From cbc75befb5bdf368bec15f47413bd7669273a181 Mon Sep 17 00:00:00 2001 From: Maryana Rozhankivska Date: Fri, 30 May 2014 17:14:53 +0300 Subject: small xss vulnerability and translation ability fix --- inc/poche/Poche.class.php | 41 ++++++++++++++++++++--------------------- 1 file changed, 20 insertions(+), 21 deletions(-) (limited to 'inc') diff --git a/inc/poche/Poche.class.php b/inc/poche/Poche.class.php index 37cf66a3..b0c0adf8 100755 --- a/inc/poche/Poche.class.php +++ b/inc/poche/Poche.class.php @@ -1083,11 +1083,10 @@ class Poche $config = $this->store->getConfigUser($user_id); if ($config == null) { - die(_('User with this id (' . $user_id . ') does not exist.')); + die(_( sprintf('User with this id (%d) does not exist.', $user_id) )); } - if (!in_array($type, $allowed_types) || - $token != $config['token']) { + if (!in_array($type, $allowed_types) || $token != $config['token']) { die(_('Uh, there is a problem while generating feeds.')); } // Check the token @@ -1150,12 +1149,12 @@ class Poche return new HTMLPurifier($config); } - + /** * handle epub */ public function createEpub() { - + switch ($_GET['method']) { case 'id': $entryID = filter_var($_GET['id'],FILTER_SANITIZE_NUMBER_INT); @@ -1191,7 +1190,7 @@ class Poche break; case 'default': die(_('Uh, there is a problem while generating epub.')); - + } $content_start = @@ -1204,11 +1203,11 @@ class Poche . "\n"; $bookEnd = "\n\n"; - + $log = new Logger("wallabag", TRUE); $fileDir = CACHE; - + $book = new EPub(EPub::BOOK_VERSION_EPUB3); $log->logLine("new EPub()"); $log->logLine("EPub class version: " . EPub::VERSION); @@ -1216,7 +1215,7 @@ class Poche $log->logLine("Zip version: " . Zip::VERSION); $log->logLine("getCurrentServerURL: " . $book->getCurrentServerURL()); $log->logLine("getCurrentPageURL..: " . $book->getCurrentPageURL()); - + $book->setTitle(_('wallabag\'s articles')); $book->setIdentifier("http://$_SERVER[HTTP_HOST]", EPub::IDENTIFIER_URI); // Could also be the ISBN number, prefered for published books, or a UUID. //$book->setLanguage("en"); // Not needed, but included for the example, Language is mandatory, but EPub defaults to "en". Use RFC3066 Language codes, such as "en", "da", "fr" etc. @@ -1226,39 +1225,39 @@ class Poche $book->setDate(time()); // Strictly not needed as the book date defaults to time(). //$book->setRights("Copyright and licence information specific for the book."); // As this is generated, this _could_ contain the name or licence information of the user who purchased the book, if needed. If this is used that way, the identifier must also be made unique for the book. $book->setSourceURL("http://$_SERVER[HTTP_HOST]"); - + $book->addDublinCoreMetadata(DublinCore::CONTRIBUTOR, "PHP"); $book->addDublinCoreMetadata(DublinCore::CONTRIBUTOR, "wallabag"); - + $cssData = "body {\n margin-left: .5em;\n margin-right: .5em;\n text-align: justify;\n}\n\np {\n font-family: serif;\n font-size: 10pt;\n text-align: justify;\n text-indent: 1em;\n margin-top: 0px;\n margin-bottom: 1ex;\n}\n\nh1, h2 {\n font-family: sans-serif;\n font-style: italic;\n text-align: center;\n background-color: #6b879c;\n color: white;\n width: 100%;\n}\n\nh1 {\n margin-bottom: 2px;\n}\n\nh2 {\n margin-top: -2px;\n margin-bottom: 2px;\n}\n"; - + $log->logLine("Add Cover"); - + $fullTitle = "

" . $bookTitle . "

\n"; - + $book->setCoverImage("Cover.png", file_get_contents("themes/baggy/img/apple-touch-icon-152.png"), "image/png", $fullTitle); - + $cover = $content_start . '

' . _('Produced by wallabag with PHPePub') . '

'. _('Please open an issue if you have trouble with the display of this E-Book on your device.') . '

' . $bookEnd; - + //$book->addChapter("Table of Contents", "TOC.xhtml", NULL, false, EPub::EXTERNAL_REF_IGNORE); $book->addChapter("Notices", "Cover2.html", $cover); - + $book->buildTOC(); - + foreach ($entries as $entry) { //set tags as subjects $tags = $this->store->retrieveTagsByEntry($entry['id']); foreach ($tags as $tag) { $book->setSubject($tag['value']); } - + $log->logLine("Set up parameters"); - + $chapter = $content_start . $entry['content'] . $bookEnd; $book->addChapter($entry['title'], htmlspecialchars($entry['title']) . ".html", $chapter, true, EPub::EXTERNAL_REF_ADD); $log->logLine("Added chapter " . $entry['title']); } - if (DEBUG_POCHE) { + if (DEBUG_POCHE) { $epuplog = $book->getLog(); $book->addChapter("Log", "Log.html", $content_start . $log->getLog() . "\n" . $bookEnd); // log generation } -- cgit v1.2.3 From 30bd273580a326db1fcc7263e1f52948672f9848 Mon Sep 17 00:00:00 2001 From: Maryana Rozhankivska Date: Fri, 30 May 2014 17:17:34 +0300 Subject: small xss vulnerability and translation ability fix --- inc/poche/Poche.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'inc') diff --git a/inc/poche/Poche.class.php b/inc/poche/Poche.class.php index b0c0adf8..3d1337f3 100755 --- a/inc/poche/Poche.class.php +++ b/inc/poche/Poche.class.php @@ -1083,7 +1083,7 @@ class Poche $config = $this->store->getConfigUser($user_id); if ($config == null) { - die(_( sprintf('User with this id (%d) does not exist.', $user_id) )); + die(sprintf(_('User with this id (%d) does not exist.'), $user_id)); } if (!in_array($type, $allowed_types) || $token != $config['token']) { -- cgit v1.2.3 From 1d14e653156399ef4759df3c0f39cebc5ee0102e Mon Sep 17 00:00:00 2001 From: Maryana Rozhankivska Date: Sun, 1 Jun 2014 19:49:22 +0300 Subject: fix of undefined ATOM constant warning in full-text-rss, will fix ios-app issue #14 --- inc/3rdparty/libraries/feedwriter/FeedWriter.php | 1 + 1 file changed, 1 insertion(+) (limited to 'inc') diff --git a/inc/3rdparty/libraries/feedwriter/FeedWriter.php b/inc/3rdparty/libraries/feedwriter/FeedWriter.php index aa064afb..9446cddf 100755 --- a/inc/3rdparty/libraries/feedwriter/FeedWriter.php +++ b/inc/3rdparty/libraries/feedwriter/FeedWriter.php @@ -2,6 +2,7 @@ define('RSS2', 1, true); define('JSON', 2, true); define('JSONP', 3, true); +define('ATOM', 4, true); /** * Univarsel Feed Writer class -- cgit v1.2.3 From 752cd4a8ef7bbc8ebd6c481ed890e0d8e46819a8 Mon Sep 17 00:00:00 2001 From: Maryana Rozhankivska Date: Mon, 2 Jun 2014 18:00:09 +0300 Subject: error reporting level set in E_ALL & ~E_NOTICE by default, can be overriden in config --- inc/3rdparty/makefulltextfeed.php | 2 +- inc/poche/Tools.class.php | 4 +--- inc/poche/config.inc.default.php | 4 ++++ 3 files changed, 6 insertions(+), 4 deletions(-) (limited to 'inc') diff --git a/inc/3rdparty/makefulltextfeed.php b/inc/3rdparty/makefulltextfeed.php index 7a56be8c..62c050ec 100755 --- a/inc/3rdparty/makefulltextfeed.php +++ b/inc/3rdparty/makefulltextfeed.php @@ -28,7 +28,7 @@ along with this program. If not, see . // Request this file passing it a web page or feed URL in the querystring: makefulltextfeed.php?url=example.org/article // For more request parameters, see http://help.fivefilters.org/customer/portal/articles/226660-usage -error_reporting(E_ALL ^ E_NOTICE); +//error_reporting(E_ALL ^ E_NOTICE); ini_set("display_errors", 1); @set_time_limit(120); diff --git a/inc/poche/Tools.class.php b/inc/poche/Tools.class.php index 8073a3fe..1ef875c9 100755 --- a/inc/poche/Tools.class.php +++ b/inc/poche/Tools.class.php @@ -18,8 +18,6 @@ class Tools die(_('Oops, it seems you don\'t have PHP 5.')); } - error_reporting(E_ALL); - function stripslashesDeep($value) { return is_array($value) ? array_map('stripslashesDeep', $value) @@ -64,7 +62,7 @@ class Tools if (strpos($host, ':') !== false) { $serverport = ''; } - + return 'http' . ($https ? 's' : '') . '://' . $host . $serverport . $scriptname; } diff --git a/inc/poche/config.inc.default.php b/inc/poche/config.inc.default.php index ffcd205d..95f727c6 100755 --- a/inc/poche/config.inc.default.php +++ b/inc/poche/config.inc.default.php @@ -30,6 +30,10 @@ @define ('MODE_DEMO', FALSE); @define ('DEBUG_POCHE', FALSE); + +//default level of error reporting in application. Developers should override it in their config.inc.php: set to E_ALL. +@define ('ERROR_REPORTING', E_ALL & ~E_NOTICE); + @define ('DOWNLOAD_PICTURES', FALSE); # This can slow down the process of adding articles @define ('REGENERATE_PICTURES_QUALITY', 75); @define ('CONVERT_LINKS_FOOTNOTES', FALSE); -- cgit v1.2.3 From ec15d0a784a84e07b284c76e71fd8496e00559d5 Mon Sep 17 00:00:00 2001 From: tcit Date: Sat, 7 Jun 2014 15:53:39 +0200 Subject: do not debug inside an epub --- inc/3rdparty/libraries/PHPePub/EPub.php | 8 +++++++- inc/poche/Poche.class.php | 10 +++++----- 2 files changed, 12 insertions(+), 6 deletions(-) (limited to 'inc') diff --git a/inc/3rdparty/libraries/PHPePub/EPub.php b/inc/3rdparty/libraries/PHPePub/EPub.php index f1f41bd5..d9b990b7 100644 --- a/inc/3rdparty/libraries/PHPePub/EPub.php +++ b/inc/3rdparty/libraries/PHPePub/EPub.php @@ -41,6 +41,8 @@ class EPub { private $bookVersion = EPub::BOOK_VERSION_EPUB2; + private $debugInside = FALSE; + public $maxImageWidth = 768; public $maxImageHeight = 1024; @@ -132,10 +134,14 @@ class EPub { * * @return void */ - function __construct($bookVersion = EPub::BOOK_VERSION_EPUB2, $languageCode = "en", $writingDirection = EPub::DIRECTION_LEFT_TO_RIGHT) { + function __construct($bookVersion = EPub::BOOK_VERSION_EPUB2, $debugInside = FALSE, $languageCode = "en", $writingDirection = EPub::DIRECTION_LEFT_TO_RIGHT) { include_once("Zip.php"); include_once("Logger.php"); + if (!$debugInside) { + error_reporting(E_ERROR | E_PARSE); + } + $this->bookVersion = $bookVersion; $this->writingDirection = $writingDirection; $this->languageCode = $languageCode; diff --git a/inc/poche/Poche.class.php b/inc/poche/Poche.class.php index 1b69cd61..4139c4f4 100755 --- a/inc/poche/Poche.class.php +++ b/inc/poche/Poche.class.php @@ -1142,11 +1142,11 @@ class Poche * return new purifier object with actual config */ protected function getPurifier() { - $config = HTMLPurifier_Config::createDefault(); - $config->set('Cache.SerializerPath', CACHE); - $config->set('HTML.SafeIframe', true); + $config = HTMLPurifier_Config::createDefault(); + $config->set('Cache.SerializerPath', CACHE); + $config->set('HTML.SafeIframe', true); $config->set('URI.SafeIframeRegexp', '%^(https?:)?//(www\.youtube(?:-nocookie)?\.com/embed/|player\.vimeo\.com/video/)%'); //allow YouTube and Vimeo$purifier = new HTMLPurifier($config); - + return new HTMLPurifier($config); } @@ -1208,7 +1208,7 @@ class Poche $fileDir = CACHE; - $book = new EPub(EPub::BOOK_VERSION_EPUB3); + $book = new EPub(EPub::BOOK_VERSION_EPUB3, DEBUG_POCHE); $log->logLine("new EPub()"); $log->logLine("EPub class version: " . EPub::VERSION); $log->logLine("EPub Req. Zip version: " . EPub::REQ_ZIP_VERSION); -- cgit v1.2.3 From aa126ba458a02e8b1e43b15fc28f550ee72a9619 Mon Sep 17 00:00:00 2001 From: Maryana Rozhankivska Date: Wed, 25 Jun 2014 19:34:14 +0300 Subject: fix of issue #718: Error parsing file imported from Pocket #718 --- inc/3rdparty/simple_html_dom.php | 105 ++++++++++++++++++++++++--------------- 1 file changed, 65 insertions(+), 40 deletions(-) mode change 100644 => 100755 inc/3rdparty/simple_html_dom.php (limited to 'inc') diff --git a/inc/3rdparty/simple_html_dom.php b/inc/3rdparty/simple_html_dom.php old mode 100644 new mode 100755 index 43b94e57..9b73b105 --- a/inc/3rdparty/simple_html_dom.php +++ b/inc/3rdparty/simple_html_dom.php @@ -34,7 +34,7 @@ * @author S.C. Chen * @author John Schlick * @author Rus Carroll - * @version 1.5 ($Rev: 202 $) + * @version 1.5 ($Rev: 210 $) * @package PlaceLocalInclude * @subpackage simple_html_dom */ @@ -269,7 +269,10 @@ class simple_html_dom_node { return $this->children; } - if (isset($this->children[$idx])) return $this->children[$idx]; + if (isset($this->children[$idx])) + { + return $this->children[$idx]; + } return null; } @@ -330,14 +333,14 @@ class simple_html_dom_node function find_ancestor_tag($tag) { global $debug_object; - if (is_object($debug_object)) { $debug_object->debugLogEntry(1); } + if (is_object($debug_object)) { $debug_object->debug_log_entry(1); } // Start by including ourselves in the comparison. $returnDom = $this; while (!is_null($returnDom)) { - if (is_object($debug_object)) { $debug_object->debugLog(2, "Current tag is: " . $returnDom->tag); } + if (is_object($debug_object)) { $debug_object->debug_log(2, "Current tag is: " . $returnDom->tag); } if ($returnDom->tag == $tag) { @@ -374,7 +377,7 @@ class simple_html_dom_node $text = " with text: " . $this->text; } } - $debug_object->debugLog(1, 'Innertext of tag: ' . $this->tag . $text); + $debug_object->debug_log(1, 'Innertext of tag: ' . $this->tag . $text); } if ($this->tag==='root') return $this->innertext(); @@ -532,7 +535,9 @@ class simple_html_dom_node foreach ($head as $k=>$v) { if (!isset($found_keys[$k])) + { $found_keys[$k] = 1; + } } } @@ -554,7 +559,7 @@ class simple_html_dom_node protected function seek($selector, &$ret, $lowercase=false) { global $debug_object; - if (is_object($debug_object)) { $debug_object->debugLogEntry(1); } + if (is_object($debug_object)) { $debug_object->debug_log_entry(1); } list($tag, $key, $val, $exp, $no_key) = $selector; @@ -615,7 +620,7 @@ class simple_html_dom_node // this is a normal search, we want the value of that attribute of the tag. $nodeKeyValue = $node->attr[$key]; } - if (is_object($debug_object)) {$debug_object->debugLog(2, "testing node: " . $node->tag . " for attribute: " . $key . $exp . $val . " where nodes value is: " . $nodeKeyValue);} + if (is_object($debug_object)) {$debug_object->debug_log(2, "testing node: " . $node->tag . " for attribute: " . $key . $exp . $val . " where nodes value is: " . $nodeKeyValue);} //PaperG - If lowercase is set, do a case insensitive test of the value of the selector. if ($lowercase) { @@ -623,7 +628,7 @@ class simple_html_dom_node } else { $check = $this->match($exp, $val, $nodeKeyValue); } - if (is_object($debug_object)) {$debug_object->debugLog(2, "after match: " . ($check ? "true" : "false"));} + if (is_object($debug_object)) {$debug_object->debug_log(2, "after match: " . ($check ? "true" : "false"));} // handle multiple class if (!$check && strcasecmp($key, 'class')===0) { @@ -645,12 +650,12 @@ class simple_html_dom_node unset($node); } // It's passed by reference so this is actually what this function returns. - if (is_object($debug_object)) {$debug_object->debugLog(1, "EXIT - ret: ", $ret);} + if (is_object($debug_object)) {$debug_object->debug_log(1, "EXIT - ret: ", $ret);} } protected function match($exp, $pattern, $value) { global $debug_object; - if (is_object($debug_object)) {$debug_object->debugLogEntry(1);} + if (is_object($debug_object)) {$debug_object->debug_log_entry(1);} switch ($exp) { case '=': @@ -672,7 +677,7 @@ class simple_html_dom_node protected function parse_selector($selector_string) { global $debug_object; - if (is_object($debug_object)) {$debug_object->debugLogEntry(1);} + if (is_object($debug_object)) {$debug_object->debug_log_entry(1);} // pattern of CSS selectors, modified from mootools // Paperg: Add the colon to the attrbute, so that it properly finds like google does. @@ -683,7 +688,7 @@ class simple_html_dom_node // $pattern = "/([\w-:\*]*)(?:\#([\w-]+)|\.([\w-]+))?(?:\[@?(!?[\w-]+)(?:([!*^$]?=)[\"']?(.*?)[\"']?)?\])?([\/, ]+)/is"; $pattern = "/([\w-:\*]*)(?:\#([\w-]+)|\.([\w-]+))?(?:\[@?(!?[\w-:]+)(?:([!*^$]?=)[\"']?(.*?)[\"']?)?\])?([\/, ]+)/is"; preg_match_all($pattern, trim($selector_string).' ', $matches, PREG_SET_ORDER); - if (is_object($debug_object)) {$debug_object->debugLog(2, "Matches Array: ", $matches);} + if (is_object($debug_object)) {$debug_object->debug_log(2, "Matches Array: ", $matches);} $selectors = array(); $result = array(); @@ -718,12 +723,14 @@ class simple_html_dom_node return $selectors; } - function __get($name) { + function __get($name) + { if (isset($this->attr[$name])) { return $this->convert_text($this->attr[$name]); } - switch ($name) { + switch ($name) + { case 'outertext': return $this->outertext(); case 'innertext': return $this->innertext(); case 'plaintext': return $this->text(); @@ -732,22 +739,30 @@ class simple_html_dom_node } } - function __set($name, $value) { - switch ($name) { + function __set($name, $value) + { + global $debug_object; + if (is_object($debug_object)) {$debug_object->debug_log_entry(1);} + + switch ($name) + { case 'outertext': return $this->_[HDOM_INFO_OUTER] = $value; case 'innertext': if (isset($this->_[HDOM_INFO_TEXT])) return $this->_[HDOM_INFO_TEXT] = $value; return $this->_[HDOM_INFO_INNER] = $value; } - if (!isset($this->attr[$name])) { + if (!isset($this->attr[$name])) + { $this->_[HDOM_INFO_SPACE][] = array(' ', '', ''); $this->_[HDOM_INFO_QUOTE][] = HDOM_QUOTE_DOUBLE; } $this->attr[$name] = $value; } - function __isset($name) { - switch ($name) { + function __isset($name) + { + switch ($name) + { case 'outertext': return true; case 'innertext': return true; case 'plaintext': return true; @@ -765,7 +780,7 @@ class simple_html_dom_node function convert_text($text) { global $debug_object; - if (is_object($debug_object)) {$debug_object->debugLogEntry(1);} + if (is_object($debug_object)) {$debug_object->debug_log_entry(1);} $converted_text = $text; @@ -777,7 +792,7 @@ class simple_html_dom_node $sourceCharset = strtoupper($this->dom->_charset); $targetCharset = strtoupper($this->dom->_target_charset); } - if (is_object($debug_object)) {$debug_object->debugLog(3, "source charset: " . $sourceCharset . " target charaset: " . $targetCharset);} + if (is_object($debug_object)) {$debug_object->debug_log(3, "source charset: " . $sourceCharset . " target charaset: " . $targetCharset);} if (!empty($sourceCharset) && !empty($targetCharset) && (strcasecmp($sourceCharset, $targetCharset) != 0)) { @@ -1045,10 +1060,10 @@ class simple_html_dom // prepare $this->prepare($str, $lowercase, $stripRN, $defaultBRText, $defaultSpanText); - // strip out comments - $this->remove_noise("''is"); // strip out cdata $this->remove_noise("''is", true); + // strip out comments + $this->remove_noise("''is"); // Per sourceforge http://sourceforge.net/tracker/?func=detail&aid=2949097&group_id=218559&atid=1044037 // Script tags removal now preceeds style tag removal. // strip out