mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-30 21:40:43 +02:00
Code Issues Releases Wiki Activity

Merge branch 'develop-olympus' into develop

Browse Source 
* develop-olympus:
  [prep-release-3.0.8] Incrementing version number to 3.0.8 and update changelog
  [ticket/9903] Script for detecting potentially malicious flash bbcodes
  [ticket/9904] Update WebPI Parameters.xml to work with WebMatrix.
  [ticket/9903] Fix XSS in BBcode-parser's Flash-BBcode.
This commit is contained in:
Nils Adermann
2010-11-20 17:56:17 +01:00
parent 635752fafc d2778e67ea
commit 67593824d4
7 changed files with 265 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
phpBB/includes/constants.php
View File

@@ -275,4 +275,4 @@ define('ZEBRA_TABLE', $table_prefix . 'zebra');
// Additional tables
?>
?>

9
phpBB/includes/message_parser.php
View File

@@ -352,6 +352,15 @@ class bbcode_firstpass extends bbcode
return '[flash=' . $width . ',' . $height . ']' . $in . '[/flash]';
}
$in = str_replace(' ', '%20', $in);
// Make sure $in is a URL.
if (!preg_match('#^' . get_preg_expression('url') . '$#i', $in) &&
!preg_match('#^' . get_preg_expression('www_url') . '$#i', $in))
{
return '[flash=' . $width . ',' . $height . ']' . $in . '[/flash]';
}
// Apply the same size checks on flash files as on images
if ($config['max_' . $this->mode . '_img_height'] || $config['max_' . $this->mode . '_img_width'])
{