972 Commits

Author SHA1 Message Date
nicolaasuni
d0e8dd17f8 Remove global phar config and add checks for allowed protocols 6.9.3 2025-04-20 16:52:50 +01:00
nicolaasuni
ea258d4d16 Disable PHAR protocol 6.9.2 2025-04-18 17:46:11 +01:00
nicolaasuni
ed27e28a4c Fixed Path Traversal security vulnerability reported by Positive Technologies 6.9.1 2025-04-03 07:38:07 +01:00
nicolaasuni
f67b761b61 Update version 6.9.0 2025-03-30 17:56:09 +01:00
Nicola Asuni
55ddad5f81
Merge pull request #795 from tecnickcom/20250330_prs
Group Pull requests.
6.8.3
2025-03-30 15:42:37 +01:00
nicolaasuni
0bc88c112e Bump version and changelog 2025-03-30 15:38:26 +01:00
nicolaasuni
bd6f7f2227 Bump version 2025-03-30 15:26:19 +01:00
nicolaasuni
fb4e14e871 Merge branch 'pdfa-validation' 2025-03-30 15:23:32 +01:00
nicolaasuni
b65446b310 Merge branch 'cleanup-tcpdf-import' 2025-03-30 15:21:26 +01:00
Kristof Ringleff, Fooman
9e5051e541 use verapdf for validation of pdfa pdfs
fix examples
update all references to PDF/A-3b
2025-02-12 16:20:29 +13:00
William Desportes
eea7967986
Also test on PHP 8.4 2025-02-09 17:07:00 +01:00
William Desportes
f83a912b6f
Upgrade upload-artifact
"This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/"
2025-02-09 17:06:56 +01:00
William Desportes
0d751c9e68
Drop not necessary archive exclude 2025-02-09 17:06:51 +01:00
William Desportes
8f54294247
Upgrade upload-artifact
"This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/"
2025-02-09 16:56:30 +01:00
William Desportes
90ca1b1576
Drop not necessary archive exclude 2025-02-09 16:51:10 +01:00
William Desportes
15a9bba4d6
Remove tcpdf_parser.php and tcpdf_import.php from TCPDF
They are unfinished files, that did not get attention or updates.
2025-02-09 16:49:28 +01:00
Nicola Asuni
f7a781073e
Merge pull request #781 from tecnickcom/fixes
Fixes
6.8.2
2025-01-26 14:03:12 +00:00
nicolaasuni
45b14703c9 Bump version 2025-01-26 13:59:45 +00:00
nicolaasuni
744c9ffa3b Merge branch 'patch-1' into fixes 2025-01-26 13:55:55 +00:00
Nicola Asuni
1029d4f9d4
Merge branch 'main' into patch-1 2025-01-26 13:52:51 +00:00
nicolaasuni
bf9f99fe73 Fix some annotation flags values. 2025-01-26 13:51:55 +00:00
Nicola Asuni
79bfbb448a
Merge pull request #780 from tecnickcom/imgpath
Forbid access to parent folders in SVG images path.
2025-01-26 13:44:35 +00:00
nicolaasuni
c6bd9a93a9 Forbid access to parent folders in SVG images path. 2025-01-26 13:37:38 +00:00
Nicola Asuni
14ffa0e308
Merge pull request #772 from tecnickcom/sanitize
Multiple fixes - REQUIRES PHP 7.1+.
6.8.0
2024-12-23 13:34:57 +00:00
nicolaasuni
306bdf9aca Test requires PHP 7.1+ 2024-12-23 13:32:06 +00:00
nicolaasuni
d0f52e184b Add CURL extension 2024-12-23 13:31:14 +00:00
nicolaasuni
818abfae4c Add curl extension in tests 2024-12-23 13:11:44 +00:00
nicolaasuni
a9d32801f1 Requires curl extension 2024-12-23 13:09:17 +00:00
nicolaasuni
ebfc0b855e Merge branch 'main' into sanitize 2024-12-23 13:00:26 +00:00
nicolaasuni
c9f41cbb84 Sanitize font-family attribute. 2024-12-23 12:55:00 +00:00
nicolaasuni
a0a02efe48 Add some addTTFfont fixes from tc-lib-pdf-font 2024-12-23 12:43:22 +00:00
nicolaasuni
aab43ab0a8 Add K_CURLOPTS config array to set custom cURL options (NOTE: some defaults have changed) 2024-12-23 12:32:44 +00:00
nicolaasuni
3d83609b1c Requires PHP 7.1+ 2024-12-23 12:20:27 +00:00
nicolaasuni
bc629a5759 Requires PHP 7+ 2024-12-23 12:17:18 +00:00
nicolaasuni
d54b97cec3 Use strict time-constant function to compare TCPDF-tag hashes. 2024-12-23 12:15:14 +00:00
nicolaasuni
387e803161 Requires PHP 5.6+ 2024-12-23 12:13:25 +00:00
nicolaasuni
11778aaa2d Escape error message 2024-12-23 12:12:07 +00:00
nicolaasuni
5c046cc18c Bump version 2024-12-23 12:10:18 +00:00
Ondrej Čerman
fdecefabfd Internal link to named destination does not require conversion 2024-12-19 10:50:44 +01:00
nicolaasuni
7956f5e378 Update version and changelog 6.7.8 2024-12-13 19:31:40 +00:00
nicolaasuni
e9b6d5864e Merge branch 'improve-svg-detection-regex' 2024-12-13 19:25:44 +00:00
Manuel Capinha
e88f371c90 remove namespace from svg regex 2024-12-04 10:58:29 +00:00
Manuel Capinha
122a2c61dc improve SVG detection by checking for (mandatory) namespace and closing tag 2024-11-26 11:54:15 +00:00
François-Xavier de Guillebon
ab7f779e33
use late state binding now that minimum PHP version is 5.5 2024-11-18 09:35:33 +01:00
Nicola Asuni
cfbc0028cc
Merge pull request #757 from tecnickcom/develop
New release version
6.7.7
2024-10-26 13:15:02 +01:00
nicolaasuni
696d233385 Bump version 2024-10-26 13:08:33 +01:00
nicolaasuni
17fe9597fb Update regexp to fix CVE-2024-22641 2024-10-26 13:08:26 +01:00
Nicola Asuni
01c96e89ef
Merge multiple PRs (#756)
* Ayesh: [PHP 8.4] Fix: Curl CURLOPT_BINARYTRANSFER deprecated #675

* THenkeDE: SVG detection fix for inline data images #646

* bruno-farias:  Fix count svg #647
2024-10-26 12:13:18 +01:00
Nicola Asuni
dad9e915a0
Multiple PRs (#755)
* Update tcpdf.php

Since the version 6.7.4, the "0" is considered like empty string and not displayed

* Update tcpdf.php

Co-authored-by: William Desportes <williamdes@wdes.fr>

* Fixed handling of transparency in PDF/A mode in addExtGState method

The condition allowed to add ExtGState in all PDF/A modes and disallowed
in default mode.

This fix inlines the condition with setExtGState to allow transparency
parameters for non-PDF/A and PDF/A > 1 documents.

The state condition is copied from 'setExtGState'.

* Encrypt /DA string when document is encrypted

When document is encrypted then /DA string must be encrypted,
without this Acrobat cannot allow fill form fields.

* Improve quality of generated seed, avoid potential security pitfall

* Try to use random_bytes() first if it's available
* Do not include the server parameters in the generated seed, as
they might contain sensitive data

As all current usages of getRandomSeed() directly hash the seed,
there should be no BC breaking changes.

The main source of entropy is more than enough on its own if
random_bytes() or openssl_random_pseudo_bytes() are available.

* Fix bug on _getannotsrefs when there are empty signature appearances but not other annot on a page

* Fix SVG coordinate parser that caused drawing artifacts

* Remove usage of xml_set_object() function

The xml_set_object() function will be deprecated in PHP 8.4 as well as
passing non-callable strings to the xml_set_*_handler() functions.

Instead of using xml_set_object(), the string method names in
xml_set_element_handler() and xml_set_character_data_handler() should be
replaced with callables.

- https://wiki.php.net/rfc/deprecations_php_8_4#xml_set_object_and_xml_set_handler_with_string_method_names

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>

---------

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
Co-authored-by: jlouche <61839660+jlouche@users.noreply.github.com>
Co-authored-by: William Desportes <williamdes@wdes.fr>
Co-authored-by: stollr <christian.stoller@mail.de>
Co-authored-by: Robert Jędrzejczyk <robert@prog.olsztyn.pl>
Co-authored-by: Andreas Erhard <andreas.erhard@i-med.ac.at>
Co-authored-by: Alejandro Precioso <aprecioso@bigtree.com.ar>
Co-authored-by: davidrod <david@gassiotllobet.com>
Co-authored-by: sslldavid <119080321+sslldavid@users.noreply.github.com>
Co-authored-by: Alejandro <aprecioso@gmail.com>
Co-authored-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
2024-10-26 10:29:48 +01:00
nicolaasuni
4cf1ab192e fix control for all PHP versions 6.7.6 2024-10-06 11:54:28 +01:00