Skip to content

Commit 2f50365

Browse files
slackeroslackero
committed
Updated composer packages, updated release date
- symfony/polyfill-php80 (v1.31.0 => v1.32.0) - symfony/polyfill-mbstring (v1.31.0 => v1.32.0) - league/commonmark (2.6.2 => 2.7.0) - phpmailer/phpmailer (v6.9.3 => v6.10.0) - roave/security-advisories (dev-latest 6c54d20 => dev-latest c6007a5) - symfony/polyfill-php73 (v1.31.0 => v1.32.0) - symfony/polyfill-php74 (v1.31.0 => v1.32.0) - symfony/polyfill-php81 (v1.31.0 => v1.32.0) - symfony/polyfill-php82 (v1.31.0 => v1.32.0) - symfony/polyfill-php83 (v1.31.0 => v1.32.0)
1 parent 07e14bb commit 2f50365

21 files changed

Lines changed: 467 additions & 177 deletions

File tree

‎composer.json‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,20 @@
1111
"algo26-matthias/idna-convert": "^v3.2.0",
1212
"enshrined/svg-sanitize": "^0.21.0",
1313
"netcarver/textile": "v4.1.3",
14-
"league/commonmark": "^2.6.2",
14+
"league/commonmark": "^2.7.0",
1515
"ezyang/htmlpurifier": "^v4.18.0",
1616
"openpsa/universalfeedcreator": "^v1.9.0",
17-
"phpmailer/phpmailer": "^v6.9.3",
17+
"phpmailer/phpmailer": "^v6.10.0",
1818
"phpoffice/phpspreadsheet": "^1.29.10",
1919
"simplepie/simplepie": "@dev",
2020
"html2text/html2text": "^4.3.2",
21-
"symfony/polyfill-mbstring": "^v1.31.0",
22-
"symfony/polyfill-php73": "^v1.31.0",
23-
"symfony/polyfill-php74": "^v1.31.0",
24-
"symfony/polyfill-php80": "^v1.31.0",
25-
"symfony/polyfill-php81": "^v1.31.0",
26-
"symfony/polyfill-php82": "^v1.31.0",
27-
"symfony/polyfill-php83": "^v1.31.0",
21+
"symfony/polyfill-mbstring": "^v1.32.0",
22+
"symfony/polyfill-php73": "^v1.32.0",
23+
"symfony/polyfill-php74": "^v1.32.0",
24+
"symfony/polyfill-php80": "^v1.32.0",
25+
"symfony/polyfill-php81": "^v1.32.0",
26+
"symfony/polyfill-php82": "^v1.32.0",
27+
"symfony/polyfill-php83": "^v1.32.0",
2828
"ext-intl": "*",
2929
"ext-gd": "*",
3030
"ext-mysqli": "*",

‎include/inc_lib/revision/revision.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@
1010
**/
1111

1212
const PHPWCMS_VERSION = '1.9.46-dev';
13-
const PHPWCMS_RELEASE_DATE = '2025/04/12';
13+
const PHPWCMS_RELEASE_DATE = '2025/06/02';
1414
const PHPWCMS_REVISION = '553';

‎include/vendor/composer/installed.json‎

Lines changed: 90 additions & 72 deletions
Large diffs are not rendered by default.

‎include/vendor/composer/installed.php‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
'name' => '__root__',
44
'pretty_version' => 'dev-master',
55
'version' => 'dev-master',
6-
'reference' => 'f029b03ebedee1a850a7f007f69bb71541346310',
6+
'reference' => '07e14bb94f549f9fbe3ccd14dce86f81d77dd6c8',
77
'type' => 'library',
88
'install_path' => __DIR__ . '/../../../',
99
'aliases' => array(),
@@ -13,7 +13,7 @@
1313
'__root__' => array(
1414
'pretty_version' => 'dev-master',
1515
'version' => 'dev-master',
16-
'reference' => 'f029b03ebedee1a850a7f007f69bb71541346310',
16+
'reference' => '07e14bb94f549f9fbe3ccd14dce86f81d77dd6c8',
1717
'type' => 'library',
1818
'install_path' => __DIR__ . '/../../../',
1919
'aliases' => array(),
@@ -83,9 +83,9 @@
8383
'dev_requirement' => false,
8484
),
8585
'league/commonmark' => array(
86-
'pretty_version' => '2.6.2',
87-
'version' => '2.6.2.0',
88-
'reference' => '06c3b0bf2540338094575612f4a1778d0d2d5e94',
86+
'pretty_version' => '2.7.0',
87+
'version' => '2.7.0.0',
88+
'reference' => '6fbb36d44824ed4091adbcf4c7d4a3923cdb3405',
8989
'type' => 'library',
9090
'install_path' => __DIR__ . '/../league/commonmark',
9191
'aliases' => array(),
@@ -173,9 +173,9 @@
173173
'dev_requirement' => false,
174174
),
175175
'phpmailer/phpmailer' => array(
176-
'pretty_version' => 'v6.9.3',
177-
'version' => '6.9.3.0',
178-
'reference' => '2f5c94fe7493efc213f643c23b1b1c249d40f47e',
176+
'pretty_version' => 'v6.10.0',
177+
'version' => '6.10.0.0',
178+
'reference' => 'bf74d75a1fde6beaa34a0ddae2ec5fce0f72a144',
179179
'type' => 'library',
180180
'install_path' => __DIR__ . '/../phpmailer/phpmailer',
181181
'aliases' => array(),
@@ -238,7 +238,7 @@
238238
'roave/security-advisories' => array(
239239
'pretty_version' => 'dev-latest',
240240
'version' => 'dev-latest',
241-
'reference' => '6c54d20ae795b83ecf3f826311d7f488cd1ef005',
241+
'reference' => 'c6007a53027047b08044448c57571988ac9b6e93',
242242
'type' => 'metapackage',
243243
'install_path' => null,
244244
'aliases' => array(
@@ -267,62 +267,62 @@
267267
'dev_requirement' => false,
268268
),
269269
'symfony/polyfill-mbstring' => array(
270-
'pretty_version' => 'v1.31.0',
271-
'version' => '1.31.0.0',
272-
'reference' => '85181ba99b2345b0ef10ce42ecac37612d9fd341',
270+
'pretty_version' => 'v1.32.0',
271+
'version' => '1.32.0.0',
272+
'reference' => '6d857f4d76bd4b343eac26d6b539585d2bc56493',
273273
'type' => 'library',
274274
'install_path' => __DIR__ . '/../symfony/polyfill-mbstring',
275275
'aliases' => array(),
276276
'dev_requirement' => false,
277277
),
278278
'symfony/polyfill-php73' => array(
279-
'pretty_version' => 'v1.31.0',
280-
'version' => '1.31.0.0',
279+
'pretty_version' => 'v1.32.0',
280+
'version' => '1.32.0.0',
281281
'reference' => '0f68c03565dcaaf25a890667542e8bd75fe7e5bb',
282282
'type' => 'library',
283283
'install_path' => __DIR__ . '/../symfony/polyfill-php73',
284284
'aliases' => array(),
285285
'dev_requirement' => false,
286286
),
287287
'symfony/polyfill-php74' => array(
288-
'pretty_version' => 'v1.31.0',
289-
'version' => '1.31.0.0',
288+
'pretty_version' => 'v1.32.0',
289+
'version' => '1.32.0.0',
290290
'reference' => '9589537d05325fb5d88a20d8926823e5b827a43e',
291291
'type' => 'library',
292292
'install_path' => __DIR__ . '/../symfony/polyfill-php74',
293293
'aliases' => array(),
294294
'dev_requirement' => false,
295295
),
296296
'symfony/polyfill-php80' => array(
297-
'pretty_version' => 'v1.31.0',
298-
'version' => '1.31.0.0',
299-
'reference' => '60328e362d4c2c802a54fcbf04f9d3fb892b4cf8',
297+
'pretty_version' => 'v1.32.0',
298+
'version' => '1.32.0.0',
299+
'reference' => '0cc9dd0f17f61d8131e7df6b84bd344899fe2608',
300300
'type' => 'library',
301301
'install_path' => __DIR__ . '/../symfony/polyfill-php80',
302302
'aliases' => array(),
303303
'dev_requirement' => false,
304304
),
305305
'symfony/polyfill-php81' => array(
306-
'pretty_version' => 'v1.31.0',
307-
'version' => '1.31.0.0',
306+
'pretty_version' => 'v1.32.0',
307+
'version' => '1.32.0.0',
308308
'reference' => '4a4cfc2d253c21a5ad0e53071df248ed48c6ce5c',
309309
'type' => 'library',
310310
'install_path' => __DIR__ . '/../symfony/polyfill-php81',
311311
'aliases' => array(),
312312
'dev_requirement' => false,
313313
),
314314
'symfony/polyfill-php82' => array(
315-
'pretty_version' => 'v1.31.0',
316-
'version' => '1.31.0.0',
315+
'pretty_version' => 'v1.32.0',
316+
'version' => '1.32.0.0',
317317
'reference' => '5d2ed36f7734637dacc025f179698031951b1692',
318318
'type' => 'library',
319319
'install_path' => __DIR__ . '/../symfony/polyfill-php82',
320320
'aliases' => array(),
321321
'dev_requirement' => false,
322322
),
323323
'symfony/polyfill-php83' => array(
324-
'pretty_version' => 'v1.31.0',
325-
'version' => '1.31.0.0',
324+
'pretty_version' => 'v1.32.0',
325+
'version' => '1.32.0.0',
326326
'reference' => '2fb86d65e2d424369ad2905e83b236a8805ba491',
327327
'type' => 'library',
328328
'install_path' => __DIR__ . '/../symfony/polyfill-php83',

‎include/vendor/league/commonmark/CHANGELOG.md‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,17 @@ Updates should follow the [Keep a CHANGELOG](https://keepachangelog.com/) princi
66

77
## [Unreleased][unreleased]
88

9+
## [2.7.0]
10+
11+
This is a **security release** to address a potential cross-site scripting (XSS) vulnerability when using the `AttributesExtension` with untrusted user input.
12+
13+
### Added
14+
- Added `attributes/allow` config option to specify which attributes users are allowed to set on elements (default allows virtually all attributes)
15+
16+
### Changed
17+
- The `AttributesExtension` blocks all attributes starting with `on` unless explicitly allowed via the `attributes/allow` config option
18+
- The `allow_unsafe_links` option is now respected by the `AttributesExtension` when users specify `href` and `src` attributes
19+
920
## [2.6.2] - 2025-04-18
1021

1122
### Fixed
@@ -689,7 +700,8 @@ No changes were introduced since the previous release.
689700
- Alternative 1: Use `CommonMarkConverter` or `GithubFlavoredMarkdownConverter` if you don't need to customize the environment
690701
- Alternative 2: Instantiate a new `Environment` and add the necessary extensions yourself
691702

692-
[unreleased]: https://github.com/thephpleague/commonmark/compare/2.6.1...2.6.2
703+
[unreleased]: https://github.com/thephpleague/commonmark/compare/2.7.0...HEAD
704+
[2.7.0]: https://github.com/thephpleague/commonmark/compare/2.6.2...2.7.0
693705
[2.6.2]: https://github.com/thephpleague/commonmark/compare/2.6.1...2.6.2
694706
[2.6.1]: https://github.com/thephpleague/commonmark/compare/2.6.0...2.6.1
695707
[2.6.0]: https://github.com/thephpleague/commonmark/compare/2.5.3...2.6.0

‎include/vendor/league/commonmark/composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@
115115
},
116116
"extra": {
117117
"branch-alias": {
118-
"dev-main": "2.7-dev"
118+
"dev-main": "2.8-dev"
119119
}
120120
},
121121
"config": {

‎include/vendor/league/commonmark/src/Extension/Attributes/AttributesExtension.php‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,26 @@
1919
use League\CommonMark\Extension\Attributes\Event\AttributesListener;
2020
use League\CommonMark\Extension\Attributes\Parser\AttributesBlockStartParser;
2121
use League\CommonMark\Extension\Attributes\Parser\AttributesInlineParser;
22-
use League\CommonMark\Extension\ExtensionInterface;
22+
use League\CommonMark\Extension\ConfigurableExtensionInterface;
23+
use League\Config\ConfigurationBuilderInterface;
24+
use Nette\Schema\Expect;
2325

24-
final class AttributesExtension implements ExtensionInterface
26+
final class AttributesExtension implements ConfigurableExtensionInterface
2527
{
28+
public function configureSchema(ConfigurationBuilderInterface $builder): void
29+
{
30+
$builder->addSchema('attributes', Expect::structure([
31+
'allow' => Expect::arrayOf('string')->default([]),
32+
]));
33+
}
34+
2635
public function register(EnvironmentBuilderInterface $environment): void
2736
{
37+
$allowList = $environment->getConfiguration()->get('attributes.allow');
38+
$allowUnsafeLinks = $environment->getConfiguration()->get('allow_unsafe_links');
39+
2840
$environment->addBlockStartParser(new AttributesBlockStartParser());
2941
$environment->addInlineParser(new AttributesInlineParser());
30-
$environment->addEventListener(DocumentParsedEvent::class, [new AttributesListener(), 'processDocument']);
42+
$environment->addEventListener(DocumentParsedEvent::class, [new AttributesListener($allowList, $allowUnsafeLinks), 'processDocument']);
3143
}
3244
}

‎include/vendor/league/commonmark/src/Extension/Attributes/Event/AttributesListener.php‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,19 @@ final class AttributesListener
2929
private const DIRECTION_PREFIX = 'prefix';
3030
private const DIRECTION_SUFFIX = 'suffix';
3131

32+
/** @var list<string> */
33+
private array $allowList;
34+
private bool $allowUnsafeLinks;
35+
36+
/**
37+
* @param list<string> $allowList
38+
*/
39+
public function __construct(array $allowList = [], bool $allowUnsafeLinks = true)
40+
{
41+
$this->allowList = $allowList;
42+
$this->allowUnsafeLinks = $allowUnsafeLinks;
43+
}
44+
3245
public function processDocument(DocumentParsedEvent $event): void
3346
{
3447
foreach ($event->getDocument()->iterator() as $node) {
@@ -50,7 +63,7 @@ public function processDocument(DocumentParsedEvent $event): void
5063
$attributes = AttributesHelper::mergeAttributes($node->getAttributes(), $target);
5164
}
5265

53-
$target->data->set('attributes', $attributes);
66+
$target->data->set('attributes', AttributesHelper::filterAttributes($attributes, $this->allowList, $this->allowUnsafeLinks));
5467
}
5568

5669
$node->detach();

‎include/vendor/league/commonmark/src/Extension/Attributes/Util/AttributesHelper.php‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,4 +139,42 @@ public static function mergeAttributes($attributes1, $attributes2): array
139139

140140
return $attributes;
141141
}
142+
143+
/**
144+
* @param array<string, mixed> $attributes
145+
* @param list<string> $allowList
146+
*
147+
* @return array<string, mixed>
148+
*/
149+
public static function filterAttributes(array $attributes, array $allowList, bool $allowUnsafeLinks): array
150+
{
151+
$allowList = \array_fill_keys($allowList, true);
152+
153+
foreach ($attributes as $name => $value) {
154+
$attrNameLower = \strtolower($name);
155+
156+
// Remove any unsafe links
157+
if (! $allowUnsafeLinks && ($attrNameLower === 'href' || $attrNameLower === 'src') && \is_string($value) && RegexHelper::isLinkPotentiallyUnsafe($value)) {
158+
unset($attributes[$name]);
159+
continue;
160+
}
161+
162+
// No allowlist?
163+
if ($allowList === []) {
164+
// Just remove JS event handlers
165+
if (\str_starts_with($attrNameLower, 'on')) {
166+
unset($attributes[$name]);
167+
}
168+
169+
continue;
170+
}
171+
172+
// Remove any attributes not in that allowlist (case-sensitive)
173+
if (! isset($allowList[$name])) {
174+
unset($attributes[$name]);
175+
}
176+
}
177+
178+
return $attributes;
179+
}
142180
}

‎include/vendor/phpmailer/phpmailer/.editorconfig‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

0 commit comments

Comments
 (0)