diff --git a/build/build_changelog.php b/build/build_changelog.php index d794251dda..b2efdaaea7 100755 --- a/build/build_changelog.php +++ b/build/build_changelog.php @@ -45,7 +45,7 @@ foreach ($xml->xpath('//item') as $item) $keyUrl = 'https://tracker.phpbb.com/browse/' . $key; $keyLink = '' . $key . ''; - $value = str_replace($key, $keyLink, htmlspecialchars($item->title)); + $value = str_replace($key, $keyLink, htmlspecialchars($item->title, ENT_COMPAT)); $value = str_replace(']', '] -', $value); $types[(string) $item->type][$key] = $value; diff --git a/phpBB/develop/create_variable_overview.php b/phpBB/develop/create_variable_overview.php index 3aebebcd94..e9e812ab88 100644 --- a/phpBB/develop/create_variable_overview.php +++ b/phpBB/develop/create_variable_overview.php @@ -220,7 +220,7 @@ foreach ($files_to_parse as $file_num => $data) { $_var = str_replace(array('{', '}'), array('', ''), $var); $lang_references[$_var][] = $data['single_filename']; - $lang_data .= '
  • ' . $var . '
    ' . "\n" . ((isset($lang[$_var])) ? htmlspecialchars(str_replace("\\'", "'", $lang[$_var])) : 'No Language Variable available') . '

    • ' . "\n"; + $lang_data .= '
  • ' . $var . '
    ' . "\n" . ((isset($lang[$_var])) ? htmlspecialchars(str_replace("\\'", "'", $lang[$_var]), ENT_COMPAT) : 'No Language Variable available') . '

    • ' . "\n"; } } $lang_data .= ''; diff --git a/phpBB/develop/imageset_to_css.php b/phpBB/develop/imageset_to_css.php index c25e414320..de66875d28 100644 --- a/phpBB/develop/imageset_to_css.php +++ b/phpBB/develop/imageset_to_css.php @@ -288,7 +288,7 @@ function dump_code($code, $filename = 'file.txt') $list = explode("\n", $code); $height = 15 * count($list); echo ' [ download expand ]
    '; - echo '
    '; + echo '
    '; } function css($list, $path = './', $bidi = false) diff --git a/phpBB/includes/acp/acp_attachments.php b/phpBB/includes/acp/acp_attachments.php index 3245d84231..91396b80fe 100644 --- a/phpBB/includes/acp/acp_attachments.php +++ b/phpBB/includes/acp/acp_attachments.php @@ -750,7 +750,7 @@ class acp_attachments continue; } - $filename_list .= ''; + $filename_list .= ''; } } diff --git a/phpBB/includes/acp/acp_bbcodes.php b/phpBB/includes/acp/acp_bbcodes.php index 28bb18037f..5706367ee3 100644 --- a/phpBB/includes/acp/acp_bbcodes.php +++ b/phpBB/includes/acp/acp_bbcodes.php @@ -62,7 +62,7 @@ class acp_bbcodes } $bbcode_match = $row['bbcode_match']; - $bbcode_tpl = htmlspecialchars($row['bbcode_tpl']); + $bbcode_tpl = htmlspecialchars($row['bbcode_tpl'], ENT_COMPAT); $display_on_posting = $row['display_on_posting']; $bbcode_helpline = $row['bbcode_helpline']; break; @@ -86,7 +86,7 @@ class acp_bbcodes $display_on_posting = $request->variable('display_on_posting', 0); $bbcode_match = $request->variable('bbcode_match', ''); - $bbcode_tpl = htmlspecialchars_decode($request->variable('bbcode_tpl', '', true)); + $bbcode_tpl = htmlspecialchars_decode($request->variable('bbcode_tpl', '', true), ENT_COMPAT); $bbcode_helpline = $request->variable('bbcode_helpline', '', true); break; } @@ -334,7 +334,7 @@ class acp_bbcodes 'action' => $action, 'bbcode' => $bbcode_id, 'bbcode_match' => $bbcode_match, - 'bbcode_tpl' => htmlspecialchars($bbcode_tpl), + 'bbcode_tpl' => htmlspecialchars($bbcode_tpl, ENT_COMPAT), 'bbcode_helpline' => $bbcode_helpline, 'display_on_posting' => $display_on_posting, ))) diff --git a/phpBB/includes/acp/acp_board.php b/phpBB/includes/acp/acp_board.php index 17460d3d89..ddf99a57b5 100644 --- a/phpBB/includes/acp/acp_board.php +++ b/phpBB/includes/acp/acp_board.php @@ -696,8 +696,8 @@ class acp_board $messenger->set_addresses($user->data); $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'USERNAME' => htmlspecialchars_decode($user->data['username']), - 'MESSAGE' => htmlspecialchars_decode($request->variable('send_test_email_text', '', true)), + 'USERNAME' => htmlspecialchars_decode($user->data['username'], ENT_COMPAT), + 'MESSAGE' => htmlspecialchars_decode($request->variable('send_test_email_text', '', true), ENT_COMPAT), )); $messenger->send(NOTIFY_EMAIL); diff --git a/phpBB/includes/acp/acp_email.php b/phpBB/includes/acp/acp_email.php index 5a1fbac9f6..720d58a078 100644 --- a/phpBB/includes/acp/acp_email.php +++ b/phpBB/includes/acp/acp_email.php @@ -205,7 +205,7 @@ class acp_email $email_template = 'admin_send_email'; $template_data = array( 'CONTACT_EMAIL' => phpbb_get_board_contact($config, $phpEx), - 'MESSAGE' => htmlspecialchars_decode($message), + 'MESSAGE' => htmlspecialchars_decode($message, ENT_COMPAT), ); $generate_log_entry = true; @@ -252,7 +252,7 @@ class acp_email $messenger->anti_abuse_headers($config, $user); - $messenger->subject(htmlspecialchars_decode($subject)); + $messenger->subject(htmlspecialchars_decode($subject, ENT_COMPAT)); $messenger->set_mail_priority($priority); $messenger->assign_vars($template_data); diff --git a/phpBB/includes/acp/acp_help_phpbb.php b/phpBB/includes/acp/acp_help_phpbb.php index 798cff5cee..4a1d965146 100644 --- a/phpBB/includes/acp/acp_help_phpbb.php +++ b/phpBB/includes/acp/acp_help_phpbb.php @@ -90,7 +90,7 @@ class acp_help_phpbb if (!empty($response)) { - $decoded_response = json_decode(htmlspecialchars_decode($response), true); + $decoded_response = json_decode(htmlspecialchars_decode($response, ENT_COMPAT), true); if ($decoded_response && isset($decoded_response['status']) && $decoded_response['status'] == 'ok') { @@ -126,7 +126,7 @@ class acp_help_phpbb } $template->assign_block_vars('providers', array( - 'NAME' => htmlspecialchars($provider), + 'NAME' => htmlspecialchars($provider, ENT_COMPAT), )); foreach ($data as $key => $value) diff --git a/phpBB/includes/acp/acp_icons.php b/phpBB/includes/acp/acp_icons.php index deb6886228..6429424983 100644 --- a/phpBB/includes/acp/acp_icons.php +++ b/phpBB/includes/acp/acp_icons.php @@ -693,7 +693,7 @@ class acp_icons foreach ($_paks as $pak) { - $pak_options .= ''; + $pak_options .= ''; } $template->assign_vars(array( diff --git a/phpBB/includes/acp/acp_inactive.php b/phpBB/includes/acp/acp_inactive.php index 4ee4cd4816..1ecd3c15b9 100644 --- a/phpBB/includes/acp/acp_inactive.php +++ b/phpBB/includes/acp/acp_inactive.php @@ -130,7 +130,7 @@ class acp_inactive $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'USERNAME' => htmlspecialchars_decode($row['username'])) + 'USERNAME' => htmlspecialchars_decode($row['username'], ENT_COMPAT)) ); $messenger->send(NOTIFY_EMAIL); @@ -224,7 +224,7 @@ class acp_inactive $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'USERNAME' => htmlspecialchars_decode($row['username']), + 'USERNAME' => htmlspecialchars_decode($row['username'], ENT_COMPAT), 'REGISTER_DATE' => $user->format_date($row['user_regdate'], false, true), 'U_ACTIVATE' => generate_board_url() . "/ucp.$phpEx?mode=activate&u=" . $row['user_id'] . '&k=' . $row['user_actkey']) ); diff --git a/phpBB/includes/acp/acp_language.php b/phpBB/includes/acp/acp_language.php index 8881f624e3..b2d732d4a8 100644 --- a/phpBB/includes/acp/acp_language.php +++ b/phpBB/includes/acp/acp_language.php @@ -274,7 +274,7 @@ class acp_language $lang_pack = array( 'iso' => $lang_iso, - 'name' => trim(htmlspecialchars($file[0])), + 'name' => trim(htmlspecialchars($file[0], ENT_COMPAT)), 'local_name'=> trim(htmlspecialchars($file[1], ENT_COMPAT, 'UTF-8')), 'author' => trim(htmlspecialchars($file[2], ENT_COMPAT, 'UTF-8')) ); @@ -420,7 +420,7 @@ class acp_language foreach ($new_ary as $iso => $lang_ary) { $template->assign_block_vars('notinst', array( - 'ISO' => htmlspecialchars($lang_ary['iso']), + 'ISO' => htmlspecialchars($lang_ary['iso'], ENT_COMPAT), 'LOCAL_NAME' => htmlspecialchars($lang_ary['local_name'], ENT_COMPAT, 'UTF-8'), 'NAME' => htmlspecialchars($lang_ary['name'], ENT_COMPAT, 'UTF-8'), 'U_INSTALL' => $this->u_action . '&action=install&iso=' . urlencode($lang_ary['iso']) . '&hash=' . generate_link_hash('acp_language')) diff --git a/phpBB/includes/acp/acp_logs.php b/phpBB/includes/acp/acp_logs.php index f9bb35791c..b98cd64f49 100644 --- a/phpBB/includes/acp/acp_logs.php +++ b/phpBB/includes/acp/acp_logs.php @@ -108,7 +108,7 @@ class acp_logs $sql_sort = $sort_by_sql[$sort_key] . ' ' . (($sort_dir == 'd') ? 'DESC' : 'ASC'); $keywords = $request->variable('keywords', '', true); - $keywords_param = !empty($keywords) ? '&keywords=' . urlencode(htmlspecialchars_decode($keywords)) : ''; + $keywords_param = !empty($keywords) ? '&keywords=' . urlencode(htmlspecialchars_decode($keywords, ENT_COMPAT)) : ''; $l_title = $user->lang['ACP_' . strtoupper($mode) . '_LOGS']; $l_title_explain = $user->lang['ACP_' . strtoupper($mode) . '_LOGS_EXPLAIN']; diff --git a/phpBB/includes/acp/acp_ranks.php b/phpBB/includes/acp/acp_ranks.php index 4d2b64d74c..47e4e85aa1 100644 --- a/phpBB/includes/acp/acp_ranks.php +++ b/phpBB/includes/acp/acp_ranks.php @@ -70,7 +70,7 @@ class acp_ranks 'rank_title' => $rank_title, 'rank_special' => $special_rank, 'rank_min' => $min_posts, - 'rank_image' => htmlspecialchars_decode($rank_image) + 'rank_image' => htmlspecialchars_decode($rank_image, ENT_COMPAT) ); /** @@ -206,7 +206,7 @@ class acp_ranks continue; } - $filename_list .= ''; + $filename_list .= ''; } } @@ -221,7 +221,7 @@ class acp_ranks 'RANK_TITLE' => (isset($ranks['rank_title'])) ? $ranks['rank_title'] : '', 'S_FILENAME_LIST' => $filename_list, - 'RANK_IMAGE' => ($edit_img) ? $phpbb_root_path . $config['ranks_path'] . '/' . $edit_img : htmlspecialchars($phpbb_admin_path) . 'images/spacer.gif', + 'RANK_IMAGE' => ($edit_img) ? $phpbb_root_path . $config['ranks_path'] . '/' . $edit_img : htmlspecialchars($phpbb_admin_path, ENT_COMPAT) . 'images/spacer.gif', 'S_SPECIAL_RANK' => (isset($ranks['rank_special']) && $ranks['rank_special']) ? true : false, 'MIN_POSTS' => (isset($ranks['rank_min']) && !$ranks['rank_special']) ? $ranks['rank_min'] : 0, ); diff --git a/phpBB/includes/acp/acp_styles.php b/phpBB/includes/acp/acp_styles.php index fb65914944..fc33519882 100644 --- a/phpBB/includes/acp/acp_styles.php +++ b/phpBB/includes/acp/acp_styles.php @@ -205,7 +205,7 @@ class acp_styles { if (in_array($dir, $this->reserved_style_names)) { - $messages[] = $this->user->lang('STYLE_NAME_RESERVED', htmlspecialchars($dir)); + $messages[] = $this->user->lang('STYLE_NAME_RESERVED', htmlspecialchars($dir, ENT_COMPAT)); continue; } @@ -225,12 +225,12 @@ class acp_styles $found = true; $installed_names[] = $style['style_name']; $installed_dirs[] = $style['style_path']; - $messages[] = sprintf($this->user->lang['STYLE_INSTALLED'], htmlspecialchars($style['style_name'])); + $messages[] = sprintf($this->user->lang['STYLE_INSTALLED'], htmlspecialchars($style['style_name'], ENT_COMPAT)); } } if (!$found) { - $messages[] = sprintf($this->user->lang['STYLE_NOT_INSTALLED'], htmlspecialchars($dir)); + $messages[] = sprintf($this->user->lang['STYLE_NOT_INSTALLED'], htmlspecialchars($dir, ENT_COMPAT)); } } @@ -598,7 +598,7 @@ class acp_styles { $this->template->assign_block_vars('parent_styles', array( 'STYLE_ID' => $row['style_id'], - 'STYLE_NAME' => htmlspecialchars($row['style_name']), + 'STYLE_NAME' => htmlspecialchars($row['style_name'], ENT_COMPAT), 'LEVEL' => $row['level'], 'SPACER' => str_repeat('  ', $row['level']), ) @@ -609,9 +609,9 @@ class acp_styles $this->template->assign_vars(array( 'S_STYLE_DETAILS' => true, 'STYLE_ID' => $style['style_id'], - 'STYLE_NAME' => htmlspecialchars($style['style_name']), - 'STYLE_PATH' => htmlspecialchars($style['style_path']), - 'STYLE_VERSION' => htmlspecialchars($style_cfg['style_version']), + 'STYLE_NAME' => htmlspecialchars($style['style_name'], ENT_COMPAT), + 'STYLE_PATH' => htmlspecialchars($style['style_path'], ENT_COMPAT), + 'STYLE_VERSION' => htmlspecialchars($style_cfg['style_version'], ENT_COMPAT), 'STYLE_COPYRIGHT' => strip_tags($style['style_copyright']), 'STYLE_PARENT' => $style['style_parent_id'], 'S_STYLE_ACTIVE' => $style['style_active'], @@ -657,7 +657,7 @@ class acp_styles { if (empty($style['_shown'])) { - $style['_note'] = sprintf($this->user->lang['REQUIRES_STYLE'], htmlspecialchars($style['style_parent_tree'])); + $style['_note'] = sprintf($this->user->lang['REQUIRES_STYLE'], htmlspecialchars($style['style_parent_tree'], ENT_COMPAT)); $this->list_style($style, 0); } } @@ -826,7 +826,7 @@ class acp_styles { // Parent style is not installed yet $style['_available'] = false; - $style['_note'] = sprintf($this->user->lang['REQUIRES_STYLE'], htmlspecialchars($parent)); + $style['_note'] = sprintf($this->user->lang['REQUIRES_STYLE'], htmlspecialchars($parent, ENT_COMPAT)); } } @@ -966,10 +966,10 @@ class acp_styles $row = array( // Style data 'STYLE_ID' => $style['style_id'], - 'STYLE_NAME' => htmlspecialchars($style['style_name']), + 'STYLE_NAME' => htmlspecialchars($style['style_name'], ENT_COMPAT), 'STYLE_VERSION' => $style_cfg['style_version'] ?? '-', 'STYLE_PHPBB_VERSION' => $style_cfg['phpbb_version'], - 'STYLE_PATH' => htmlspecialchars($style['style_path']), + 'STYLE_PATH' => htmlspecialchars($style['style_path'], ENT_COMPAT), 'STYLE_COPYRIGHT' => strip_tags($style['style_copyright']), 'STYLE_ACTIVE' => $style['style_active'], @@ -979,7 +979,7 @@ class acp_styles 'LEVEL' => $level, 'PADDING' => (4 + 16 * $level), 'SHOW_COPYRIGHT' => ($style['style_id']) ? false : true, - 'STYLE_PATH_FULL' => htmlspecialchars($this->styles_path_absolute . '/' . $style['style_path']) . '/', + 'STYLE_PATH_FULL' => htmlspecialchars($this->styles_path_absolute . '/' . $style['style_path'], ENT_COMPAT) . '/', // Comment to show below style 'COMMENT' => (isset($style['_note'])) ? $style['_note'] : '', diff --git a/phpBB/includes/acp/acp_users.php b/phpBB/includes/acp/acp_users.php index f2f67d3eed..94a9e50a7b 100644 --- a/phpBB/includes/acp/acp_users.php +++ b/phpBB/includes/acp/acp_users.php @@ -402,8 +402,8 @@ class acp_users $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'WELCOME_MSG' => htmlspecialchars_decode(sprintf($user->lang['WELCOME_SUBJECT'], $config['sitename'])), - 'USERNAME' => htmlspecialchars_decode($user_row['username']), + 'WELCOME_MSG' => htmlspecialchars_decode(sprintf($user->lang['WELCOME_SUBJECT'], $config['sitename']), ENT_COMPAT), + 'USERNAME' => htmlspecialchars_decode($user_row['username'], ENT_COMPAT), 'U_ACTIVATE' => "$server_url/ucp.$phpEx?mode=activate&u={$user_row['user_id']}&k=$user_actkey") ); @@ -466,7 +466,7 @@ class acp_users $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'USERNAME' => htmlspecialchars_decode($user_row['username'])) + 'USERNAME' => htmlspecialchars_decode($user_row['username'], ENT_COMPAT)) ); $messenger->send(NOTIFY_EMAIL); diff --git a/phpBB/includes/acp/auth.php b/phpBB/includes/acp/auth.php index ee0c217d2c..efe0f0e5d1 100644 --- a/phpBB/includes/acp/auth.php +++ b/phpBB/includes/acp/auth.php @@ -488,7 +488,7 @@ class auth_admin extends \phpbb\auth\auth if ($s_role_options) { - $s_role_options = '' . $s_role_options; + $s_role_options = '' . $s_role_options; } if (!$current_role_id && $mode != 'view') @@ -585,7 +585,7 @@ class auth_admin extends \phpbb\auth\auth if ($s_role_options) { - $s_role_options = '' . $s_role_options; + $s_role_options = '' . $s_role_options; } if (!$current_role_id && $mode != 'view') diff --git a/phpBB/includes/diff/renderer.php b/phpBB/includes/diff/renderer.php index 8a8b0c295e..0c8438ff17 100644 --- a/phpBB/includes/diff/renderer.php +++ b/phpBB/includes/diff/renderer.php @@ -322,17 +322,17 @@ class diff_renderer_unified extends diff_renderer function _context($lines) { - return '
    ' . htmlspecialchars($this->_lines($lines, ' ')) . '
    '; + return '
    ' . htmlspecialchars($this->_lines($lines, ' '), ENT_COMPAT) . '
    '; } function _added($lines) { - return '
    ' . htmlspecialchars($this->_lines($lines, '+')) . '
    '; + return '
    ' . htmlspecialchars($this->_lines($lines, '+'), ENT_COMPAT) . '
    '; } function _deleted($lines) { - return '
    ' . htmlspecialchars($this->_lines($lines, '-')) . '
    '; + return '
    ' . htmlspecialchars($this->_lines($lines, '-'), ENT_COMPAT) . '
    '; } function _changed($orig, $final) @@ -519,7 +519,7 @@ class diff_renderer_inline extends diff_renderer function _encode(&$string) { - $string = htmlspecialchars($string); + $string = htmlspecialchars($string, ENT_COMPAT); } } @@ -539,7 +539,7 @@ class diff_renderer_raw extends diff_renderer */ function get_diff_content($diff) { - return ''; + return ''; } function _block_header($xbeg, $xlen, $ybeg, $ylen) @@ -649,7 +649,7 @@ class diff_renderer_side_by_side extends diff_renderer foreach ($change['lines'] as $_line) { - $line .= htmlspecialchars($_line) . '
    '; + $line .= htmlspecialchars($_line, ENT_COMPAT) . '
    '; } $output .= ' 
    ' . ((strlen($line)) ? $line : ' ') . '
    '; @@ -660,14 +660,14 @@ class diff_renderer_side_by_side extends diff_renderer foreach ($change['lines'] as $_line) { - $line .= htmlspecialchars($_line) . '
    '; + $line .= htmlspecialchars($_line, ENT_COMPAT) . '
    '; } $output .= '
    ' . ((strlen($line)) ? $line : ' ') . '
     '; break; case 'empty': - $current_context .= htmlspecialchars($change['line']) . '
    '; + $current_context .= htmlspecialchars($change['line'], ENT_COMPAT) . '
    '; break; case 'change': @@ -678,9 +678,9 @@ class diff_renderer_side_by_side extends diff_renderer for ($row = 0, $row_max = max($oldsize, $newsize); $row < $row_max; ++$row) { - $left .= isset($change['old'][$row]) ? htmlspecialchars($change['old'][$row]) : ''; + $left .= isset($change['old'][$row]) ? htmlspecialchars($change['old'][$row], ENT_COMPAT) : ''; $left .= '
    '; - $right .= isset($change['new'][$row]) ? htmlspecialchars($change['new'][$row]) : ''; + $right .= isset($change['new'][$row]) ? htmlspecialchars($change['new'][$row], ENT_COMPAT) : ''; $right .= '
    '; } diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php index 4a428850c8..72df25cc03 100644 --- a/phpBB/includes/functions.php +++ b/phpBB/includes/functions.php @@ -2690,7 +2690,7 @@ function parse_cfg_file($filename, $lines = false) } // Determine first occurrence, since in values the equal sign is allowed - $key = htmlspecialchars(strtolower(trim(substr($line, 0, $delim_pos)))); + $key = htmlspecialchars(strtolower(trim(substr($line, 0, $delim_pos))), ENT_COMPAT); $value = trim(substr($line, $delim_pos + 1)); if (in_array($value, array('off', 'false', '0'))) @@ -2707,11 +2707,11 @@ function parse_cfg_file($filename, $lines = false) } else if (($value[0] == "'" && $value[strlen($value) - 1] == "'") || ($value[0] == '"' && $value[strlen($value) - 1] == '"')) { - $value = htmlspecialchars(substr($value, 1, strlen($value)-2)); + $value = htmlspecialchars(substr($value, 1, strlen($value)-2), ENT_COMPAT); } else { - $value = htmlspecialchars($value); + $value = htmlspecialchars($value, ENT_COMPAT); } $parsed_items[$key] = $value; @@ -2744,7 +2744,7 @@ function get_backtrace() foreach ($backtrace as $trace) { // Strip the current directory from path - $trace['file'] = (empty($trace['file'])) ? '(not given by php)' : htmlspecialchars(phpbb_filter_root_path($trace['file'])); + $trace['file'] = (empty($trace['file'])) ? '(not given by php)' : htmlspecialchars(phpbb_filter_root_path($trace['file']), ENT_COMPAT); $trace['line'] = (empty($trace['line'])) ? '(not given by php)' : $trace['line']; // Only show function arguments for include etc. @@ -2752,7 +2752,7 @@ function get_backtrace() $argument = ''; if (!empty($trace['args'][0]) && in_array($trace['function'], array('include', 'require', 'include_once', 'require_once'))) { - $argument = htmlspecialchars(phpbb_filter_root_path($trace['args'][0])); + $argument = htmlspecialchars(phpbb_filter_root_path($trace['args'][0]), ENT_COMPAT); } $trace['class'] = (!isset($trace['class'])) ? '' : $trace['class']; @@ -2762,7 +2762,7 @@ function get_backtrace() $output .= 'FILE: ' . $trace['file'] . '
    '; $output .= 'LINE: ' . ((!empty($trace['line'])) ? $trace['line'] : '') . '
    '; - $output .= 'CALL: ' . htmlspecialchars($trace['class'] . $trace['type'] . $trace['function']); + $output .= 'CALL: ' . htmlspecialchars($trace['class'] . $trace['type'] . $trace['function'], ENT_COMPAT); $output .= '(' . (($argument !== '') ? "'$argument'" : '') . ')
    '; } $output .= ''; @@ -4334,6 +4334,6 @@ function phpbb_get_board_contact_link(\phpbb\config\config $config, $phpbb_root_ } else { - return 'mailto:' . htmlspecialchars($config['board_contact']); + return 'mailto:' . htmlspecialchars($config['board_contact'], ENT_COMPAT); } } diff --git a/phpBB/includes/functions_compatibility.php b/phpBB/includes/functions_compatibility.php index d06e3072cd..0dd2dd74bb 100644 --- a/phpBB/includes/functions_compatibility.php +++ b/phpBB/includes/functions_compatibility.php @@ -725,7 +725,7 @@ function phpbb_http_login($param) { if ($request->is_set($k, \phpbb\request\request_interface::SERVER)) { - $username = htmlspecialchars_decode($request->server($k)); + $username = htmlspecialchars_decode($request->server($k), ENT_COMPAT); break; } } @@ -735,7 +735,7 @@ function phpbb_http_login($param) { if ($request->is_set($k, \phpbb\request\request_interface::SERVER)) { - $password = htmlspecialchars_decode($request->server($k)); + $password = htmlspecialchars_decode($request->server($k), ENT_COMPAT); break; } } diff --git a/phpBB/includes/functions_content.php b/phpBB/includes/functions_content.php index f5637b1f5e..3de8334674 100644 --- a/phpBB/includes/functions_content.php +++ b/phpBB/includes/functions_content.php @@ -803,8 +803,8 @@ function make_clickable_callback($type, $whitespace, $url, $relative_url, $class $orig_url = $url; $orig_relative = $relative_url; $append = ''; - $url = htmlspecialchars_decode($url); - $relative_url = htmlspecialchars_decode($relative_url); + $url = htmlspecialchars_decode($url, ENT_COMPAT); + $relative_url = htmlspecialchars_decode($relative_url, ENT_COMPAT); // make sure no HTML entities were matched $chars = array('<', '>', '"'); @@ -910,9 +910,9 @@ function make_clickable_callback($type, $whitespace, $url, $relative_url, $class break; } - $url = htmlspecialchars($url); - $text = htmlspecialchars($text); - $append = htmlspecialchars($append); + $url = htmlspecialchars($url, ENT_COMPAT); + $text = htmlspecialchars($text, ENT_COMPAT); + $append = htmlspecialchars($append, ENT_COMPAT); $html = "$whitespace$text$append"; @@ -1457,7 +1457,7 @@ function truncate_string($string, $max_length = 60, $max_store_length = 255, $al $string = substr($string, 4); } - $_chars = utf8_str_split(htmlspecialchars_decode($string)); + $_chars = utf8_str_split(htmlspecialchars_decode($string, ENT_COMPAT)); $chars = array_map('utf8_htmlspecialchars', $_chars); // Now check the length ;) @@ -1472,7 +1472,7 @@ function truncate_string($string, $max_length = 60, $max_store_length = 255, $al if (utf8_strlen($string) > $max_store_length) { // let's split again, we do not want half-baked strings where entities are split - $_chars = utf8_str_split(htmlspecialchars_decode($string)); + $_chars = utf8_str_split(htmlspecialchars_decode($string, ENT_COMPAT)); $chars = array_map('utf8_htmlspecialchars', $_chars); do diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php index df252f5c84..3dcfb4cc98 100644 --- a/phpBB/includes/functions_download.php +++ b/phpBB/includes/functions_download.php @@ -208,7 +208,7 @@ function send_file_to_browser($attachment, $category) if (empty($user->browser) || ((strpos(strtolower($user->browser), 'msie') !== false) && !phpbb_is_greater_ie_version($user->browser, 7))) { - header('Content-Disposition: attachment; ' . header_filename(htmlspecialchars_decode($attachment['real_filename']))); + header('Content-Disposition: attachment; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'], ENT_COMPAT))); if (empty($user->browser) || (strpos(strtolower($user->browser), 'msie 6.0') !== false)) { header('Expires: ' . gmdate('D, d M Y H:i:s', time()) . ' GMT'); @@ -216,7 +216,7 @@ function send_file_to_browser($attachment, $category) } else { - header('Content-Disposition: ' . ((strpos($attachment['mimetype'], 'image') === 0) ? 'inline' : 'attachment') . '; ' . header_filename(htmlspecialchars_decode($attachment['real_filename']))); + header('Content-Disposition: ' . ((strpos($attachment['mimetype'], 'image') === 0) ? 'inline' : 'attachment') . '; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'], ENT_COMPAT))); if (phpbb_is_greater_ie_version($user->browser, 7) && (strpos($attachment['mimetype'], 'image') !== 0)) { header('X-Download-Options: noopen'); @@ -283,7 +283,7 @@ function download_allowed() return true; } - $url = htmlspecialchars_decode($request->header('Referer')); + $url = htmlspecialchars_decode($request->header('Referer'), ENT_COMPAT); if (!$url) { diff --git a/phpBB/includes/functions_messenger.php b/phpBB/includes/functions_messenger.php index 47c18f6dd9..3054846371 100644 --- a/phpBB/includes/functions_messenger.php +++ b/phpBB/includes/functions_messenger.php @@ -320,8 +320,8 @@ class messenger // We add some standard variables we always use, no need to specify them always $this->assign_vars(array( 'U_BOARD' => generate_board_url(), - 'EMAIL_SIG' => str_replace('
    ', "\n", "-- \n" . htmlspecialchars_decode($config['board_email_sig'])), - 'SITENAME' => htmlspecialchars_decode($config['sitename']), + 'EMAIL_SIG' => str_replace('
    ', "\n", "-- \n" . htmlspecialchars_decode($config['board_email_sig'], ENT_COMPAT)), + 'SITENAME' => htmlspecialchars_decode($config['sitename'], ENT_COMPAT), )); $subject = $this->subject; @@ -427,7 +427,7 @@ class messenger $user->session_begin(); } - $calling_page = htmlspecialchars_decode($request->server('PHP_SELF')); + $calling_page = htmlspecialchars_decode($request->server('PHP_SELF'), ENT_COMPAT); switch ($type) { @@ -440,7 +440,7 @@ class messenger break; } - $message .= '
    ' . htmlspecialchars($calling_page) . '

    ' . $msg . '
    '; + $message .= '
    ' . htmlspecialchars($calling_page, ENT_COMPAT) . '

    ' . $msg . '
    '; $phpbb_log->add('critical', $user->data['user_id'], $user->ip, 'LOG_ERROR_' . $type, false, array($message)); } @@ -557,7 +557,7 @@ class messenger $use_queue = true; } - $contact_name = htmlspecialchars_decode($config['board_contact_name']); + $contact_name = htmlspecialchars_decode($config['board_contact_name'], ENT_COMPAT); $board_contact = (($contact_name !== '') ? '"' . mail_encode($contact_name) . '" ' : '') . '<' . $config['board_contact'] . '>'; $break = false; @@ -691,7 +691,7 @@ class messenger if (!$use_queue) { include_once($phpbb_root_path . 'includes/functions_jabber.' . $phpEx); - $this->jabber = new jabber($config['jab_host'], $config['jab_port'], $config['jab_username'], htmlspecialchars_decode($config['jab_password']), $config['jab_use_ssl'], $config['jab_verify_peer'], $config['jab_verify_peer_name'], $config['jab_allow_self_signed']); + $this->jabber = new jabber($config['jab_host'], $config['jab_port'], $config['jab_username'], htmlspecialchars_decode($config['jab_password'], ENT_COMPAT), $config['jab_use_ssl'], $config['jab_verify_peer'], $config['jab_verify_peer_name'], $config['jab_allow_self_signed']); if (!$this->jabber->connect()) { @@ -889,7 +889,7 @@ class queue } include_once($phpbb_root_path . 'includes/functions_jabber.' . $phpEx); - $this->jabber = new jabber($config['jab_host'], $config['jab_port'], $config['jab_username'], htmlspecialchars_decode($config['jab_password']), $config['jab_use_ssl'], $config['jab_verify_peer'], $config['jab_verify_peer_name'], $config['jab_allow_self_signed']); + $this->jabber = new jabber($config['jab_host'], $config['jab_port'], $config['jab_username'], htmlspecialchars_decode($config['jab_password'], ENT_COMPAT), $config['jab_use_ssl'], $config['jab_verify_peer'], $config['jab_verify_peer_name'], $config['jab_allow_self_signed']); if (!$this->jabber->connect()) { @@ -1194,7 +1194,7 @@ function smtpmail($addresses, $subject, $message, &$err_msg, $headers = false) } $err_msg = (isset($user->lang['NO_CONNECT_TO_SMTP_HOST'])) ? sprintf($user->lang['NO_CONNECT_TO_SMTP_HOST'], $errno, $errstr) : "Could not connect to smtp host : $errno : $errstr"; - $err_msg .= ($error_contents) ? '

    ' . htmlspecialchars($error_contents) : ''; + $err_msg .= ($error_contents) ? '

    ' . htmlspecialchars($error_contents, ENT_COMPAT) : ''; return false; } @@ -1206,7 +1206,7 @@ function smtpmail($addresses, $subject, $message, &$err_msg, $headers = false) } // Let me in. This function handles the complete authentication process - if ($err_msg = $smtp->log_into_server($config['smtp_host'], $config['smtp_username'], htmlspecialchars_decode($config['smtp_password']), $config['smtp_auth_method'])) + if ($err_msg = $smtp->log_into_server($config['smtp_host'], $config['smtp_username'], htmlspecialchars_decode($config['smtp_password'], ENT_COMPAT), $config['smtp_auth_method'])) { $smtp->close_session($err_msg); return false; @@ -1257,7 +1257,7 @@ function smtpmail($addresses, $subject, $message, &$err_msg, $headers = false) { $user->session_begin(); $err_msg .= '

    '; - $err_msg .= (isset($user->lang['INVALID_EMAIL_LOG'])) ? sprintf($user->lang['INVALID_EMAIL_LOG'], htmlspecialchars($mail_to_address)) : '' . htmlspecialchars($mail_to_address) . ' possibly an invalid email address?'; + $err_msg .= (isset($user->lang['INVALID_EMAIL_LOG'])) ? sprintf($user->lang['INVALID_EMAIL_LOG'], htmlspecialchars($mail_to_address, ENT_COMPAT)) : '' . htmlspecialchars($mail_to_address, ENT_COMPAT) . ' possibly an invalid email address?'; $smtp->close_session($err_msg); return false; } @@ -1340,7 +1340,7 @@ class smtp_class { if ($this->backtrace) { - $this->backtrace_log[] = utf8_htmlspecialchars($message); + $this->backtrace_log[] = utf8_htmlspecialchars($message, ENT_COMPAT); } } diff --git a/phpBB/includes/functions_user.php b/phpBB/includes/functions_user.php index e07871b51c..fc2861c75f 100644 --- a/phpBB/includes/functions_user.php +++ b/phpBB/includes/functions_user.php @@ -1510,7 +1510,7 @@ function user_ipwhois($ip) $ipwhois = (empty($buffer)) ? $ipwhois : $buffer; } - $ipwhois = htmlspecialchars($ipwhois); + $ipwhois = htmlspecialchars($ipwhois, ENT_COMPAT); // Magic URL ;) return trim(make_clickable($ipwhois, false, '')); @@ -1572,11 +1572,11 @@ function validate_string($string, $optional = false, $min = 0, $max = 0) return false; } - if ($min && utf8_strlen(htmlspecialchars_decode($string)) < $min) + if ($min && utf8_strlen(htmlspecialchars_decode($string, ENT_COMPAT)) < $min) { return 'TOO_SHORT'; } - else if ($max && utf8_strlen(htmlspecialchars_decode($string)) > $max) + else if ($max && utf8_strlen(htmlspecialchars_decode($string, ENT_COMPAT)) > $max) { return 'TOO_LONG'; } diff --git a/phpBB/includes/mcp/mcp_logs.php b/phpBB/includes/mcp/mcp_logs.php index d705ee8557..1c5be1213d 100644 --- a/phpBB/includes/mcp/mcp_logs.php +++ b/phpBB/includes/mcp/mcp_logs.php @@ -179,7 +179,7 @@ class mcp_logs $sql_sort = $sort_by_sql[$sort_key] . ' ' . (($sort_dir == 'd') ? 'DESC' : 'ASC'); $keywords = $request->variable('keywords', '', true); - $keywords_param = !empty($keywords) ? '&keywords=' . urlencode(htmlspecialchars_decode($keywords)) : ''; + $keywords_param = !empty($keywords) ? '&keywords=' . urlencode(htmlspecialchars_decode($keywords, ENT_COMPAT)) : ''; // Grab log data $log_data = array(); diff --git a/phpBB/includes/mcp/mcp_notes.php b/phpBB/includes/mcp/mcp_notes.php index da1683ea06..47dc97cc8b 100644 --- a/phpBB/includes/mcp/mcp_notes.php +++ b/phpBB/includes/mcp/mcp_notes.php @@ -206,7 +206,7 @@ class mcp_notes $sql_sort = $sort_by_sql[$sk] . ' ' . (($sd == 'd') ? 'DESC' : 'ASC'); $keywords = $request->variable('keywords', '', true); - $keywords_param = !empty($keywords) ? '&keywords=' . urlencode(htmlspecialchars_decode($keywords)) : ''; + $keywords_param = !empty($keywords) ? '&keywords=' . urlencode(htmlspecialchars_decode($keywords, ENT_COMPAT)) : ''; $log_data = array(); $log_count = 0; diff --git a/phpBB/includes/message_parser.php b/phpBB/includes/message_parser.php index 395e613af8..c463179227 100644 --- a/phpBB/includes/message_parser.php +++ b/phpBB/includes/message_parser.php @@ -506,7 +506,7 @@ class bbcode_firstpass extends bbcode } // Because highlight_string is specialcharing the text (but we already did this before), we have to reverse this in order to get correct results - $code = htmlspecialchars_decode($code); + $code = htmlspecialchars_decode($code, ENT_COMPAT); $code = highlight_string($code, true); $str_from = array('', '', '','[', ']', '.', ':'); diff --git a/phpBB/includes/questionnaire/questionnaire.php b/phpBB/includes/questionnaire/questionnaire.php index ec2e6fea5d..848a65956b 100644 --- a/phpBB/includes/questionnaire/questionnaire.php +++ b/phpBB/includes/questionnaire/questionnaire.php @@ -150,11 +150,11 @@ class phpbb_questionnaire_system_data_provider // Start discovering the IPV4 server address, if available // Try apache, IIS, fall back to 0.0.0.0 - $server_address = htmlspecialchars_decode($request->server('SERVER_ADDR', $request->server('LOCAL_ADDR', '0.0.0.0'))); + $server_address = htmlspecialchars_decode($request->server('SERVER_ADDR', $request->server('LOCAL_ADDR', '0.0.0.0')), ENT_COMPAT); return array( 'os' => PHP_OS, - 'httpd' => htmlspecialchars_decode($request->server('SERVER_SOFTWARE')), + 'httpd' => htmlspecialchars_decode($request->server('SERVER_SOFTWARE'), ENT_COMPAT), // we don't want the real IP address (for privacy policy reasons) but only // a network address to see whether your installation is running on a private or public network. 'private_ip' => $this->is_private_ip($server_address), diff --git a/phpBB/includes/ucp/ucp_activate.php b/phpBB/includes/ucp/ucp_activate.php index 7a90f2e3b1..bb22fe1437 100644 --- a/phpBB/includes/ucp/ucp_activate.php +++ b/phpBB/includes/ucp/ucp_activate.php @@ -134,7 +134,7 @@ class ucp_activate $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'USERNAME' => htmlspecialchars_decode($user_row['username'])) + 'USERNAME' => htmlspecialchars_decode($user_row['username'], ENT_COMPAT)) ); $messenger->send($user_row['user_notify_type']); diff --git a/phpBB/includes/ucp/ucp_login_link.php b/phpBB/includes/ucp/ucp_login_link.php index c1f307eeb5..8f7c212aaa 100644 --- a/phpBB/includes/ucp/ucp_login_link.php +++ b/phpBB/includes/ucp/ucp_login_link.php @@ -230,7 +230,7 @@ class ucp_login_link $user->lang[$result['error_msg']], ($config['email_enable']) ? '' : '', ($config['email_enable']) ? '' : '', - ($config['board_contact']) ? '' : '', + ($config['board_contact']) ? '' : '', ($config['board_contact']) ? '' : '' ); break; @@ -242,7 +242,7 @@ class ucp_login_link // Assign admin contact to some error messages if ($result['error_msg'] == 'LOGIN_ERROR_USERNAME' || $result['error_msg'] == 'LOGIN_ERROR_PASSWORD') { - $login_error = (!$config['board_contact']) ? sprintf($user->lang[$result['error_msg']], '', '') : sprintf($user->lang[$result['error_msg']], '', ''); + $login_error = (!$config['board_contact']) ? sprintf($user->lang[$result['error_msg']], '', '') : sprintf($user->lang[$result['error_msg']], '', ''); } break; diff --git a/phpBB/includes/ucp/ucp_profile.php b/phpBB/includes/ucp/ucp_profile.php index 53a042f173..229f3fc06a 100644 --- a/phpBB/includes/ucp/ucp_profile.php +++ b/phpBB/includes/ucp/ucp_profile.php @@ -186,7 +186,7 @@ class ucp_profile $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'USERNAME' => htmlspecialchars_decode($data['username']), + 'USERNAME' => htmlspecialchars_decode($data['username'], ENT_COMPAT), 'U_ACTIVATE' => "$server_url/ucp.$phpEx?mode=activate&u={$user->data['user_id']}&k=$user_actkey") ); diff --git a/phpBB/includes/ucp/ucp_register.php b/phpBB/includes/ucp/ucp_register.php index 793f5542f9..38a2bd4fc5 100644 --- a/phpBB/includes/ucp/ucp_register.php +++ b/phpBB/includes/ucp/ucp_register.php @@ -461,9 +461,9 @@ class ucp_register $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'WELCOME_MSG' => htmlspecialchars_decode(sprintf($user->lang['WELCOME_SUBJECT'], $config['sitename'])), - 'USERNAME' => htmlspecialchars_decode($data['username']), - 'PASSWORD' => htmlspecialchars_decode($data['new_password']), + 'WELCOME_MSG' => htmlspecialchars_decode(sprintf($user->lang['WELCOME_SUBJECT'], $config['sitename']), ENT_COMPAT), + 'USERNAME' => htmlspecialchars_decode($data['username'], ENT_COMPAT), + 'PASSWORD' => htmlspecialchars_decode($data['new_password'], ENT_COMPAT), 'U_ACTIVATE' => "$server_url/ucp.$phpEx?mode=activate&u=$user_id&k=$user_actkey") ); diff --git a/phpBB/includes/ucp/ucp_resend.php b/phpBB/includes/ucp/ucp_resend.php index 55923668d4..a3f9868145 100644 --- a/phpBB/includes/ucp/ucp_resend.php +++ b/phpBB/includes/ucp/ucp_resend.php @@ -99,8 +99,8 @@ class ucp_resend $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'WELCOME_MSG' => htmlspecialchars_decode(sprintf($user->lang['WELCOME_SUBJECT'], $config['sitename'])), - 'USERNAME' => htmlspecialchars_decode($user_row['username']), + 'WELCOME_MSG' => htmlspecialchars_decode(sprintf($user->lang['WELCOME_SUBJECT'], $config['sitename']), ENT_COMPAT), + 'USERNAME' => htmlspecialchars_decode($user_row['username'], ENT_COMPAT), 'U_ACTIVATE' => generate_board_url() . "/ucp.$phpEx?mode=activate&u={$user_row['user_id']}&k={$user_row['user_actkey']}") ); @@ -134,7 +134,7 @@ class ucp_resend $messenger->anti_abuse_headers($config, $user); $messenger->assign_vars(array( - 'USERNAME' => htmlspecialchars_decode($user_row['username']), + 'USERNAME' => htmlspecialchars_decode($user_row['username'], ENT_COMPAT), 'U_USER_DETAILS' => generate_board_url() . "/memberlist.$phpEx?mode=viewprofile&u={$user_row['user_id']}", 'U_ACTIVATE' => generate_board_url() . "/ucp.$phpEx?mode=activate&u={$user_row['user_id']}&k={$user_row['user_actkey']}") ); diff --git a/phpBB/install/convert/controller/convertor.php b/phpBB/install/convert/controller/convertor.php index 3639b10dc5..b764171422 100644 --- a/phpBB/install/convert/controller/convertor.php +++ b/phpBB/install/convert/controller/convertor.php @@ -506,7 +506,7 @@ class convertor { /** @var \phpbb\db\driver\driver_interface $src_db */ $src_db = new $src_dbms(); - $src_db->sql_connect($src_dbhost, $src_dbuser, htmlspecialchars_decode($src_dbpasswd), $src_dbname, $src_dbport, false, true); + $src_db->sql_connect($src_dbhost, $src_dbuser, htmlspecialchars_decode($src_dbpasswd, ENT_COMPAT), $src_dbname, $src_dbport, false, true); $same_db = false; } else diff --git a/phpBB/install/convert/convertor.php b/phpBB/install/convert/convertor.php index 00e6c8903a..52a4565083 100644 --- a/phpBB/install/convert/convertor.php +++ b/phpBB/install/convert/convertor.php @@ -132,7 +132,7 @@ class convertor $dbms = $convert->src_dbms; /** @var \phpbb\db\driver\driver $src_db */ $src_db = new $dbms(); - $src_db->sql_connect($convert->src_dbhost, $convert->src_dbuser, htmlspecialchars_decode($convert->src_dbpasswd), $convert->src_dbname, $convert->src_dbport, false, true); + $src_db->sql_connect($convert->src_dbhost, $convert->src_dbuser, htmlspecialchars_decode($convert->src_dbpasswd, ENT_COMPAT), $convert->src_dbname, $convert->src_dbport, false, true); $same_db = false; } else @@ -763,7 +763,7 @@ class convertor { if (!$db->sql_query($insert_query . $waiting_sql)) { - $this->db_error($user->lang['DB_ERR_INSERT'], htmlspecialchars($insert_query . $waiting_sql) . '

    ' . htmlspecialchars(print_r($db->_sql_error(), true)), __LINE__, __FILE__, true); + $this->db_error($user->lang['DB_ERR_INSERT'], htmlspecialchars($insert_query . $waiting_sql, ENT_COMPAT) . '

    ' . htmlspecialchars(print_r($db->_sql_error(), true), ENT_COMPAT), __LINE__, __FILE__, true); } } @@ -782,7 +782,7 @@ class convertor if (!$db->sql_query($insert_sql)) { - $this->db_error($user->lang['DB_ERR_INSERT'], htmlspecialchars($insert_sql) . '

    ' . htmlspecialchars(print_r($db->_sql_error(), true)), __LINE__, __FILE__, true); + $this->db_error($user->lang['DB_ERR_INSERT'], htmlspecialchars($insert_sql, ENT_COMPAT) . '

    ' . htmlspecialchars(print_r($db->_sql_error(), true), ENT_COMPAT), __LINE__, __FILE__, true); } $db->sql_return_on_error(false); @@ -817,7 +817,7 @@ class convertor foreach ($waiting_rows as $waiting_sql) { $db->sql_query($insert_query . $waiting_sql); - $this->db_error($user->lang['DB_ERR_INSERT'], htmlspecialchars($insert_query . $waiting_sql) . '

    ' . htmlspecialchars(print_r($db->_sql_error(), true)), __LINE__, __FILE__, true); + $this->db_error($user->lang['DB_ERR_INSERT'], htmlspecialchars($insert_query . $waiting_sql, ENT_COMPAT) . '

    ' . htmlspecialchars(print_r($db->_sql_error(), true), ENT_COMPAT), __LINE__, __FILE__, true); } $db->sql_return_on_error(false); @@ -1468,6 +1468,12 @@ class convertor $value = array($value); } + // Add ENT_COMPAT default flag to html specialchars/entities functions, see PHPBB3-16690 + if (in_array($execution, ['htmlspecialchars', 'htmlentities', 'htmlspecialchars_decode', 'html_entitity_decode'])) + { + $value[] = ENT_COMPAT; + } + $value = call_user_func_array($execution, $value); } else if (strpos($type, 'execute') === 0) @@ -1517,6 +1523,12 @@ class convertor $value = array($value); } + // Add ENT_COMPAT default flag to html specialchars/entities functions, see PHPBB3-16690 + if (in_array($execution, ['htmlspecialchars', 'htmlentities', 'htmlspecialchars_decode', 'html_entitity_decode'])) + { + $value[] = ENT_COMPAT; + } + $value = call_user_func_array($execution, $value); } else if (strpos($type, 'execute') === 0) diff --git a/phpBB/memberlist.php b/phpBB/memberlist.php index c1e5df8f32..fb4f82f38c 100644 --- a/phpBB/memberlist.php +++ b/phpBB/memberlist.php @@ -441,16 +441,16 @@ switch ($mode) $messenger = new messenger(false); $messenger->template('profile_send_im', $row['user_lang']); - $messenger->subject(htmlspecialchars_decode($subject)); + $messenger->subject(htmlspecialchars_decode($subject, ENT_COMPAT)); $messenger->replyto($user->data['user_email']); $messenger->set_addresses($row); $messenger->assign_vars(array( 'BOARD_CONTACT' => phpbb_get_board_contact($config, $phpEx), - 'FROM_USERNAME' => htmlspecialchars_decode($user->data['username']), - 'TO_USERNAME' => htmlspecialchars_decode($row['username']), - 'MESSAGE' => htmlspecialchars_decode($message)) + 'FROM_USERNAME' => htmlspecialchars_decode($user->data['username'], ENT_COMPAT), + 'TO_USERNAME' => htmlspecialchars_decode($row['username'], ENT_COMPAT), + 'MESSAGE' => htmlspecialchars_decode($message, ENT_COMPAT)) ); $messenger->send(NOTIFY_IM); @@ -803,8 +803,8 @@ switch ($mode) 'S_USER_NOTES' => ($user_notes_enabled) ? true : false, 'S_WARN_USER' => ($warn_user_enabled) ? true : false, 'S_ZEBRA' => ($user->data['user_id'] != $user_id && $user->data['is_registered'] && $zebra_enabled) ? true : false, - 'U_ADD_FRIEND' => (!$friend && !$foe && $friends_enabled) ? append_sid("{$phpbb_root_path}ucp.$phpEx", 'i=zebra&add=' . urlencode(htmlspecialchars_decode($member['username']))) : '', - 'U_ADD_FOE' => (!$friend && !$foe && $foes_enabled) ? append_sid("{$phpbb_root_path}ucp.$phpEx", 'i=zebra&mode=foes&add=' . urlencode(htmlspecialchars_decode($member['username']))) : '', + 'U_ADD_FRIEND' => (!$friend && !$foe && $friends_enabled) ? append_sid("{$phpbb_root_path}ucp.$phpEx", 'i=zebra&add=' . urlencode(htmlspecialchars_decode($member['username'], ENT_COMPAT))) : '', + 'U_ADD_FOE' => (!$friend && !$foe && $foes_enabled) ? append_sid("{$phpbb_root_path}ucp.$phpEx", 'i=zebra&mode=foes&add=' . urlencode(htmlspecialchars_decode($member['username'], ENT_COMPAT))) : '', 'U_REMOVE_FRIEND' => ($friend && $friends_enabled) ? append_sid("{$phpbb_root_path}ucp.$phpEx", 'i=zebra&remove=1&usernames[]=' . $user_id) : '', 'U_REMOVE_FOE' => ($foe && $foes_enabled) ? append_sid("{$phpbb_root_path}ucp.$phpEx", 'i=zebra&remove=1&mode=foes&usernames[]=' . $user_id) : '', diff --git a/phpBB/phpbb/auth/provider/apache.php b/phpBB/phpbb/auth/provider/apache.php index a713674657..a13e2d9484 100644 --- a/phpBB/phpbb/auth/provider/apache.php +++ b/phpBB/phpbb/auth/provider/apache.php @@ -73,7 +73,7 @@ class apache extends base */ public function init() { - if (!$this->request->is_set('PHP_AUTH_USER', request_interface::SERVER) || $this->user->data['username'] !== htmlspecialchars_decode($this->request->server('PHP_AUTH_USER'))) + if (!$this->request->is_set('PHP_AUTH_USER', request_interface::SERVER) || $this->user->data['username'] !== htmlspecialchars_decode($this->request->server('PHP_AUTH_USER'), ENT_COMPAT)) { return $this->language->lang('APACHE_SETUP_BEFORE_USE'); } @@ -113,8 +113,8 @@ class apache extends base ); } - $php_auth_user = htmlspecialchars_decode($this->request->server('PHP_AUTH_USER')); - $php_auth_pw = htmlspecialchars_decode($this->request->server('PHP_AUTH_PW')); + $php_auth_user = htmlspecialchars_decode($this->request->server('PHP_AUTH_USER'), ENT_COMPAT); + $php_auth_pw = htmlspecialchars_decode($this->request->server('PHP_AUTH_PW'), ENT_COMPAT); if (!empty($php_auth_user) && !empty($php_auth_pw)) { @@ -180,8 +180,8 @@ class apache extends base return array(); } - $php_auth_user = htmlspecialchars_decode($this->request->server('PHP_AUTH_USER')); - $php_auth_pw = htmlspecialchars_decode($this->request->server('PHP_AUTH_PW')); + $php_auth_user = htmlspecialchars_decode($this->request->server('PHP_AUTH_USER'), ENT_COMPAT); + $php_auth_pw = htmlspecialchars_decode($this->request->server('PHP_AUTH_PW'), ENT_COMPAT); if (!empty($php_auth_user) && !empty($php_auth_pw)) { diff --git a/phpBB/phpbb/auth/provider/ldap.php b/phpBB/phpbb/auth/provider/ldap.php index 43699f7d6e..4945d6ca53 100644 --- a/phpBB/phpbb/auth/provider/ldap.php +++ b/phpBB/phpbb/auth/provider/ldap.php @@ -83,7 +83,7 @@ class ldap extends base if ($this->config['ldap_user'] || $this->config['ldap_password']) { - if (!@ldap_bind($ldap, htmlspecialchars_decode($this->config['ldap_user']), htmlspecialchars_decode($this->config['ldap_password']))) + if (!@ldap_bind($ldap, htmlspecialchars_decode($this->config['ldap_user'], ENT_COMPAT), htmlspecialchars_decode($this->config['ldap_password'], ENT_COMPAT))) { return $this->language->lang('LDAP_INCORRECT_USER_PASSWORD'); } @@ -92,11 +92,11 @@ class ldap extends base // ldap_connect only checks whether the specified server is valid, so the connection might still fail $search = @ldap_search( $ldap, - htmlspecialchars_decode($this->config['ldap_base_dn']), + htmlspecialchars_decode($this->config['ldap_base_dn'], ENT_COMPAT), $this->ldap_user_filter($this->user->data['username']), (empty($this->config['ldap_email'])) ? - array(htmlspecialchars_decode($this->config['ldap_uid'])) : - array(htmlspecialchars_decode($this->config['ldap_uid']), htmlspecialchars_decode($this->config['ldap_email'])), + array(htmlspecialchars_decode($this->config['ldap_uid'], ENT_COMPAT)) : + array(htmlspecialchars_decode($this->config['ldap_uid'], ENT_COMPAT), htmlspecialchars_decode($this->config['ldap_email'], ENT_COMPAT)), 0, 1 ); @@ -180,7 +180,7 @@ class ldap extends base if ($this->config['ldap_user'] || $this->config['ldap_password']) { - if (!@ldap_bind($ldap, htmlspecialchars_decode($this->config['ldap_user']), htmlspecialchars_decode($this->config['ldap_password']))) + if (!@ldap_bind($ldap, htmlspecialchars_decode($this->config['ldap_user'], ENT_COMPAT), htmlspecialchars_decode($this->config['ldap_password'], ENT_COMPAT))) { return array( 'status' => LOGIN_ERROR_EXTERNAL_AUTH, @@ -192,11 +192,11 @@ class ldap extends base $search = @ldap_search( $ldap, - htmlspecialchars_decode($this->config['ldap_base_dn']), + htmlspecialchars_decode($this->config['ldap_base_dn'], ENT_COMPAT), $this->ldap_user_filter($username), (empty($this->config['ldap_email'])) ? - array(htmlspecialchars_decode($this->config['ldap_uid'])) : - array(htmlspecialchars_decode($this->config['ldap_uid']), htmlspecialchars_decode($this->config['ldap_email'])), + array(htmlspecialchars_decode($this->config['ldap_uid'], ENT_COMPAT)) : + array(htmlspecialchars_decode($this->config['ldap_uid'], ENT_COMPAT), htmlspecialchars_decode($this->config['ldap_email'], ENT_COMPAT)), 0, 1 ); @@ -205,7 +205,7 @@ class ldap extends base if (is_array($ldap_result) && count($ldap_result) > 1) { - if (@ldap_bind($ldap, $ldap_result[0]['dn'], htmlspecialchars_decode($password))) + if (@ldap_bind($ldap, $ldap_result[0]['dn'], htmlspecialchars_decode($password, ENT_COMPAT))) { @ldap_close($ldap); @@ -257,7 +257,7 @@ class ldap extends base $ldap_user_row = array( 'username' => $username, 'user_password' => '', - 'user_email' => (!empty($this->config['ldap_email'])) ? utf8_htmlspecialchars($ldap_result[0][htmlspecialchars_decode($this->config['ldap_email'])][0]) : '', + 'user_email' => (!empty($this->config['ldap_email'])) ? utf8_htmlspecialchars($ldap_result[0][htmlspecialchars_decode($this->config['ldap_email'], ENT_COMPAT)][0]) : '', 'group_id' => (int) $row['group_id'], 'user_type' => USER_NORMAL, 'user_ip' => $this->user->ip, @@ -337,7 +337,7 @@ class ldap extends base */ private function ldap_user_filter($username) { - $filter = '(' . $this->config['ldap_uid'] . '=' . $this->ldap_escape(htmlspecialchars_decode($username)) . ')'; + $filter = '(' . $this->config['ldap_uid'] . '=' . $this->ldap_escape(htmlspecialchars_decode($username, ENT_COMPAT)) . ')'; if ($this->config['ldap_user_filter']) { $_filter = ($this->config['ldap_user_filter'][0] == '(' && substr($this->config['ldap_user_filter'], -1) == ')') ? $this->config['ldap_user_filter'] : "({$this->config['ldap_user_filter']})"; diff --git a/phpBB/phpbb/console/command/user/activate.php b/phpBB/phpbb/console/command/user/activate.php index dc87f6d2db..5cfd2d8bac 100644 --- a/phpBB/phpbb/console/command/user/activate.php +++ b/phpBB/phpbb/console/command/user/activate.php @@ -203,7 +203,7 @@ class activate extends command $messenger->set_addresses($user_row); $messenger->anti_abuse_headers($this->config, $this->user); $messenger->assign_vars(array( - 'USERNAME' => htmlspecialchars_decode($user_row['username'])) + 'USERNAME' => htmlspecialchars_decode($user_row['username'], ENT_COMPAT)) ); $messenger->send(NOTIFY_EMAIL); diff --git a/phpBB/phpbb/console/command/user/add.php b/phpBB/phpbb/console/command/user/add.php index 303216a93d..10eb8c60ea 100644 --- a/phpBB/phpbb/console/command/user/add.php +++ b/phpBB/phpbb/console/command/user/add.php @@ -312,9 +312,9 @@ class add extends command $messenger->to($this->data['email'], $this->data['username']); $messenger->anti_abuse_headers($this->config, $this->user); $messenger->assign_vars(array( - 'WELCOME_MSG' => htmlspecialchars_decode($this->language->lang('WELCOME_SUBJECT', $this->config['sitename'])), - 'USERNAME' => htmlspecialchars_decode($this->data['username']), - 'PASSWORD' => htmlspecialchars_decode($this->data['new_password']), + 'WELCOME_MSG' => htmlspecialchars_decode($this->language->lang('WELCOME_SUBJECT', $this->config['sitename']), ENT_COMPAT), + 'USERNAME' => htmlspecialchars_decode($this->data['username'], ENT_COMPAT), + 'PASSWORD' => htmlspecialchars_decode($this->data['new_password'], ENT_COMPAT), 'U_ACTIVATE' => generate_board_url() . "/ucp.{$this->php_ext}?mode=activate&u=$user_id&k=$user_actkey") ); diff --git a/phpBB/phpbb/db/driver/driver.php b/phpBB/phpbb/db/driver/driver.php index 2a4150b558..cd9f1f058e 100644 --- a/phpBB/phpbb/db/driver/driver.php +++ b/phpBB/phpbb/db/driver/driver.php @@ -983,7 +983,7 @@ abstract class driver implements driver_interface // The DEBUG constant is for development only! if ((isset($auth) && $auth->acl_get('a_')) || defined('IN_INSTALL') || $this->debug_sql_explain) { - $message .= ($sql) ? '

    SQL

    ' . htmlspecialchars($sql) : ''; + $message .= ($sql) ? '

    SQL

    ' . htmlspecialchars($sql, ENT_COMPAT) : ''; } else { @@ -997,7 +997,7 @@ abstract class driver implements driver_interface { if (!empty($config['board_contact'])) { - $message .= '

    ' . sprintf($user->lang['SQL_ERROR_OCCURRED'], '', ''); + $message .= '

    ' . sprintf($user->lang['SQL_ERROR_OCCURRED'], '', ''); } else { @@ -1061,7 +1061,7 @@ abstract class driver implements driver_interface SQL Report - +
    @@ -1111,7 +1111,7 @@ abstract class driver implements driver_interface - + @@ -1132,7 +1132,7 @@ abstract class driver implements driver_interface else { $error = $this->sql_error(); - $this->sql_report .= 'FAILED - ' . $this->sql_layer . ' Error ' . $error['code'] . ': ' . htmlspecialchars($error['message']); + $this->sql_report .= 'FAILED - ' . $this->sql_layer . ' Error ' . $error['code'] . ': ' . htmlspecialchars($error['message'], ENT_COMPAT); } $this->sql_report .= '



    '; @@ -1197,7 +1197,7 @@ abstract class driver implements driver_interface $color = ($time_db > $time_cache) ? 'green' : 'red'; $this->sql_report .= ''; - $this->sql_report .= '
    Query results obtained from the cache
    '; + $this->sql_report .= ''; $this->sql_report .= '

    '; $this->sql_report .= 'Before: ' . sprintf('%.5f', $this->curtime - $starttime) . 's | After: ' . sprintf('%.5f', $endtime - $starttime) . 's | Elapsed [cache]: ' . sprintf('%.5f', ($time_cache)) . 's | Elapsed [db]: ' . sprintf('%.5f', $time_db) . 's



    '; diff --git a/phpBB/phpbb/extension/metadata_manager.php b/phpBB/phpbb/extension/metadata_manager.php index 60b8db8310..706343495b 100644 --- a/phpBB/phpbb/extension/metadata_manager.php +++ b/phpBB/phpbb/extension/metadata_manager.php @@ -117,7 +117,7 @@ class metadata_manager */ public function sanitize_json(&$value, $key) { - $value = htmlspecialchars($value); + $value = htmlspecialchars($value, ENT_COMPAT); } /** diff --git a/phpBB/phpbb/install/helper/iohandler/ajax_iohandler.php b/phpBB/phpbb/install/helper/iohandler/ajax_iohandler.php index 2a608f504e..f4fb364c55 100644 --- a/phpBB/phpbb/install/helper/iohandler/ajax_iohandler.php +++ b/phpBB/phpbb/install/helper/iohandler/ajax_iohandler.php @@ -418,7 +418,7 @@ class ajax_iohandler extends iohandler_base if ($msg !== null) { - $link_properties['msg'] = htmlspecialchars_decode($this->language->lang($msg)); + $link_properties['msg'] = htmlspecialchars_decode($this->language->lang($msg), ENT_COMPAT); } $this->download[] = $link_properties; diff --git a/phpBB/phpbb/install/helper/iohandler/iohandler_base.php b/phpBB/phpbb/install/helper/iohandler/iohandler_base.php index 1797a6c9ad..2a29fd3300 100644 --- a/phpBB/phpbb/install/helper/iohandler/iohandler_base.php +++ b/phpBB/phpbb/install/helper/iohandler/iohandler_base.php @@ -108,7 +108,7 @@ abstract class iohandler_base implements iohandler_interface { if (!is_array($error_title) && strpos($error_title, '
    ') !== false) { - $error_title = strip_tags(htmlspecialchars_decode($error_title)); + $error_title = strip_tags(htmlspecialchars_decode($error_title, ENT_COMPAT)); } $this->errors[] = $this->translate_message($error_title, $error_description); } diff --git a/phpBB/phpbb/install/module/install_data/task/add_languages.php b/phpBB/phpbb/install/module/install_data/task/add_languages.php index 7ffdf4f276..cf661fb5d4 100644 --- a/phpBB/phpbb/install/module/install_data/task/add_languages.php +++ b/phpBB/phpbb/install/module/install_data/task/add_languages.php @@ -63,7 +63,7 @@ class add_languages extends \phpbb\install\task_base $lang_pack = array( 'lang_iso' => $lang_info['iso'], 'lang_dir' => $lang_info['iso'], - 'lang_english_name' => htmlspecialchars($lang_info['name']), + 'lang_english_name' => htmlspecialchars($lang_info['name'], ENT_COMPAT), 'lang_local_name' => htmlspecialchars($lang_info['local_name'], ENT_COMPAT, 'UTF-8'), 'lang_author' => htmlspecialchars($lang_info['author'], ENT_COMPAT, 'UTF-8'), ); diff --git a/phpBB/phpbb/install/module/install_finish/task/notify_user.php b/phpBB/phpbb/install/module/install_finish/task/notify_user.php index 57bff1e311..ea4fe92ec2 100644 --- a/phpBB/phpbb/install/module/install_finish/task/notify_user.php +++ b/phpBB/phpbb/install/module/install_finish/task/notify_user.php @@ -114,8 +114,8 @@ class notify_user extends \phpbb\install\task_base $messenger->to($this->config['board_email'], $this->install_config->get('admin_name')); $messenger->anti_abuse_headers($this->config, $this->user); $messenger->assign_vars(array( - 'USERNAME' => htmlspecialchars_decode($this->install_config->get('admin_name')), - 'PASSWORD' => htmlspecialchars_decode($this->install_config->get('admin_passwd'))) + 'USERNAME' => htmlspecialchars_decode($this->install_config->get('admin_name'), ENT_COMPAT), + 'PASSWORD' => htmlspecialchars_decode($this->install_config->get('admin_passwd'), ENT_COMPAT)) ); $messenger->send(NOTIFY_EMAIL); } diff --git a/phpBB/phpbb/install/module/obtain_data/task/obtain_server_data.php b/phpBB/phpbb/install/module/obtain_data/task/obtain_server_data.php index 5096ce284e..6b5a14c117 100644 --- a/phpBB/phpbb/install/module/obtain_data/task/obtain_server_data.php +++ b/phpBB/phpbb/install/module/obtain_data/task/obtain_server_data.php @@ -57,7 +57,7 @@ class obtain_server_data extends \phpbb\install\task_base implements \phpbb\inst $server_name = strtolower(htmlspecialchars_decode($this->io_handler->get_header_variable( 'Host', $this->io_handler->get_server_variable('SERVER_NAME') - ))); + ), ENT_COMPAT)); // HTTP HOST can carry a port number... if (strpos($server_name, ':') !== false) @@ -65,11 +65,11 @@ class obtain_server_data extends \phpbb\install\task_base implements \phpbb\inst $server_name = substr($server_name, 0, strpos($server_name, ':')); } - $script_path = htmlspecialchars_decode($this->io_handler->get_server_variable('PHP_SELF')); + $script_path = htmlspecialchars_decode($this->io_handler->get_server_variable('PHP_SELF'), ENT_COMPAT); if (!$script_path) { - $script_path = htmlspecialchars_decode($this->io_handler->get_server_variable('REQUEST_URI')); + $script_path = htmlspecialchars_decode($this->io_handler->get_server_variable('REQUEST_URI'), ENT_COMPAT); } $script_path = str_replace(array('\\', '//'), '/', $script_path); diff --git a/phpBB/phpbb/install/module/obtain_data/task/obtain_update_ftp_data.php b/phpBB/phpbb/install/module/obtain_data/task/obtain_update_ftp_data.php index d94cc4b5fd..0bf625d898 100644 --- a/phpBB/phpbb/install/module/obtain_data/task/obtain_update_ftp_data.php +++ b/phpBB/phpbb/install/module/obtain_data/task/obtain_update_ftp_data.php @@ -87,7 +87,7 @@ class obtain_update_ftp_data extends task_base $ftp_host = $this->iohandler->get_input('ftp_host', '', true); $ftp_user = $this->iohandler->get_input('ftp_user', '', true); - $ftp_pass = htmlspecialchars_decode($this->iohandler->get_input('ftp_pass', '', true)); + $ftp_pass = htmlspecialchars_decode($this->iohandler->get_input('ftp_pass', '', true), ENT_COMPAT); $ftp_path = $this->iohandler->get_input('ftp_path', '', true); $ftp_port = $this->iohandler->get_input('ftp_port', 21); $ftp_time = $this->iohandler->get_input('ftp_timeout', 10); diff --git a/phpBB/phpbb/message/message.php b/phpBB/phpbb/message/message.php index 6b742d6c00..e1475bd339 100644 --- a/phpBB/phpbb/message/message.php +++ b/phpBB/phpbb/message/message.php @@ -262,13 +262,13 @@ class message $messenger->headers('X-AntiAbuse: Username - ' . $this->sender_username); } - $messenger->subject(htmlspecialchars_decode($this->subject)); + $messenger->subject(htmlspecialchars_decode($this->subject, ENT_COMPAT)); $messenger->assign_vars(array( 'BOARD_CONTACT' => $contact, - 'TO_USERNAME' => htmlspecialchars_decode($recipient['to_name']), - 'FROM_USERNAME' => htmlspecialchars_decode($this->sender_name), - 'MESSAGE' => htmlspecialchars_decode($this->body)) + 'TO_USERNAME' => htmlspecialchars_decode($recipient['to_name'], ENT_COMPAT), + 'FROM_USERNAME' => htmlspecialchars_decode($this->sender_name, ENT_COMPAT), + 'MESSAGE' => htmlspecialchars_decode($this->body, ENT_COMPAT)) ); if (count($this->template_vars)) diff --git a/phpBB/phpbb/message/topic_form.php b/phpBB/phpbb/message/topic_form.php index dbb883c142..cc1c4514d7 100644 --- a/phpBB/phpbb/message/topic_form.php +++ b/phpBB/phpbb/message/topic_form.php @@ -122,7 +122,7 @@ class topic_form extends form $this->message->set_template('email_notify'); $this->message->set_template_vars(array( - 'TOPIC_NAME' => htmlspecialchars_decode($this->topic_row['topic_title']), + 'TOPIC_NAME' => htmlspecialchars_decode($this->topic_row['topic_title'], ENT_COMPAT), 'U_TOPIC' => generate_board_url() . '/viewtopic.' . $this->phpEx . '?f=' . $this->topic_row['forum_id'] . '&t=' . $this->topic_id, )); $this->message->set_body($this->body); diff --git a/phpBB/phpbb/notification/type/admin_activate_user.php b/phpBB/phpbb/notification/type/admin_activate_user.php index 78c10ac36a..7b407ce92d 100644 --- a/phpBB/phpbb/notification/type/admin_activate_user.php +++ b/phpBB/phpbb/notification/type/admin_activate_user.php @@ -150,7 +150,7 @@ class admin_activate_user extends \phpbb\notification\type\base $username = $this->user_loader->get_username($this->item_id, 'username'); return array( - 'USERNAME' => htmlspecialchars_decode($username), + 'USERNAME' => htmlspecialchars_decode($username, ENT_COMPAT), 'U_USER_DETAILS' => "{$board_url}/memberlist.{$this->php_ext}?mode=viewprofile&u={$this->item_id}", 'U_ACTIVATE' => "{$board_url}/ucp.{$this->php_ext}?mode=activate&u={$this->item_id}&k={$this->get_data('user_actkey')}", ); diff --git a/phpBB/phpbb/notification/type/disapprove_post.php b/phpBB/phpbb/notification/type/disapprove_post.php index 2d908eb254..2d2f7997b5 100644 --- a/phpBB/phpbb/notification/type/disapprove_post.php +++ b/phpBB/phpbb/notification/type/disapprove_post.php @@ -120,7 +120,7 @@ class disapprove_post extends \phpbb\notification\type\approve_post public function get_email_template_variables() { return array_merge(parent::get_email_template_variables(), array( - 'REASON' => htmlspecialchars_decode($this->get_data('disapprove_reason')), + 'REASON' => htmlspecialchars_decode($this->get_data('disapprove_reason'), ENT_COMPAT), )); } diff --git a/phpBB/phpbb/notification/type/disapprove_topic.php b/phpBB/phpbb/notification/type/disapprove_topic.php index c2522fb562..01d611238b 100644 --- a/phpBB/phpbb/notification/type/disapprove_topic.php +++ b/phpBB/phpbb/notification/type/disapprove_topic.php @@ -120,7 +120,7 @@ class disapprove_topic extends \phpbb\notification\type\approve_topic public function get_email_template_variables() { return array_merge(parent::get_email_template_variables(), array( - 'REASON' => htmlspecialchars_decode($this->get_data('disapprove_reason')), + 'REASON' => htmlspecialchars_decode($this->get_data('disapprove_reason'), ENT_COMPAT), )); } diff --git a/phpBB/phpbb/notification/type/forum.php b/phpBB/phpbb/notification/type/forum.php index 161ec1e780..a490881e48 100644 --- a/phpBB/phpbb/notification/type/forum.php +++ b/phpBB/phpbb/notification/type/forum.php @@ -130,10 +130,10 @@ class forum extends \phpbb\notification\type\post } return [ - 'AUTHOR_NAME' => htmlspecialchars_decode($username), - 'FORUM_NAME' => htmlspecialchars_decode(censor_text($this->get_data('forum_name'))), - 'POST_SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('post_subject'))), - 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title'))), + 'AUTHOR_NAME' => htmlspecialchars_decode($username, ENT_COMPAT), + 'FORUM_NAME' => htmlspecialchars_decode(censor_text($this->get_data('forum_name')), ENT_COMPAT), + 'POST_SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('post_subject')), ENT_COMPAT), + 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title')), ENT_COMPAT), 'U_VIEW_POST' => generate_board_url() . "/viewtopic.{$this->php_ext}?p={$this->item_id}#p{$this->item_id}", 'U_NEWEST_POST' => generate_board_url() . "/viewtopic.{$this->php_ext}?f={$this->get_data('forum_id')}&t={$this->item_parent_id}&e=1&view=unread#unread", diff --git a/phpBB/phpbb/notification/type/group_request.php b/phpBB/phpbb/notification/type/group_request.php index 28a9e73bf9..ce5231f9d1 100644 --- a/phpBB/phpbb/notification/type/group_request.php +++ b/phpBB/phpbb/notification/type/group_request.php @@ -133,8 +133,8 @@ class group_request extends \phpbb\notification\type\base $user_data = $this->user_loader->get_user($this->item_id); return array( - 'GROUP_NAME' => htmlspecialchars_decode($this->get_data('group_name')), - 'REQUEST_USERNAME' => htmlspecialchars_decode($user_data['username']), + 'GROUP_NAME' => htmlspecialchars_decode($this->get_data('group_name'), ENT_COMPAT), + 'REQUEST_USERNAME' => htmlspecialchars_decode($user_data['username'], ENT_COMPAT), 'U_PENDING' => generate_board_url() . "/ucp.{$this->php_ext}?i=groups&mode=manage&action=list&g={$this->item_parent_id}", 'U_GROUP' => generate_board_url() . "/memberlist.{$this->php_ext}?mode=group&g={$this->item_parent_id}", diff --git a/phpBB/phpbb/notification/type/pm.php b/phpBB/phpbb/notification/type/pm.php index c51586afb9..20b206e70b 100644 --- a/phpBB/phpbb/notification/type/pm.php +++ b/phpBB/phpbb/notification/type/pm.php @@ -164,8 +164,8 @@ class pm extends \phpbb\notification\type\base $user_data = $this->user_loader->get_user($this->get_data('from_user_id')); return array( - 'AUTHOR_NAME' => htmlspecialchars_decode($user_data['username']), - 'SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('message_subject'))), + 'AUTHOR_NAME' => htmlspecialchars_decode($user_data['username'], ENT_COMPAT), + 'SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('message_subject')), ENT_COMPAT), 'U_VIEW_MESSAGE' => generate_board_url() . '/ucp.' . $this->php_ext . "?i=pm&mode=view&p={$this->item_id}", ); diff --git a/phpBB/phpbb/notification/type/post.php b/phpBB/phpbb/notification/type/post.php index a25328ff43..a83a8a6d52 100644 --- a/phpBB/phpbb/notification/type/post.php +++ b/phpBB/phpbb/notification/type/post.php @@ -262,9 +262,9 @@ class post extends \phpbb\notification\type\base } return array( - 'AUTHOR_NAME' => htmlspecialchars_decode($username), - 'POST_SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('post_subject'))), - 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title'))), + 'AUTHOR_NAME' => htmlspecialchars_decode($username, ENT_COMPAT), + 'POST_SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('post_subject')), ENT_COMPAT), + 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title')), ENT_COMPAT), 'U_VIEW_POST' => generate_board_url() . "/viewtopic.{$this->php_ext}?p={$this->item_id}#p{$this->item_id}", 'U_NEWEST_POST' => generate_board_url() . "/viewtopic.{$this->php_ext}?f={$this->get_data('forum_id')}&t={$this->item_parent_id}&e=1&view=unread#unread", diff --git a/phpBB/phpbb/notification/type/quote.php b/phpBB/phpbb/notification/type/quote.php index 323c18b204..826d40e6da 100644 --- a/phpBB/phpbb/notification/type/quote.php +++ b/phpBB/phpbb/notification/type/quote.php @@ -168,7 +168,7 @@ class quote extends \phpbb\notification\type\post $user_data = $this->user_loader->get_user($this->get_data('poster_id')); return array_merge(parent::get_email_template_variables(), array( - 'AUTHOR_NAME' => htmlspecialchars_decode($user_data['username']), + 'AUTHOR_NAME' => htmlspecialchars_decode($user_data['username'], ENT_COMPAT), )); } diff --git a/phpBB/phpbb/notification/type/report_pm.php b/phpBB/phpbb/notification/type/report_pm.php index 0b2054b259..0fd2654cb1 100644 --- a/phpBB/phpbb/notification/type/report_pm.php +++ b/phpBB/phpbb/notification/type/report_pm.php @@ -143,11 +143,11 @@ class report_pm extends \phpbb\notification\type\pm $user_data = $this->user_loader->get_user($this->get_data('from_user_id')); return [ - 'AUTHOR_NAME' => htmlspecialchars_decode($user_data['username']), - 'SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('message_subject'))), + 'AUTHOR_NAME' => htmlspecialchars_decode($user_data['username'], ENT_COMPAT), + 'SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('message_subject')), ENT_COMPAT), /** @deprecated 3.2.6-RC1 (to be removed in 4.0.0) use {SUBJECT} instead in report_pm.txt */ - 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('message_subject'))), + 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('message_subject')), ENT_COMPAT), 'U_VIEW_REPORT' => generate_board_url() . "/mcp.{$this->php_ext}?r={$this->item_parent_id}&i=pm_reports&mode=pm_report_details", ]; diff --git a/phpBB/phpbb/notification/type/report_pm_closed.php b/phpBB/phpbb/notification/type/report_pm_closed.php index 1901a3b2d5..2c3a7cb3b0 100644 --- a/phpBB/phpbb/notification/type/report_pm_closed.php +++ b/phpBB/phpbb/notification/type/report_pm_closed.php @@ -104,9 +104,9 @@ class report_pm_closed extends \phpbb\notification\type\pm $closer_data = $this->user_loader->get_username($this->get_data('closer_id'), 'username'); return [ - 'AUTHOR_NAME' => htmlspecialchars_decode($sender_data['username']), - 'CLOSER_NAME' => htmlspecialchars_decode($closer_data['username']), - 'SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('message_subject'))), + 'AUTHOR_NAME' => htmlspecialchars_decode($sender_data['username'], ENT_COMPAT), + 'CLOSER_NAME' => htmlspecialchars_decode($closer_data['username'], ENT_COMPAT), + 'SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('message_subject')), ENT_COMPAT), 'U_VIEW_MESSAGE'=> generate_board_url() . "/ucp.{$this->php_ext}?i=pm&mode=view&p={$this->item_id}", ]; diff --git a/phpBB/phpbb/notification/type/report_post.php b/phpBB/phpbb/notification/type/report_post.php index e5e04bac6d..4548f29957 100644 --- a/phpBB/phpbb/notification/type/report_post.php +++ b/phpBB/phpbb/notification/type/report_post.php @@ -110,8 +110,8 @@ class report_post extends \phpbb\notification\type\post_in_queue $board_url = generate_board_url(); return array( - 'POST_SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('post_subject'))), - 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title'))), + 'POST_SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('post_subject')), ENT_COMPAT), + 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title')), ENT_COMPAT), 'U_VIEW_REPORT' => "{$board_url}/mcp.{$this->php_ext}?f={$this->get_data('forum_id')}&p={$this->item_id}&i=reports&mode=report_details#reports", 'U_VIEW_POST' => "{$board_url}/viewtopic.{$this->php_ext}?p={$this->item_id}#p{$this->item_id}", diff --git a/phpBB/phpbb/notification/type/report_post_closed.php b/phpBB/phpbb/notification/type/report_post_closed.php index 9344aa1fb7..5358846344 100644 --- a/phpBB/phpbb/notification/type/report_post_closed.php +++ b/phpBB/phpbb/notification/type/report_post_closed.php @@ -111,10 +111,10 @@ class report_post_closed extends \phpbb\notification\type\post $closer_username = $this->user_loader->get_username($this->get_data('closer_id'), 'username'); return [ - 'AUTHOR_NAME' => htmlspecialchars_decode($post_username), - 'CLOSER_NAME' => htmlspecialchars_decode($closer_username), - 'POST_SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('post_subject'))), - 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title'))), + 'AUTHOR_NAME' => htmlspecialchars_decode($post_username, ENT_COMPAT), + 'CLOSER_NAME' => htmlspecialchars_decode($closer_username, ENT_COMPAT), + 'POST_SUBJECT' => htmlspecialchars_decode(censor_text($this->get_data('post_subject')), ENT_COMPAT), + 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title')), ENT_COMPAT), 'U_VIEW_POST' => generate_board_url() . "/viewtopic.{$this->php_ext}?p={$this->item_id}#p{$this->item_id}", ]; diff --git a/phpBB/phpbb/notification/type/topic.php b/phpBB/phpbb/notification/type/topic.php index 2535cdaed6..f3aa93ffd8 100644 --- a/phpBB/phpbb/notification/type/topic.php +++ b/phpBB/phpbb/notification/type/topic.php @@ -217,9 +217,9 @@ class topic extends \phpbb\notification\type\base } return array( - 'AUTHOR_NAME' => htmlspecialchars_decode($username), - 'FORUM_NAME' => htmlspecialchars_decode($this->get_data('forum_name')), - 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title'))), + 'AUTHOR_NAME' => htmlspecialchars_decode($username, ENT_COMPAT), + 'FORUM_NAME' => htmlspecialchars_decode($this->get_data('forum_name'), ENT_COMPAT), + 'TOPIC_TITLE' => htmlspecialchars_decode(censor_text($this->get_data('topic_title')), ENT_COMPAT), 'U_TOPIC' => "{$board_url}/viewtopic.{$this->php_ext}?f={$this->item_parent_id}&t={$this->item_id}", 'U_VIEW_TOPIC' => "{$board_url}/viewtopic.{$this->php_ext}?f={$this->item_parent_id}&t={$this->item_id}", diff --git a/phpBB/phpbb/plupload/plupload.php b/phpBB/phpbb/plupload/plupload.php index a94fbb7617..f0b36abb40 100644 --- a/phpBB/phpbb/plupload/plupload.php +++ b/phpBB/phpbb/plupload/plupload.php @@ -163,7 +163,7 @@ class plupload 'S_PLUPLOAD' => true, 'FILTERS' => $filters, 'CHUNK_SIZE' => $chunk_size, - 'S_PLUPLOAD_URL' => htmlspecialchars_decode($s_action), + 'S_PLUPLOAD_URL' => htmlspecialchars_decode($s_action, ENT_COMPAT), 'MAX_ATTACHMENTS' => $max_files, 'ATTACH_ORDER' => ($this->config['display_order']) ? 'asc' : 'desc', 'L_TOO_MANY_ATTACHMENTS' => $this->user->lang('TOO_MANY_ATTACHMENTS', $max_files), diff --git a/phpBB/phpbb/search/fulltext_mysql.php b/phpBB/phpbb/search/fulltext_mysql.php index 581a20f506..b493ccf326 100644 --- a/phpBB/phpbb/search/fulltext_mysql.php +++ b/phpBB/phpbb/search/fulltext_mysql.php @@ -232,7 +232,7 @@ class fulltext_mysql extends \phpbb\search\base } // Filter out as above - $split_keywords = preg_replace("#[\n\r\t]+#", ' ', trim(htmlspecialchars_decode($keywords))); + $split_keywords = preg_replace("#[\n\r\t]+#", ' ', trim(htmlspecialchars_decode($keywords, ENT_COMPAT))); // Split words $split_keywords = preg_replace('#([^\p{L}\p{N}\'*"()])#u', '$1$1', str_replace('\'\'', '\' \'', trim($split_keywords))); @@ -597,7 +597,7 @@ class fulltext_mysql extends \phpbb\search\base $sql = "SELECT $sql_select FROM $sql_from$sql_sort_table" . POSTS_TABLE . " p - WHERE MATCH ($sql_match) AGAINST ('" . $this->db->sql_escape(htmlspecialchars_decode($this->search_query)) . "' IN BOOLEAN MODE) + WHERE MATCH ($sql_match) AGAINST ('" . $this->db->sql_escape(htmlspecialchars_decode($this->search_query, ENT_COMPAT)) . "' IN BOOLEAN MODE) $sql_where_options ORDER BY $sql_sort"; $this->db->sql_return_on_error(true); diff --git a/phpBB/phpbb/search/fulltext_postgres.php b/phpBB/phpbb/search/fulltext_postgres.php index d38ee88a75..0b7b32a6c6 100644 --- a/phpBB/phpbb/search/fulltext_postgres.php +++ b/phpBB/phpbb/search/fulltext_postgres.php @@ -204,7 +204,7 @@ class fulltext_postgres extends \phpbb\search\base } // Filter out as above - $split_keywords = preg_replace("#[\"\n\r\t]+#", ' ', trim(htmlspecialchars_decode($keywords))); + $split_keywords = preg_replace("#[\"\n\r\t]+#", ' ', trim(htmlspecialchars_decode($keywords, ENT_COMPAT))); // Split words $split_keywords = preg_replace('#([^\p{L}\p{N}\'*"()])#u', '$1$1', str_replace('\'\'', '\' \'', trim($split_keywords))); diff --git a/phpBB/phpbb/search/fulltext_sphinx.php b/phpBB/phpbb/search/fulltext_sphinx.php index df92cef983..8f24f970da 100644 --- a/phpBB/phpbb/search/fulltext_sphinx.php +++ b/phpBB/phpbb/search/fulltext_sphinx.php @@ -1045,7 +1045,7 @@ class fulltext_sphinx

    ' . $this->user->lang['FULLTEXT_SPHINX_CONFIG_FILE_EXPLAIN'] . '
    -
    ' . (($this->config_generate()) ? '' : $this->config_file_data) . '
    +
    ' . (($this->config_generate()) ? '' : $this->config_file_data) . '
    '; diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php index 743735a226..82f134eaf9 100644 --- a/phpBB/phpbb/session.php +++ b/phpBB/phpbb/session.php @@ -52,7 +52,7 @@ class session // If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support... if (!$script_name) { - $script_name = htmlspecialchars_decode($request->server('REQUEST_URI')); + $script_name = htmlspecialchars_decode($request->server('REQUEST_URI'), ENT_COMPAT); $script_name = (($pos = strpos($script_name, '?')) !== false) ? substr($script_name, 0, $pos) : $script_name; $page_array['failover'] = 1; } @@ -86,7 +86,7 @@ class session // basenamed page name (for example: index.php) $page_name = (substr($script_name, -1, 1) == '/') ? '' : basename($script_name); - $page_name = urlencode(htmlspecialchars($page_name)); + $page_name = urlencode(htmlspecialchars($page_name, ENT_COMPAT)); $symfony_request_path = filesystem_helper::clean_path($symfony_request->getPathInfo()); if ($symfony_request_path !== '/') @@ -151,8 +151,8 @@ class session 'page_dir' => $page_dir, 'query_string' => $query_string, - 'script_path' => str_replace(' ', '%20', htmlspecialchars($script_path)), - 'root_script_path' => str_replace(' ', '%20', htmlspecialchars($root_script_path)), + 'script_path' => str_replace(' ', '%20', htmlspecialchars($script_path, ENT_COMPAT)), + 'root_script_path' => str_replace(' ', '%20', htmlspecialchars($root_script_path, ENT_COMPAT)), 'page' => $page, 'forum' => $forum_id, @@ -169,7 +169,7 @@ class session global $config, $request; // Get hostname - $host = htmlspecialchars_decode($request->header('Host', $request->server('SERVER_NAME'))); + $host = htmlspecialchars_decode($request->header('Host', $request->server('SERVER_NAME')), ENT_COMPAT); // Should be a string and lowered $host = (string) strtolower($host); @@ -292,7 +292,7 @@ class session // Why no forwarded_for et al? Well, too easily spoofed. With the results of my recent requests // it's pretty clear that in the majority of cases you'll at least be left with a proxy/cache ip. - $ip = htmlspecialchars_decode($request->server('REMOTE_ADDR')); + $ip = htmlspecialchars_decode($request->server('REMOTE_ADDR'), ENT_COMPAT); $ip = preg_replace('# {2,}#', ' ', str_replace(',', ' ', $ip)); /** @@ -458,8 +458,8 @@ class session $s_ip, $u_browser, $s_browser, - htmlspecialchars($u_forwarded_for), - htmlspecialchars($s_forwarded_for) + htmlspecialchars($u_forwarded_for, ENT_COMPAT), + htmlspecialchars($s_forwarded_for, ENT_COMPAT) )); } else @@ -1585,7 +1585,7 @@ class session return true; } - $host = htmlspecialchars($this->host); + $host = htmlspecialchars($this->host, ENT_COMPAT); $ref = substr($this->referer, strpos($this->referer, '://') + 3); if (!(stripos($ref, $host) === 0) && (!$config['force_server_vars'] || !(stripos($ref, $config['server_name']) === 0))) diff --git a/phpBB/phpbb/textformatter/data_access.php b/phpBB/phpbb/textformatter/data_access.php index 0d37e62c87..27ce778904 100644 --- a/phpBB/phpbb/textformatter/data_access.php +++ b/phpBB/phpbb/textformatter/data_access.php @@ -227,7 +227,7 @@ class data_access { foreach ($columns as $column) { - $row[$column] = htmlspecialchars_decode($row[$column]); + $row[$column] = htmlspecialchars_decode($row[$column], ENT_COMPAT); } } diff --git a/phpBB/phpbb/ucp/controller/reset_password.php b/phpBB/phpbb/ucp/controller/reset_password.php index 6a6e9f5b47..30d2f1700f 100644 --- a/phpBB/phpbb/ucp/controller/reset_password.php +++ b/phpBB/phpbb/ucp/controller/reset_password.php @@ -118,7 +118,7 @@ class reset_password if (!$this->config['allow_password_reset']) { throw new http_exception(Response::HTTP_OK, 'UCP_PASSWORD_RESET_DISABLED', [ - '', + '', '' ]); } @@ -265,7 +265,7 @@ class reset_password $messenger->anti_abuse_headers($this->config, $this->user); $messenger->assign_vars([ - 'USERNAME' => htmlspecialchars_decode($user_row['username']), + 'USERNAME' => htmlspecialchars_decode($user_row['username'], ENT_COMPAT), 'U_RESET_PASSWORD' => generate_board_url(true) . $this->helper->route('phpbb_ucp_reset_password_controller', [ 'u' => $user_row['user_id'], 'token' => $reset_token, diff --git a/phpBB/phpbb/user.php b/phpBB/phpbb/user.php index b85f226497..fb3f666426 100644 --- a/phpBB/phpbb/user.php +++ b/phpBB/phpbb/user.php @@ -328,7 +328,7 @@ class user extends \phpbb\session if (is_string($default_value)) { - $this->style[$key] = htmlspecialchars($this->style[$key]); + $this->style[$key] = htmlspecialchars($this->style[$key], ENT_COMPAT); } } diff --git a/phpBB/search.php b/phpBB/search.php index c0f91abb91..048985b023 100644 --- a/phpBB/search.php +++ b/phpBB/search.php @@ -678,16 +678,16 @@ if ($keywords || $author || $author_id || $search_id || $submit) $hilit = phpbb_clean_search_string(str_replace(array('+', '-', '|', '(', ')', '"'), ' ', $keywords)); $hilit = str_replace(' ', '|', $hilit); - $u_hilit = urlencode(htmlspecialchars_decode(str_replace('|', ' ', $hilit))); + $u_hilit = urlencode(htmlspecialchars_decode(str_replace('|', ' ', $hilit), ENT_COMPAT)); $u_show_results = '&sr=' . $show_results; $u_search_forum = implode('&fid%5B%5D=', $search_forum); $u_search = append_sid("{$phpbb_root_path}search.$phpEx", $u_sort_param . $u_show_results); $u_search .= ($search_id) ? '&search_id=' . $search_id : ''; - $u_search .= ($u_hilit) ? '&keywords=' . urlencode(htmlspecialchars_decode($keywords)) : ''; + $u_search .= ($u_hilit) ? '&keywords=' . urlencode(htmlspecialchars_decode($keywords, ENT_COMPAT)) : ''; $u_search .= ($search_terms != 'all') ? '&terms=' . $search_terms : ''; $u_search .= ($topic_id) ? '&t=' . $topic_id : ''; - $u_search .= ($author) ? '&author=' . urlencode(htmlspecialchars_decode($author)) : ''; + $u_search .= ($author) ? '&author=' . urlencode(htmlspecialchars_decode($author, ENT_COMPAT)) : ''; $u_search .= ($author_id) ? '&author_id=' . $author_id : ''; $u_search .= ($u_search_forum) ? '&fid%5B%5D=' . $u_search_forum : ''; $u_search .= (!$search_child) ? '&sc=0' : ''; @@ -1569,7 +1569,7 @@ if ($auth->acl_get('a_search')) 'KEYWORDS' => $keywords, 'TIME' => $user->format_date($row['search_time']), - 'U_KEYWORDS' => append_sid("{$phpbb_root_path}search.$phpEx", 'keywords=' . urlencode(htmlspecialchars_decode($keywords))) + 'U_KEYWORDS' => append_sid("{$phpbb_root_path}search.$phpEx", 'keywords=' . urlencode(htmlspecialchars_decode($keywords, ENT_COMPAT))) )); } $db->sql_freeresult($result); diff --git a/tests/email/email_parsing_test.php b/tests/email/email_parsing_test.php index 5c4844927e..f5ec3f6f1a 100644 --- a/tests/email/email_parsing_test.php +++ b/tests/email/email_parsing_test.php @@ -122,8 +122,8 @@ class phpbb_email_parsing_test extends phpbb_test_case $this->messenger->set_addresses($user->data); $this->messenger->assign_vars(array( - 'EMAIL_SIG' => str_replace('
    ', "\n", "-- \n" . htmlspecialchars_decode($config['board_email_sig'])), - 'SITENAME' => htmlspecialchars_decode($config['sitename']), + 'EMAIL_SIG' => str_replace('
    ', "\n", "-- \n" . htmlspecialchars_decode($config['board_email_sig'], ENT_COMPAT)), + 'SITENAME' => htmlspecialchars_decode($config['sitename'], ENT_COMPAT), 'AUTHOR_NAME' => $author_name, 'FORUM_NAME' => $forum_name, @@ -142,8 +142,8 @@ class phpbb_email_parsing_test extends phpbb_test_case $this->assertStringContainsString($forum_name, $msg); $this->assertStringContainsString($topic_title, $msg); $this->assertStringContainsString($username, $msg); - $this->assertStringContainsString(htmlspecialchars_decode($config['sitename']), $msg); - $this->assertStringContainsString(str_replace('
    ', "\n", "-- \n" . htmlspecialchars_decode($config['board_email_sig'])), $msg); + $this->assertStringContainsString(htmlspecialchars_decode($config['sitename'], ENT_COMPAT), $msg); + $this->assertStringContainsString(str_replace('
    ', "\n", "-- \n" . htmlspecialchars_decode($config['board_email_sig'], ENT_COMPAT)), $msg); $this->assertStringNotContainsString('EMAIL_SIG', $msg); $this->assertStringNotContainsString('U_STOP_WATCHING_FORUM', $msg); } diff --git a/tests/upload/filespec_test.php b/tests/upload/filespec_test.php index c77a7ee401..9b01eb73fd 100644 --- a/tests/upload/filespec_test.php +++ b/tests/upload/filespec_test.php @@ -530,7 +530,7 @@ class phpbb_filespec_test extends phpbb_test_case $type_cast_helper->set_var($upload_name, $filename, 'string', true, true); $filespec = $this->get_filespec(array('name'=> $upload_name)); - $this->assertSame(trim(utf8_basename(htmlspecialchars($filename))), $filespec->get('uploadname')); + $this->assertSame(trim(utf8_basename(htmlspecialchars($filename, ENT_COMPAT))), $filespec->get('uploadname')); } public function test_is_uploaded()