Skip to content

Commit a8b49f4

Browse files
slackeroslackero
committed
Release phpwcms v1.9.46, the legacy version
Merge branch 'v1.9-dev' into phpwcms-legacy
2 parents 21d8fbf + c8edf97 commit a8b49f4

55 files changed

Lines changed: 1528 additions & 260 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ root or sub folder. Link your browser to the related URL and follow the install
2626
Server system requirements
2727
--------------------------
2828

29-
**phpwcms** version 1.9.45 requires a web server with PHP 7.4 or newer.
29+
**phpwcms** version 1.9.46 requires a web server with PHP 7.4 or newer.
3030
and a MySQL/MariaDB database (minimum version 5.1, recommend 5.5+).
3131
If you already use PHP v8.x you should use the latest version of
3232
[**phpwcms v1.10**](https://github.com/slackero/phpwcms/releases?q=1.10&expanded=true).

‎composer.json‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,23 +11,26 @@
1111
"algo26-matthias/idna-convert": "^v3.2.0",
1212
"enshrined/svg-sanitize": "^0.21.0",
1313
"netcarver/textile": "v4.1.3",
14-
"league/commonmark": "^2.6.1",
14+
"league/commonmark": "^2.7.0",
1515
"ezyang/htmlpurifier": "^v4.18.0",
1616
"openpsa/universalfeedcreator": "^v1.9.0",
17-
"phpmailer/phpmailer": "^v6.9.3",
17+
"phpmailer/phpmailer": "^v6.10.0",
1818
"phpoffice/phpspreadsheet": "^1.29.10",
1919
"simplepie/simplepie": "@dev",
2020
"html2text/html2text": "^4.3.2",
21-
"symfony/polyfill-mbstring": "^v1.31.0",
22-
"symfony/polyfill-php73": "^v1.31.0",
23-
"symfony/polyfill-php74": "^v1.31.0",
24-
"symfony/polyfill-php80": "^v1.31.0",
25-
"symfony/polyfill-php81": "^v1.31.0",
26-
"symfony/polyfill-php82": "^v1.31.0",
27-
"symfony/polyfill-php83": "^v1.31.0",
21+
"symfony/polyfill-mbstring": "^v1.32.0",
22+
"symfony/polyfill-php73": "^v1.32.0",
23+
"symfony/polyfill-php74": "^v1.32.0",
24+
"symfony/polyfill-php80": "^v1.32.0",
25+
"symfony/polyfill-php81": "^v1.32.0",
26+
"symfony/polyfill-php82": "^v1.32.0",
27+
"symfony/polyfill-php83": "^v1.32.0",
2828
"ext-intl": "*",
2929
"ext-gd": "*",
3030
"ext-mysqli": "*",
3131
"ext-mbstring": "*"
32+
},
33+
"require-dev": {
34+
"roave/security-advisories": "dev-latest"
3235
}
3336
}

‎image_resized.php‎

Lines changed: 74 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -11,70 +11,93 @@
1111

1212
// <img src="image_resized.php?format=jpg&w=100&h=200&q=85&imgfile=test.jpg" alt="" border="0">
1313

14-
$img_target = (isset($_GET['format'])) ? strtolower(trim($_GET['format'])) : 'jpg';
15-
$img_file = (isset($_GET['imgfile'])) ? trim($_GET['imgfile']) : 'img/leer.gif';
16-
$img_width = (isset($_GET['w'])) ? intval($_GET['w']) : 0;
17-
$img_height = (isset($_GET['h'])) ? intval($_GET['h']) : 0;
18-
$img_quality= (isset($_GET['q']) && intval($_GET['q']) <= 100 && intval($_GET['q'])) ? intval($_GET['q']) : 75;
19-
20-
$img_file = str_replace(array('http://', 'https://'), '', $img_file);
21-
22-
switch($img_target) {
14+
$img_target = isset($_GET['format']) ? strtolower(trim($_GET['format'])) : 'jpg';
15+
$img_file = isset($_GET['imgfile']) ? trim(urldecode($_GET['imgfile'])) : 'img/leer.gif';
16+
$img_width = isset($_GET['w']) ? (int)$_GET['w'] : 0;
17+
$img_height = isset($_GET['h']) ? (int)$_GET['h'] : 0;
18+
$img_quality = isset($_GET['q']) && (int)$_GET['q'] <= 100 && (int)$_GET['q'] ? (int)$_GET['q'] : 75;
19+
$result = false;
20+
21+
// Ensure no protocol handlers (http://…) or something like C:\ or C:/ or ./ or ../ is part of the file name
22+
if (
23+
$img_file
24+
&&
25+
(
26+
$img_file[0] === '.'
27+
||
28+
$img_file[0] === '/'
29+
||
30+
$img_file[0] === '\\'
31+
||
32+
strpos($img_file, ':/') !== false
33+
||
34+
strpos($img_file, './') !== false
35+
||
36+
strpos($img_file, ':\\') !== false
37+
||
38+
strpos($img_file, '.\\') !== false
39+
)
40+
) {
41+
$img_file = '';
42+
} else {
43+
// Absolute path only related to the current directory
44+
$img_file = __DIR__ . '/' . $img_file;
45+
}
2346

47+
switch ($img_target) {
2448
case 'png':
25-
$img_mimetype = 'image/png';
26-
$img_target = 'jpg';
49+
$img_mimetype = 'image/png';
50+
$img_target = 'jpg';
2751
break;
2852

2953
case 'gif':
30-
if(function_exists('imagegif')) {
54+
if (function_exists('imagegif')) {
3155
$img_mimetype = 'image/gif';
32-
$img_target = 'gif';
56+
$img_target = 'gif';
3357
} else {
34-
$img_target = 'png';
58+
$img_target = 'png';
3559
$img_mimetype = 'image/png';
3660
}
3761
break;
3862

3963
case 'webp':
40-
$img_mimetype = 'image/webp';
41-
$img_target = 'webp';
64+
$img_mimetype = 'image/webp';
65+
$img_target = 'webp';
4266
break;
4367

4468
case 'jpeg':
4569
case 'jpg':
4670
default:
47-
$img_mimetype = 'image/jpeg';
48-
$img_target = 'jpg';
49-
71+
$img_mimetype = 'image/jpeg';
72+
$img_target = 'jpg';
5073
}
5174

52-
if(is_file($img_file) && $img_info = getimagesize($img_file)) {
75+
if ($img_file !== '' && is_readable($img_file) && $img_info = getimagesize($img_file)) {
5376

54-
if(!$img_width || $img_width >= $img_info[0]) {
77+
if (!$img_width || $img_width >= $img_info[0]) {
5578
$percent_width = 1;
5679
} else {
5780
$percent_width = $img_width / $img_info[0];
5881
}
5982

60-
if(!$img_height || $img_height >= $img_info[1]) {
83+
if (!$img_height || $img_height >= $img_info[1]) {
6184
$percent_height = 1;
6285
} else {
6386
$percent_height = $img_height / $img_info[1];
6487
}
6588

66-
if($percent_height < $percent_width) {
89+
if ($percent_height < $percent_width) {
6790
$percent = $percent_height;
68-
} elseif($percent_height > $percent_width) {
91+
} elseif ($percent_height > $percent_width) {
6992
$percent = $percent_width;
7093
} else {
7194
$percent = $percent_width;
7295
}
7396

74-
$img_width = $img_info[0] * $percent;
97+
$img_width = $img_info[0] * $percent;
7598
$img_height = $img_info[1] * $percent;
7699

77-
switch($img_target) {
100+
switch ($img_target) {
78101
case 'jpg':
79102
case 'png':
80103
case 'webp':
@@ -86,8 +109,7 @@
86109
break;
87110
}
88111

89-
switch($img_info[2]) {
90-
112+
switch ($img_info[2]) {
91113
case IMAGETYPE_GIF: // GIF
92114
$img_source = imagecreatefromgif($img_file);
93115
break;
@@ -105,41 +127,37 @@
105127
break;
106128
}
107129

108-
imagecopyresized($new_img, $img_source, 0, 0, 0, 0, $img_width, $img_height, $img_info[0], $img_info[1]);
109-
110-
header('Content-type: '.$img_mimetype);
111-
112-
switch($img_target) {
113-
114-
case 'jpg':
115-
imagejpeg($new_img, NULL, $img_quality);
116-
break;
117-
118-
case 'webp':
119-
imagewebp($new_img, NULL, $img_quality);
120-
break;
121-
122-
case 'png':
123-
imagepng($new_img, NULL, 9);
124-
break;
125-
126-
case 'gif':
127-
imagegif($new_img);
128-
break;
129-
130+
$result = imagecopyresized($new_img, $img_source, 0, 0, 0, 0, $img_width, $img_height, $img_info[0], $img_info[1]);
131+
132+
if ($result) {
133+
header('Content-type: ' . $img_mimetype);
134+
135+
switch ($img_target) {
136+
case 'jpg':
137+
$result = imagejpeg($new_img, NULL, $img_quality);
138+
break;
139+
case 'webp':
140+
$result = imagewebp($new_img, NULL, $img_quality);
141+
break;
142+
case 'png':
143+
$result = imagepng($new_img, NULL, 9);
144+
break;
145+
case 'gif':
146+
$result = imagegif($new_img);
147+
break;
148+
}
130149
}
131150

132151
imagedestroy($new_img);
133152
imagedestroy($img_source);
153+
}
134154

135-
} else {
136-
137-
// error / no image
138-
header ('Content-type: image/png');
155+
// Error / no image
156+
if (!$result) {
157+
header('Content-type: image/png');
139158
$new_img = imagecreatetruecolor(75, 20);
140159
$text_color = imagecolorallocate($new_img, 255, 255, 255);
141-
imagestring($new_img, 1, 5, 5, "Image Error", $text_color);
160+
imagestring($new_img, 1, 5, 5, 'Image Error', $text_color);
142161
imagepng($new_img, NULL, 9);
143162
imagedestroy($new_img);
144-
145163
}

‎include/inc_front/content.func.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -461,7 +461,7 @@
461461
$sql .= "WHERE template_trash=0 ORDER BY template_default DESC LIMIT 1";
462462
$result = _dbQuery($sql);
463463
if(isset($result[0]['template_var'])) {
464-
$block = @unserialize($result[0]['template_var']);
464+
$block = @unserialize($result[0]['template_var'], ['allowed_classes' => false]);
465465
}
466466
}
467467

@@ -515,7 +515,7 @@
515515
$sql .= " LIMIT 1";
516516
$result = _dbQuery($sql);
517517
if(isset($result[0]['pagelayout_var'])) {
518-
$pagelayout = @unserialize($result[0]['pagelayout_var']);
518+
$pagelayout = @unserialize($result[0]['pagelayout_var'], ['allowed_classes' => false]);
519519
// if print action
520520
if($aktion[2] === 1) {
521521
$pagelayout = array(

‎include/inc_front/content/cnt0.article.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
$crow["acontent_template"] = render_cnt_template($crow["acontent_template"], 'TITLE', html_specialchars($crow['acontent_title']));
4141
$crow["acontent_template"] = render_cnt_template($crow["acontent_template"], 'SUBTITLE', html_specialchars($crow['acontent_subtitle']));
4242

43-
$crow["acontent_form"] = @unserialize($crow["acontent_form"]);
43+
$crow["acontent_form"] = @unserialize($crow["acontent_form"], ['allowed_classes' => false]);
4444
$crow["acontent_form"] = isset($crow["acontent_form"]['ctext_format']) ? $crow["acontent_form"]['ctext_format'] : 'plain';
4545

4646
switch($crow["acontent_form"]) {

‎include/inc_front/content/cnt13.article.inc.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,7 @@
278278

279279
case 29: $s_text .= ' '.$scrow['acontent_text'];
280280
case 2: if($content['search']['search_caption'] || $content['search']['search_filename']) {
281-
$scrow['acontent_form'] = @unserialize($scrow['acontent_form']);
281+
$scrow['acontent_form'] = @unserialize($scrow['acontent_form'], ['allowed_classes' => false]);
282282
if(isset($scrow['acontent_form']['images']) && is_array($scrow['acontent_form']['images']) && count($scrow['acontent_form']['images'])) {
283283
$s_imgname = '';
284284
foreach($scrow['acontent_form']['images'] as $s_imgtext) {
@@ -306,7 +306,7 @@
306306

307307
case 31: $s_text .= ' '.$scrow['acontent_html'];
308308
if($content['search']['search_caption'] || $content['search']['search_filename']) {
309-
$scrow['acontent_form'] = @unserialize($scrow['acontent_form']);
309+
$scrow['acontent_form'] = @unserialize($scrow['acontent_form'], ['allowed_classes' => false]);
310310
if(isset($scrow['acontent_form']['images']) && is_array($scrow['acontent_form']['images']) && count($scrow['acontent_form']['images'])) {
311311
foreach($scrow['acontent_form']['images'] as $s_imgtext) {
312312
if($content['search']['search_caption']) {
@@ -323,7 +323,7 @@
323323

324324
// search recipe
325325
case 26: $s_text .= ' '.$scrow['acontent_text'].' '.$scrow['acontent_html'];
326-
$scrow['acontent_form'] = @unserialize($scrow['acontent_form']);
326+
$scrow['acontent_form'] = @unserialize($scrow['acontent_form'], ['allowed_classes' => false]);
327327
if(isset($scrow['acontent_form']['preparation'])) {
328328
$s_text .= ' '.$scrow['acontent_form']['preparation'].' '.$scrow['acontent_form']['ingredients'];
329329
$s_text .= ' '.$scrow['acontent_form']['calorificvalue'].' '.$scrow['acontent_form']['calorificvalue_add'];

‎include/inc_front/content/cnt14.article.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
$crow["acontent_template"] = render_cnt_template($crow["acontent_template"], 'TITLE', html($crow['acontent_title']));
4141
$crow["acontent_template"] = render_cnt_template($crow["acontent_template"], 'SUBTITLE', html($crow['acontent_subtitle']));
4242

43-
$crow['custom_fields'] = empty($crow["acontent_form"]) ? null : @unserialize($crow["acontent_form"]);
43+
$crow['custom_fields'] = empty($crow["acontent_form"]) ? null : @unserialize($crow["acontent_form"], ['allowed_classes' => false]);
4444

4545
if(is_array($crow['custom_fields']) && !empty($crow["custom_fields"]['cnt_fields'])) {
4646

‎include/inc_front/content/cnt2.article.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
**/
1111

1212
//images (gallery)
13-
$image = @unserialize($crow["acontent_form"]);
13+
$image = @unserialize($crow["acontent_form"], ['allowed_classes' => false]);
1414

1515
if(is_array($image) && ($image_count = count($image))) {
1616

‎include/inc_front/content/cnt21.article.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
}
3535

3636
$CNT_TMP .= headline($crow['acontent_title'], $crow['acontent_subtitle'], $template_default['article']);
37-
$content['page_file'] = @unserialize($crow['acontent_form']);
37+
$content['page_file'] = @unserialize($crow['acontent_form'], ['allowed_classes' => false]);
3838
if(!empty($content['page_file']['source'])) {
3939
$CNT_TMP .= empty($content['page_file']['pfile']) ? '' : include_url($content['page_file']['pfile']);
4040
} elseif(!empty($content['page_file']['pfile'])) {

‎include/inc_front/content/cnt23.article.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
include_once PHPWCMS_ROOT.'/include/inc_front/content/cnt_functions/cnt23.func.inc.php';
2020

2121
// Form
22-
$cnt_form = unserialize($crow["acontent_form"]);
22+
$cnt_form = unserialize($crow["acontent_form"], ['allowed_classes' => false]);
2323

2424
if(empty($cnt_form['anchor_off'])) {
2525
$CNT_TMP .= '<a id="';
@@ -130,7 +130,7 @@
130130
$doubleoptin_error = true;
131131
} else {
132132
$doubleoptin_values = $doubleoptin_values[0];
133-
$doubleoptin_values['formresult_content'] = unserialize($doubleoptin_values['formresult_content']);
133+
$doubleoptin_values['formresult_content'] = unserialize($doubleoptin_values['formresult_content'], ['allowed_classes' => false]);
134134
if(empty($doubleoptin_values['formresult_content']['hash']) || $doubleoptin_values['formresult_content']['hash'] !== $_GET['hash']) {
135135
$doubleoptin_values = null;
136136
$doubleoptin_error = true;

0 commit comments

Comments
 (0)