diff --git a/phpBB/develop/regex_idn.php b/phpBB/develop/regex_idn.php index d871695c50..30373f8de3 100644 --- a/phpBB/develop/regex_idn.php +++ b/phpBB/develop/regex_idn.php @@ -120,7 +120,7 @@ do $pct_encoded = "%[\dA-F]{2}"; $unreserved = "$add_chars\pL0-9\-._~"; $sub_delims = ($inline) ? '!$&\'(*+,;=' : '!$&\'()*+,;='; - $scheme = ($inline) ? '[a-z][a-z\d+]*': '[a-z][a-z\d+\-.]*' ; // avoid automatic parsing of "word" in "last word.http://..." + $scheme = ($inline) ? '[a-z][a-z\d+]*(? 0) + else if (!preg_match('#^http[s]?://#i', $url) && strlen($url) > 0) { return 'http://' . $url; } diff --git a/phpBB/phpbb/profilefields/type/type_url.php b/phpBB/phpbb/profilefields/type/type_url.php index 375cf5b19a..37815b66a5 100644 --- a/phpBB/phpbb/profilefields/type/type_url.php +++ b/phpBB/phpbb/profilefields/type/type_url.php @@ -64,11 +64,24 @@ class type_url extends type_string return false; } - if (!preg_match('#^' . get_preg_expression('url') . '$#iu', $field_value)) + if (!preg_match('#^' . get_preg_expression('url_http') . '$#iu', $field_value)) { return $this->user->lang('FIELD_INVALID_URL', $this->get_field_name($field_data['lang_name'])); } return false; } + + /** + * {@inheritDoc} + */ + public function get_profile_value($field_value, $field_data) + { + if (!preg_match('#^' . get_preg_expression('url_http') . '$#iu', $field_value)) + { + return null; + } + + return parent::get_profile_value($field_value, $field_data); + } } diff --git a/tests/functions/make_clickable_test.php b/tests/functions/make_clickable_test.php index 63beeb06b2..2bb7721d21 100644 --- a/tests/functions/make_clickable_test.php +++ b/tests/functions/make_clickable_test.php @@ -55,6 +55,14 @@ class phpbb_functions_make_clickable_test extends phpbb_test_case 'http://testhost/viewtopic.php?t=1', 'viewtopic.php?t=1' ), + array( + 'javascript://testhost/viewtopic.php?t=1', + 'javascript://testhost/viewtopic.php?t=1' + ), + array( + "java\nscri\npt://testhost/viewtopic.php?t=1", + "java\nscri\npt://testhost/viewtopic.php?t=1" + ), array( 'email@domain.com', 'email@domain.com' @@ -92,6 +100,10 @@ class phpbb_functions_make_clickable_test extends phpbb_test_case 'ftp://ftp.täst.de/', 'ftp://ftp.täst.de/' ), + array( + 'javascript://täst.de/', + 'javascript://täst.de/' + ), array( 'sip://bantu@täst.de', 'sip://bantu@täst.de' diff --git a/tests/profilefields/type_string_test.php b/tests/profilefields/type_string_test.php index 0417afbfab..9709b48470 100644 --- a/tests/profilefields/type_string_test.php +++ b/tests/profilefields/type_string_test.php @@ -270,6 +270,18 @@ class phpbb_profilefield_type_string_test extends phpbb_test_case null, 'Field should simply output null for empty vlaue', ), + array( + 'http://foobar.com', + array('field_show_novalue' => false), + 'foobar.com', + 'Field should output the given value and make it clickable', + ), + array( + 'javascript://foobar.com', + array('field_show_novalue' => true), + 'javascript://foobar.com', + 'Field should output the given value but not make it clickable', + ), ); } diff --git a/tests/profilefields/type_url_test.php b/tests/profilefields/type_url_test.php index cc37f04f30..af17cc125a 100644 --- a/tests/profilefields/type_url_test.php +++ b/tests/profilefields/type_url_test.php @@ -12,6 +12,8 @@ */ require_once dirname(__FILE__) . '/../../phpBB/includes/functions.php'; +require_once dirname(__FILE__) . '/../../phpBB/includes/functions_content.php'; +require_once dirname(__FILE__) . '/../../phpBB/includes/utf/utf_tools.php'; class phpbb_profilefield_type_url_test extends phpbb_test_case { @@ -26,6 +28,9 @@ class phpbb_profilefield_type_url_test extends phpbb_test_case */ public function setUp() { + global $request, $user, $cache; + + $cache = new phpbb_mock_cache; $user = $this->getMock('\phpbb\user', array(), array('\phpbb\datetime')); $user->expects($this->any()) ->method('lang') @@ -89,6 +94,19 @@ class phpbb_profilefield_type_url_test extends phpbb_test_case 'FIELD_INVALID_URL-field', 'Field should reject invalid URL having multi value parameters', ), + // Not allowed schemes + array( + 'ftp://example.com/', + array(), + 'FIELD_INVALID_URL-field', + 'Field should reject invalid URL having multi value parameters', + ), + array( + 'javascript://alert.com', + array(), + 'FIELD_INVALID_URL-field', + 'Field should reject invalid URL having multi value parameters', + ), // IDN url type profilefields array( @@ -162,6 +180,55 @@ class phpbb_profilefield_type_url_test extends phpbb_test_case ); } + public function profile_value_data() + { + return array( + array( + 'http://foobar.com', + array('field_show_novalue' => true), + 'foobar.com', + 'Field should output the given value', + ), + array( + 'http://foobar.com', + array('field_show_novalue' => false), + 'foobar.com', + 'Field should output the given value', + ), + array( + 'test', + array('field_show_novalue' => true), + null, + 'Field should output nothing for empty value', + ), + array( + 'test', + array('field_show_novalue' => false), + null, + 'Field should simply output null for empty value', + ), + array( + 'javascript://foobar.com', + array('field_show_novalue' => true), + null, + 'Field should output nothing for empty value', + ), + ); + } + + + /** + * @dataProvider profile_value_data + */ + public function test_get_profile_value($value, $field_options, $expected, $description) + { + $field_options = array_merge($this->field_options, $field_options); + + $result = $this->cp->get_profile_value($value, $field_options); + + $this->assertSame($expected, $result, $description); + } + /** * @dataProvider profile_value_raw_data */