mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-08-13 18:14:26 +02:00
Code Issues Releases Wiki Activity

Fix all PHP 8.1 test failures

Browse Source 
* `strftime()` has been replaced with a polyfill based on `DateTime`.
* Explicit type casts/assertions added where required by PHP 8.1
* `filter_var(…, FILTER_SANITIZE_STRING)` replaced with `strip_tags()`
  or HTML entity encoding of quotation marks, depending on a guess of
  what the intended "sanitization" was
* `http_build_query()` usage type mismatches fixed
* Removed usages of the `FILE_TEXT` constant
* To avoid breaking PHP 5.6 compatibility (function return types),
  `e_session_db` no longer implements `SessionHandlerInterface`.
  Instead, the alternative non-OOP invocation of
  `session_set_save_handler()` is used instead to apply the session
  handler.
* The shim for `strptime()` still calls the native function if available
  but now suppresses the deprecation warning.

* `e_db_pdo` explicitly asks for `PDO::ATTR_STRINGIFY_FETCHES` to
  maintain consistent behavior with past versions of PHP.
* `e_db_mysql` explicitly sets `mysqli_report(MYSQLI_REPORT_OFF)` to
  maintain consistent behavior with past versions of PHP.

* Removed pointless random number generator seed from `banner` plugin
* Workaround for `COUNT(*)` SQL query in
  `validatorClass::dbValidateArray()` without a proper API for avoiding
  SQL injection
This commit is contained in:
Nick Liu
2021-09-04 15:06:19 +02:00
parent 64cd796605
commit 20882920a0
54 changed files with 295 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
e107_handlers/e_parse_class.php
View File

@@ -508,7 +508,7 @@ class e_parse
foreach($data as $key => $var)
{
//Fix - sanitize keys as well
$key = filter_var($key, FILTER_SANITIZE_STRING);
$key = str_replace(['"', "'"], ['"', '''], $key);
$ret[$key] = $this->toDB($var, $nostrip, $no_encode, $mod, $parm);
}
@@ -787,6 +787,8 @@ class e_parse
return $arr;
}
$text = (string) $text;
if(MAGIC_QUOTES_GPC == true)
{
$text = stripslashes($text);
@@ -2003,6 +2005,7 @@ class e_parse
*/
public function toText($text)
{
$text = (string) $text;
if($this->isBBcode($text) === true) // convert any bbcodes to html
{
@@ -2338,6 +2341,7 @@ class e_parse
*/
public function thumbUrl($url = null, $options = array(), $raw = false, $full = false)
{
$url = (string) $url;
$this->staticCount++; // increment counter.
@@ -3717,7 +3721,7 @@ class e_parse
$parm = $options;
$options = varset($parm['space'], '');
}
elseif(strpos($options, '='))
elseif (is_string($options) && strpos($options, '='))
{
parse_str($options, $parm);
$options = varset($parm['space'], '');
@@ -4618,7 +4622,7 @@ class e_parse
$ytpref['cc_lang_pref'] = e_LAN; // switch captions with chosen user language.
}
$ytqry = http_build_query($ytpref, null, '&');
$ytqry = http_build_query($ytpref, '', '&');
$defClass = !empty($this->bootstrap) ? 'embed-responsive embed-responsive-16by9 ratio ratio-16x9' : 'video-responsive'; // levacy backup.
@@ -4848,7 +4852,7 @@ class e_parse
{
$filterTypes = array(
'int' => FILTER_SANITIZE_NUMBER_INT,
'str' => FILTER_SANITIZE_STRING, // no html.
'str' => function($input) { return strip_tags($input); },
'email' => FILTER_SANITIZE_EMAIL,
'url' => FILTER_SANITIZE_URL,
'enc' => FILTER_SANITIZE_ENCODED
@@ -4870,13 +4874,19 @@ class e_parse
trigger_error("Unsupported type '".$type."' used in e107::getParser()->filter().", E_USER_WARNING);
}
if(is_array($text))
$filter = $filterTypes[$type];
$filter = function($element) use ($filter)
{
$ret = filter_var_array($text, $filterTypes[$type]);
$element = (string) $element;
return is_callable($filter) ? $filter($element) : filter_var($element, $filter);
};
if (is_array($text))
{
$ret = filter_var($text, FILTER_CALLBACK, ['options' => $filter]);
}
else
{
$ret = filter_var($text, $filterTypes[$type]);
$ret = $filter($text);
}
}