mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-07-25 17:01:43 +02:00
Code Issues Releases Wiki Activity

Restore htmlspecialchars() for e_parse::filter(…, 'str')

Browse Source 
Fixes regression from 20882920a0 where
data would get inserted into the database with literal quotation marks,
but e107 has always expected `"` and `'` to come directly from
the database
This commit is contained in:
Nick Liu
2021-10-06 13:03:08 -05:00
parent d4d0a74858
commit 19f48180dc
2 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
e107_handlers/e_parse_class.php
View File

@@ -4800,8 +4800,17 @@ class e_parse
/**
* Filters/Validates using the PHP5 filter_var() method.
*
* @param string|array $text
* @param string $type string str|int|email|url|w|wds|file
* @param string $type str|int|email|url|w|wds|file
*
* If the type is "str" (default), HTML tags are stripped, and quotation marks are escaped for
* HTML with the intention of making the string safe to use in both concatenated SQL queries and
* HTML code.
*
* Despite the intention, strings returned by this function should still be specified as values
* in SQL prepared statements or surrounded by {@see mysqli_real_escape_string()} if the string
* is to be written to the database.
* @return string|boolean| array
*/
public function filter($text, $type = 'str', $validate = false)
@@ -4859,7 +4868,10 @@ class e_parse
{
$filterTypes = array(
'int' => FILTER_SANITIZE_NUMBER_INT,
'str' => function($input) { return strip_tags($input); },
'str' => function($input)
{
return htmlspecialchars(strip_tags($input), ENT_QUOTES);
},
'email' => FILTER_SANITIZE_EMAIL,
'url' => FILTER_SANITIZE_URL,
'enc' => FILTER_SANITIZE_ENCODED

15
e107_tests/tests/unit/e_parseTest.php
View File

@@ -2589,7 +2589,22 @@ Your browser does not support the audio tag.
}
/**
* e107 v0.6.0 requires strings to be passed around with quotation marks escaped for HTML as a way to prevent
* both SQL injection and cross-site scripting. Although {@see e_parse::toDB()} is supposed to do that, some
* usages, specifically {@see e_front_model::sanitizeValue()} call {@see e_parse::filter()} instead.
*
* @version 2.3.1
*/
public function testFilterStr()
{
$input = "<strong>\"e107's\"</strong>";
$expected = "&quot;e107&#039;s&quot;";
$actual = $this->tp->filter($input, 'str');
$this->assertEquals($expected, $actual);
}
public function testCleanHtml()
{