diff --git a/build/build.xml b/build/build.xml index e748aabdb7..2ef9016a17 100644 --- a/build/build.xml +++ b/build/build.xml @@ -2,9 +2,9 @@ - - - + + + diff --git a/phpBB/develop/regex_idn.php b/phpBB/develop/regex_idn.php index d871695c50..30373f8de3 100644 --- a/phpBB/develop/regex_idn.php +++ b/phpBB/develop/regex_idn.php @@ -120,7 +120,7 @@ do $pct_encoded = "%[\dA-F]{2}"; $unreserved = "$add_chars\pL0-9\-._~"; $sub_delims = ($inline) ? '!$&\'(*+,;=' : '!$&\'()*+,;='; - $scheme = ($inline) ? '[a-z][a-z\d+]*': '[a-z][a-z\d+\-.]*' ; // avoid automatic parsing of "word" in "last word.http://..." + $scheme = ($inline) ? '[a-z][a-z\d+]*(?Changes since 3.2.0-a2
  • Changes since 3.2.0-a1
  • Changes since 3.1.x
    • +
  • Changes since 3.1.11
  • Changes since 3.1.10
  • Changes since 3.1.9
  • Changes since 3.1.8
    • @@ -128,6 +129,10 @@

    Changes since 3.2.1

    +

    Security Issue

    +
      +
    • [SECURITY-211] - URLs with javascript scheme should not be made clickable
      • +

    Bug

    • [PHPBB3-7845] - Error on posting local image when script path is empty
      • @@ -190,6 +195,10 @@
    • [PHPBB3-15464] - Can't reparse [IMG] - in uppercase
    • [PHPBB3-15475] - Restore Travis PR commit message validation
    • [PHPBB3-15478] - core.js $loadingIndicator JavaScript errors
      • +
    • [PHPBB3-15489] - Wrong footer text on forum of type "category"
      • +
    • [PHPBB3-15496] - SQL Error in PostgreSQL Fulltext search when results displayed as topics
      • +
    • [PHPBB3-15497] - Declaration of admin_activate_user::create_insert_array not compatible with base
      • +
    • [PHPBB3-15498] - confirm_box() adds duplicate strings to URLs in extensions

    Improvement

      @@ -850,6 +859,53 @@
    • [PHPBB3-14265] - Make all tables available in the container
    +

    Changes since 3.1.11

    + +

    Security Issue

    +
      +
    • [SECURITY-211] - URLs with javascript scheme should not be made clickable
      • +
    +

    Bug

    +
      +
    • [PHPBB3-9533] - phpbb_own_realpath() doesn't always replicate realpath() behaviour
      • +
    • [PHPBB3-12835] - Jump-box dropdown menu doesn't expand with according to line length in IE8
      • +
    • [PHPBB3-13360] - rename_too_long_indexes migration never deleted the old unique index
      • +
    • [PHPBB3-13464] - problem with drop down options and Arabic letters in chrome
      • +
    • [PHPBB3-13574] - Last post not showing in "Active topics" when Prosilver goes responsive
      • +
    • [PHPBB3-15174] - Unable to purge cache (ext & acp)
      • +
    • [PHPBB3-15285] - Travis tests are failing due to trusty changes
      • +
    • [PHPBB3-15303] - Typo in memcached driver
      • +
    • [PHPBB3-15347] - Password updater in cron generates invalid postgres SQL
      • +
    • [PHPBB3-15367] - Sphinx search backend doesn't escape special characters
      • +
    +

    Improvement

    +
      +
    • [PHPBB3-10122] - [list=] - should support "none", along with CSS2 types
      • +
    • [PHPBB3-11063] - Change version check to SSL
      • +
    • [PHPBB3-14820] - Style Version Missing
      • +
    • [PHPBB3-14919] - Inconsistent use of globals vs class elements in acp_extensions
      • +
    • [PHPBB3-14927] - event core.user_add_modify_data
      • +
    • [PHPBB3-14944] - Add possibility to search for template loop indexes by key
      • +
    • [PHPBB3-14995] - Add ACP template events acp_ext_list_*_name_after
      • +
    +

    New Feature

    + +

    Sub-task

    +
      +
    • [PHPBB3-11182] - Ensure that template files use L_COLON instead of colons.
      • +
    • [PHPBB3-11676] - generate_text_for_storage on includes/acp/acp_users.php
      • +
    +

    Task

    +
      +
    • [PHPBB3-10758] - Improve Functional Test Code Coverage
      • +
    • [PHPBB3-10791] - Add a section for extensions to readme.html
      • +
    • [PHPBB3-10792] - Add a section for 3.0 to 3.1 upgrades to install.html
      • +
    • [PHPBB3-13874] - Add master to sami API docs
      • +
    +

    Changes since 3.1.10

    Bug

    diff --git a/phpBB/includes/constants.php b/phpBB/includes/constants.php index 7eeb36595d..8a5d49358c 100644 --- a/phpBB/includes/constants.php +++ b/phpBB/includes/constants.php @@ -28,7 +28,7 @@ if (!defined('IN_PHPBB')) */ // phpBB Version -@define('PHPBB_VERSION', '3.2.3-dev'); +@define('PHPBB_VERSION', '3.2.2'); // QA-related // define('PHPBB_QA', 1); diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php index e9b7d999b5..4aae84705b 100644 --- a/phpBB/includes/functions.php +++ b/phpBB/includes/functions.php @@ -2185,7 +2185,7 @@ function confirm_box($check, $title = '', $hidden = '', $html_body = 'confirm_bo // re-add sid / transform & to & for user->page (user->page is always using &) $use_page = ($u_action) ? $u_action : str_replace('&', '&', $user->page['page']); - $u_action = reapply_sid($phpbb_path_helper->get_valid_page($use_page, $config['enable_mod_rewrite']), $phpbb_path_helper->is_router_used()); + $u_action = reapply_sid($phpbb_path_helper->get_valid_page($use_page, $config['enable_mod_rewrite'])); $u_action .= ((strpos($u_action, '?') === false) ? '?' : '&') . 'confirm_key=' . $confirm_key; $template->assign_vars(array( @@ -2780,12 +2780,17 @@ function get_preg_expression($mode) case 'url': // generated with regex_idn.php file in the develop folder - return "[a-z][a-z\d+\-.]*:/{2}(?:(?:[^\p{C}\p{Z}\p{S}\p{P}\p{Nl}\p{No}\p{Me}\x{1100}-\x{115F}\x{A960}-\x{A97C}\x{1160}-\x{11A7}\x{D7B0}-\x{D7C6}\x{20D0}-\x{20FF}\x{1D100}-\x{1D1FF}\x{1D200}-\x{1D24F}\x{0640}\x{07FA}\x{302E}\x{302F}\x{3031}-\x{3035}\x{303B}]*[\x{00B7}\x{0375}\x{05F3}\x{05F4}\x{30FB}\x{002D}\x{06FD}\x{06FE}\x{0F0B}\x{3007}\x{00DF}\x{03C2}\x{200C}\x{200D}\pL0-9\-._~!$&'()*+,;=:@|]+|%[\dA-F]{2})+|[0-9.]+|\[[a-z0-9.]+:[a-z0-9.]+:[a-z0-9.:]+\])(?::\d*)?(?:/(?:[^\p{C}\p{Z}\p{S}\p{P}\p{Nl}\p{No}\p{Me}\x{1100}-\x{115F}\x{A960}-\x{A97C}\x{1160}-\x{11A7}\x{D7B0}-\x{D7C6}\x{20D0}-\x{20FF}\x{1D100}-\x{1D1FF}\x{1D200}-\x{1D24F}\x{0640}\x{07FA}\x{302E}\x{302F}\x{3031}-\x{3035}\x{303B}]*[\x{00B7}\x{0375}\x{05F3}\x{05F4}\x{30FB}\x{002D}\x{06FD}\x{06FE}\x{0F0B}\x{3007}\x{00DF}\x{03C2}\x{200C}\x{200D}\pL0-9\-._~!$&'()*+,;=:@|]+|%[\dA-F]{2})*)*(?:\?(?:[^\p{C}\p{Z}\p{S}\p{P}\p{Nl}\p{No}\p{Me}\x{1100}-\x{115F}\x{A960}-\x{A97C}\x{1160}-\x{11A7}\x{D7B0}-\x{D7C6}\x{20D0}-\x{20FF}\x{1D100}-\x{1D1FF}\x{1D200}-\x{1D24F}\x{0640}\x{07FA}\x{302E}\x{302F}\x{3031}-\x{3035}\x{303B}]*[\x{00B7}\x{0375}\x{05F3}\x{05F4}\x{30FB}\x{002D}\x{06FD}\x{06FE}\x{0F0B}\x{3007}\x{00DF}\x{03C2}\x{200C}\x{200D}\pL0-9\-._~!$&'()*+,;=:@/?|]+|%[\dA-F]{2})*)?(?:\#(?:[^\p{C}\p{Z}\p{S}\p{P}\p{Nl}\p{No}\p{Me}\x{1100}-\x{115F}\x{A960}-\x{A97C}\x{1160}-\x{11A7}\x{D7B0}-\x{D7C6}\x{20D0}-\x{20FF}\x{1D100}-\x{1D1FF}\x{1D200}-\x{1D24F}\x{0640}\x{07FA}\x{302E}\x{302F}\x{3031}-\x{3035}\x{303B}]*[\x{00B7}\x{0375}\x{05F3}\x{05F4}\x{30FB}\x{002D}\x{06FD}\x{06FE}\x{0F0B}\x{3007}\x{00DF}\x{03C2}\x{200C}\x{200D}\pL0-9\-._~!$&'()*+,;=:@/?|]+|%[\dA-F]{2})*)?"; + return "[a-z][a-z\d+\-.]*(? 0) + else if (!preg_match('#^http[s]?://#i', $url) && strlen($url) > 0) { return 'http://' . $url; } diff --git a/phpBB/install/schemas/schema_data.sql b/phpBB/install/schemas/schema_data.sql index 1f92439c70..6075b8d589 100644 --- a/phpBB/install/schemas/schema_data.sql +++ b/phpBB/install/schemas/schema_data.sql @@ -279,7 +279,7 @@ INSERT INTO phpbb_config (config_name, config_value) VALUES ('tpl_allow_php', '0 INSERT INTO phpbb_config (config_name, config_value) VALUES ('upload_icons_path', 'images/upload_icons'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('upload_path', 'files'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('use_system_cron', '0'); -INSERT INTO phpbb_config (config_name, config_value) VALUES ('version', '3.2.3-dev'); +INSERT INTO phpbb_config (config_name, config_value) VALUES ('version', '3.2.2'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('warnings_expire_days', '90'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('warnings_gc', '14400'); diff --git a/phpBB/language/en/viewforum.php b/phpBB/language/en/viewforum.php index cab205ddf9..e2a6e2a718 100644 --- a/phpBB/language/en/viewforum.php +++ b/phpBB/language/en/viewforum.php @@ -54,6 +54,7 @@ $lang = array_merge($lang, array( 'NO_NEW_POSTS_HOT' => 'No new posts [ Popular ]', // Not used anymore 'NO_NEW_POSTS_LOCKED' => 'No new posts [ Locked ]', // Not used anymore 'NO_READ_ACCESS' => 'You do not have the required permissions to view or read topics within this forum.', + 'NO_FORUMS_IN_CATEGORY' => 'This category has no forums.', 'NO_UNREAD_POSTS_HOT' => 'No unread posts [ Popular ]', 'NO_UNREAD_POSTS_LOCKED' => 'No unread posts [ Locked ]', diff --git a/phpBB/phpbb/db/migration/data/v31x/v3112.php b/phpBB/phpbb/db/migration/data/v31x/v3112.php new file mode 100644 index 0000000000..0d75d35184 --- /dev/null +++ b/phpBB/phpbb/db/migration/data/v31x/v3112.php @@ -0,0 +1,36 @@ + +* @license GNU General Public License, version 2 (GPL-2.0) +* +* For full copyright and license information, please see +* the docs/CREDITS.txt file. +* +*/ + +namespace phpbb\db\migration\data\v31x; + +class v3112 extends \phpbb\db\migration\migration +{ + public function effectively_installed() + { + return phpbb_version_compare($this->config['version'], '3.1.12', '>='); + } + + static public function depends_on() + { + return array( + '\phpbb\db\migration\data\v31x\v3111', + ); + } + + public function update_data() + { + return array( + array('config.update', array('version', '3.1.12')), + ); + } +} diff --git a/phpBB/phpbb/db/migration/data/v32x/v322.php b/phpBB/phpbb/db/migration/data/v32x/v322.php new file mode 100644 index 0000000000..7ecbbb3e79 --- /dev/null +++ b/phpBB/phpbb/db/migration/data/v32x/v322.php @@ -0,0 +1,37 @@ + +* @license GNU General Public License, version 2 (GPL-2.0) +* +* For full copyright and license information, please see +* the docs/CREDITS.txt file. +* +*/ + +namespace phpbb\db\migration\data\v32x; + +class v322 extends \phpbb\db\migration\migration +{ + public function effectively_installed() + { + return phpbb_version_compare($this->config['version'], '3.2.2', '>='); + } + + static public function depends_on() + { + return array( + '\phpbb\db\migration\data\v31x\v3112', + '\phpbb\db\migration\data\v32x\v322rc1', + ); + } + + public function update_data() + { + return array( + array('config.update', array('version', '3.2.2')), + ); + } +} diff --git a/phpBB/phpbb/install/module/update_filesystem/task/download_updated_files.php b/phpBB/phpbb/install/module/update_filesystem/task/download_updated_files.php index 0b83e9a79d..4d7f0e0cdf 100644 --- a/phpBB/phpbb/install/module/update_filesystem/task/download_updated_files.php +++ b/phpBB/phpbb/install/module/update_filesystem/task/download_updated_files.php @@ -86,7 +86,8 @@ class download_updated_files extends task_base { $file_update_info = $this->installer_config->get('update_files', array()); - if (count($file_update_info) > 0) + // Display download box only if the archive won't be empty + if (!empty($file_update_info) && !(isset($file_update_info['delete']) && count($file_update_info) == 1)) { // Render download box $this->iohandler->add_download_link( diff --git a/phpBB/phpbb/profilefields/type/type_url.php b/phpBB/phpbb/profilefields/type/type_url.php index 375cf5b19a..37815b66a5 100644 --- a/phpBB/phpbb/profilefields/type/type_url.php +++ b/phpBB/phpbb/profilefields/type/type_url.php @@ -64,11 +64,24 @@ class type_url extends type_string return false; } - if (!preg_match('#^' . get_preg_expression('url') . '$#iu', $field_value)) + if (!preg_match('#^' . get_preg_expression('url_http') . '$#iu', $field_value)) { return $this->user->lang('FIELD_INVALID_URL', $this->get_field_name($field_data['lang_name'])); } return false; } + + /** + * {@inheritDoc} + */ + public function get_profile_value($field_value, $field_data) + { + if (!preg_match('#^' . get_preg_expression('url_http') . '$#iu', $field_value)) + { + return null; + } + + return parent::get_profile_value($field_value, $field_data); + } } diff --git a/phpBB/phpbb/search/fulltext_postgres.php b/phpBB/phpbb/search/fulltext_postgres.php index 4fe7e3b88d..6443342057 100644 --- a/phpBB/phpbb/search/fulltext_postgres.php +++ b/phpBB/phpbb/search/fulltext_postgres.php @@ -498,7 +498,7 @@ class fulltext_postgres extends \phpbb\search\base ); extract($this->phpbb_dispatcher->trigger_event('core.search_postgres_keywords_main_query_before', compact($vars))); - $sql_select = ($type == 'posts') ? 'p.post_id' : 'DISTINCT t.topic_id'; + $sql_select = ($type == 'posts') ? 'p.post_id' : 'DISTINCT t.topic_id, ' . $sort_by_sql[$sort_key]; $sql_from = ($join_topic) ? TOPICS_TABLE . ' t, ' : ''; $field = ($type == 'posts') ? 'post_id' : 'topic_id'; diff --git a/phpBB/styles/prosilver/template/viewforum_body.html b/phpBB/styles/prosilver/template/viewforum_body.html index 994d75f244..b5e12cdde4 100644 --- a/phpBB/styles/prosilver/template/viewforum_body.html +++ b/phpBB/styles/prosilver/template/viewforum_body.html @@ -250,10 +250,10 @@ {L_NO_TOPICS}
    - +
    - {L_NO_FORUMS} + {L_NO_FORUMS_IN_CATEGORY}
    diff --git a/tests/functions/make_clickable_test.php b/tests/functions/make_clickable_test.php index a351a6d527..a6af12b624 100644 --- a/tests/functions/make_clickable_test.php +++ b/tests/functions/make_clickable_test.php @@ -52,6 +52,14 @@ class phpbb_functions_make_clickable_test extends phpbb_test_case 'http://testhost/viewtopic.php?t=1', 'viewtopic.php?t=1' ), + array( + 'javascript://testhost/viewtopic.php?t=1', + 'javascript://testhost/viewtopic.php?t=1' + ), + array( + "java\nscri\npt://testhost/viewtopic.php?t=1", + "java\nscri\npt://testhost/viewtopic.php?t=1" + ), array( 'email@domain.com', 'email@domain.com' @@ -89,6 +97,10 @@ class phpbb_functions_make_clickable_test extends phpbb_test_case 'ftp://ftp.täst.de/', 'ftp://ftp.täst.de/' ), + array( + 'javascript://täst.de/', + 'javascript://täst.de/' + ), array( 'sip://bantu@täst.de', 'sip://bantu@täst.de' diff --git a/tests/profilefields/type_string_test.php b/tests/profilefields/type_string_test.php index 7c7fa3f3e6..54bb406838 100644 --- a/tests/profilefields/type_string_test.php +++ b/tests/profilefields/type_string_test.php @@ -24,7 +24,7 @@ class phpbb_profilefield_type_string_test extends phpbb_test_case */ public function setUp() { - global $request, $user, $cache, $phpbb_root_path, $phpEx; + global $config, $request, $user, $cache, $phpbb_root_path, $phpEx; $user = $this->getMock('\phpbb\user', array(), array( new \phpbb\language\language(new \phpbb\language\language_file_loader($phpbb_root_path, $phpEx)), @@ -34,6 +34,7 @@ class phpbb_profilefield_type_string_test extends phpbb_test_case $user->expects($this->any()) ->method('lang') ->will($this->returnCallback(array($this, 'return_callback_implode'))); + $config = new \phpbb\config\config([]); $request = $this->getMock('\phpbb\request\request'); $template = $this->getMock('\phpbb\template\template'); @@ -269,6 +270,18 @@ class phpbb_profilefield_type_string_test extends phpbb_test_case null, 'Field should simply output null for empty vlaue', ), + array( + 'http://foobar.com', + array('field_show_novalue' => false), + 'foobar.com', + 'Field should output the given value and make it clickable', + ), + array( + 'javascript://foobar.com', + array('field_show_novalue' => true), + 'javascript://foobar.com', + 'Field should output the given value but not make it clickable', + ), ); } diff --git a/tests/profilefields/type_url_test.php b/tests/profilefields/type_url_test.php index 1d90e2c34c..3bb5d52899 100644 --- a/tests/profilefields/type_url_test.php +++ b/tests/profilefields/type_url_test.php @@ -11,6 +11,10 @@ * */ +require_once dirname(__FILE__) . '/../../phpBB/includes/functions.php'; +require_once dirname(__FILE__) . '/../../phpBB/includes/functions_content.php'; +require_once dirname(__FILE__) . '/../../phpBB/includes/utf/utf_tools.php'; + class phpbb_profilefield_type_url_test extends phpbb_test_case { protected $cp; @@ -24,8 +28,10 @@ class phpbb_profilefield_type_url_test extends phpbb_test_case */ public function setUp() { - global $phpbb_root_path, $phpEx; + global $config, $request, $user, $cache, $phpbb_root_path, $phpEx; + $config = new \phpbb\config\config([]); + $cache = new phpbb_mock_cache; $user = $this->getMock('\phpbb\user', array(), array( new \phpbb\language\language(new \phpbb\language\language_file_loader($phpbb_root_path, $phpEx)), '\phpbb\datetime' @@ -92,6 +98,19 @@ class phpbb_profilefield_type_url_test extends phpbb_test_case 'FIELD_INVALID_URL-field', 'Field should reject invalid URL having multi value parameters', ), + // Not allowed schemes + array( + 'ftp://example.com/', + array(), + 'FIELD_INVALID_URL-field', + 'Field should reject invalid URL having multi value parameters', + ), + array( + 'javascript://alert.com', + array(), + 'FIELD_INVALID_URL-field', + 'Field should reject invalid URL having multi value parameters', + ), // IDN url type profilefields array( @@ -165,6 +184,55 @@ class phpbb_profilefield_type_url_test extends phpbb_test_case ); } + public function profile_value_data() + { + return array( + array( + 'http://foobar.com', + array('field_show_novalue' => true), + 'foobar.com', + 'Field should output the given value', + ), + array( + 'http://foobar.com', + array('field_show_novalue' => false), + 'foobar.com', + 'Field should output the given value', + ), + array( + 'test', + array('field_show_novalue' => true), + null, + 'Field should output nothing for empty value', + ), + array( + 'test', + array('field_show_novalue' => false), + null, + 'Field should simply output null for empty value', + ), + array( + 'javascript://foobar.com', + array('field_show_novalue' => true), + null, + 'Field should output nothing for empty value', + ), + ); + } + + + /** + * @dataProvider profile_value_data + */ + public function test_get_profile_value($value, $field_options, $expected, $description) + { + $field_options = array_merge($this->field_options, $field_options); + + $result = $this->cp->get_profile_value($value, $field_options); + + $this->assertSame($expected, $result, $description); + } + /** * @dataProvider profile_value_raw_data */