirmation:
 -        // - confirmation is handled by JavaScript
 -        // - we are protected from XSRF by the token.
 -
          if (! tokenOk($_GET['token'])) {
              die('Wrong token.');
          }
  
 -        $id = intval(escape($_GET['lf_linkdate']));
 -        $link = $LINKSDB[$id];
 -        $pluginManager->executeHooks('delete_link', $link);
 -        unset($LINKSDB[$id]);
 +        if (strpos($_GET['lf_linkdate'], ' ') !== false) {
 +            $ids = array_values(array_filter(preg_split('/\s+/', escape($_GET['lf_linkdate']))));
 +        } else {
 +            $ids = [$_GET['lf_linkdate']];
 +        }
 +        foreach ($ids as $id) {
 +            $id = (int) escape($id);
 +            $link = $LINKSDB[$id];
 +            $pluginManager->executeHooks('delete_link', $link);
 +            unset($LINKSDB[$id]);
 +        }
          $LINKSDB->save($conf->get('resource.page_cache')); // save to disk
          $history->deleteLink($link);
  
@@@ -1373,7 -1345,7 +1367,7 @@@
              'link' => $link,
              'link_is_new' => false,
              'http_referer' => (isset($_SERVER['HTTP_REFERER']) ? escape($_SERVER['HTTP_REFERER']) : ''),
 -            'tags' => $LINKSDB->allTags(),
 +            'tags' => $LINKSDB->linksCountPerTag(),
          );
          $pluginManager->executeHooks('render_editlink', $data);
  
@@@ -1442,7 -1414,7 +1436,7 @@@
              'link_is_new' => $link_is_new,
              'http_referer' => (isset($_SERVER['HTTP_REFERER']) ? escape($_SERVER['HTTP_REFERER']) : ''),
              'source' => (isset($_GET['source']) ? $_GET['source'] : ''),
 -            'tags' => $LINKSDB->allTags(),
 +            'tags' => $LINKSDB->linksCountPerTag(),
              'default_private_links' => $conf->get('privacy.default_private_links', false),
          );
          $pluginManager->executeHooks('render_editlink', $data);
@@@ -1598,13 -1570,6 +1592,13 @@@
          exit;
      }
  
 +    // Get a fresh token
 +    if ($targetPage == Router::$GET_TOKEN) {
 +        header('Content-Type:text/plain');
 +        echo getToken($conf);
 +        exit;
 +    }
 +
      // -------- Otherwise, simply display search form and links:
      showLinkList($PAGE, $LINKSDB, $conf, $pluginManager);
      exit;
@@@ -1622,15 -1587,7 +1616,15 @@@
  function buildLinkList($PAGE,$LINKSDB, $conf, $pluginManager)
  {
      // Used in templates
 -    $searchtags = !empty($_GET['searchtags']) ? escape(normalize_spaces($_GET['searchtags'])) : '';
 +    if (isset($_GET['searchtags'])) {
 +        if (! empty($_GET['searchtags'])) {
 +            $searchtags = escape(normalize_spaces($_GET['searchtags']));
 +        } else {
 +            $searchtags = false;
 +        }
 +    } else {
 +        $searchtags = '';
 +    }
      $searchterm = !empty($_GET['searchterm']) ? escape(normalize_spaces($_GET['searchterm'])) : '';
  
      // Smallhash filter
@@@ -1645,11 -1602,7 +1639,11 @@@
      } else {
          // Filter links according search parameters.
          $visibility = ! empty($_SESSION['privateonly']) ? 'private' : 'all';
 -        $linksToDisplay = $LINKSDB->filterSearch($_GET, false, $visibility);
 +        $request = [
 +            'searchtags' => $searchtags,
 +            'searchterm' => $searchterm,
 +        ];
 +        $linksToDisplay = $LINKSDB->filterSearch($request, false, $visibility);
      }
  
      // ---- Handle paging.
@@@ -1696,7 -1649,7 +1690,7 @@@
      }
  
      // Compute paging navigation
 -    $searchtagsUrl = empty($searchtags) ? '' : '&searchtags=' . urlencode($searchtags);
 +    $searchtagsUrl = $searchtags === '' ? '' : '&searchtags=' . urlencode($searchtags);
      $searchtermUrl = empty($searchterm) ? '' : '&searchterm=' . urlencode($searchterm);
      $previous_page_url = '';
      if ($i != count($keys)) {