mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-03-23 09:00:48 +01:00
Code Issues Releases Wiki Activity

Merge pull request #53 from phpbb/ticket/security/243

Browse Source 
[ticket/security/243] Fail silently on unsupported values for font size
This commit is contained in:
Marc Alexander 2019-08-31 21:31:25 +02:00
commit 01e64dbc9c
No known key found for this signature in database
GPG Key ID: 50E0D2423696F995
2 changed files with 1 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
phpBB/language/en/posting.php
View File

@ -140,7 +140,6 @@ $lang = array_merge($lang, array(
'IMAGES_ARE_OFF' => '[img] is <em>OFF</em>',
'IMAGES_ARE_ON' => '[img] is <em>ON</em>',
'INVALID_FILENAME' => '%s is an invalid filename.',
'INVALID_FONT_SIZE' => 'The font size you supplied is invalid: %s',
'LOAD' => 'Load',
'LOAD_DRAFT' => 'Load draft',

13
phpBB/phpbb/textformatter/s9e/parser.php
View File

@ -228,10 +228,6 @@ class parser implements \phpbb\textformatter\parser_interface
{
$errors[] = array($msg);
}
else if ($msg === 'INVALID_FONT_SIZE')
{
$errors[] = [$msg, $context['invalid_size']];
}
}
// Deduplicate error messages. array_unique() only works on strings so we have to serialize
@ -339,13 +335,6 @@ class parser implements \phpbb\textformatter\parser_interface
*/
static public function filter_font_size($size, $max_size, Logger $logger)
{
if (!is_numeric($size))
{
$logger->err('INVALID_FONT_SIZE', ['invalid_size' => htmlspecialchars($size)]);
return false;
}
if ($max_size && $size > $max_size)
{
$logger->err('MAX_FONT_SIZE_EXCEEDED', array('max_size' => $max_size));
@ -353,7 +342,7 @@ class parser implements \phpbb\textformatter\parser_interface
return false;
}
if ($size < 1)
if ($size < 1 || !is_numeric($size))
{
return false;
}