mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-31 05:50:42 +02:00
Code Issues Releases Wiki Activity

[ticket/security/243] Fail silently on unsupported values for font size

Browse Source 
SECURITY-243
This commit is contained in:
Marc Alexander
2019-08-31 18:13:24 +02:00
parent b4f9c44b30
commit cc8d6a5a01
2 changed files with 1 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
phpBB/phpbb/textformatter/s9e/parser.php
View File

@@ -228,10 +228,6 @@ class parser implements \phpbb\textformatter\parser_interface
{
$errors[] = array($msg);
}
else if ($msg === 'INVALID_FONT_SIZE')
{
$errors[] = [$msg, $context['invalid_size']];
}
}
// Deduplicate error messages. array_unique() only works on strings so we have to serialize
@@ -339,13 +335,6 @@ class parser implements \phpbb\textformatter\parser_interface
*/
static public function filter_font_size($size, $max_size, Logger $logger)
{
if (!is_numeric($size))
{
$logger->err('INVALID_FONT_SIZE', ['invalid_size' => htmlspecialchars($size)]);
return false;
}
if ($max_size && $size > $max_size)
{
$logger->err('MAX_FONT_SIZE_EXCEEDED', array('max_size' => $max_size));
@@ -353,7 +342,7 @@ class parser implements \phpbb\textformatter\parser_interface
return false;
}
if ($size < 1)
if ($size < 1 || !is_numeric($size))
{
return false;
}