Skip to content

Commit 02af92e

Browse files
thorstenthorsten
committed
Merge branch '3.2'
2 parents ea92806 + c5f0f73 commit 02af92e

File tree

20 files changed

+780
-824
lines changed

20 files changed

+780
-824
lines changed

‎CHANGELOG.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,16 @@ This is a log of major user-visible changes in each phpMyFAQ release.
4141
- migrated from SwiftMailer to Symfony Mailer (Thorsten)
4242
- migrated codebase to use PHP 8.1 language features (Thorsten)
4343
- updated to Bootstrap v5.3 (Thorsten)
44-
- updated to TinyMCE v6.4 (Thorsten)
44+
- updated to TinyMCE v6.6 (Thorsten)
4545
- updated to PHPUnit v10 (Thorsten)
4646
- updated Japanese translation (Advanced Bear)
4747
- updated Dutch translation (Bob Coret)
4848

49+
### phpMyFAQ v3.1.16 - 2023-07-16
50+
51+
- fixed multiple security vulnerabilities (Thorsten)
52+
- fixed minor bugs (Thorsten)
53+
4954
### phpMyFAQ v3.1.15 - 2023-06-17
5055

5156
- fixed minor bugs (Thorsten)

‎composer.lock

Lines changed: 18 additions & 18 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎phpmyfaq/admin/api/user.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
use phpMyFAQ\Filter;
2323
use phpMyFAQ\Helper\MailHelper;
2424
use phpMyFAQ\Permission;
25+
use phpMyFAQ\Report;
2526
use phpMyFAQ\Session\Token;
2627
use phpMyFAQ\Strings;
2728
use phpMyFAQ\Translation;
@@ -94,8 +95,8 @@
9495
$userObject->status = $user->getStatus();
9596
$userObject->isSuperAdmin = $user->isSuperAdmin();
9697
$userObject->isVisible = $user->getUserData('is_visible');
97-
$userObject->displayName = $user->getUserData('display_name');
98-
$userObject->userName = $user->getLogin();
98+
$userObject->displayName = Report::sanitize($user->getUserData('display_name'));
99+
$userObject->userName = Report::sanitize($user->getLogin());
99100
$userObject->email = $user->getUserData('email');
100101
$userObject->authSource = $user->getUserAuthSource();
101102
$userData[] = $userObject;

‎phpmyfaq/admin/report.export.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,8 @@
122122

123123
$content = '';
124124
foreach ($text as $row) {
125-
$content .= implode(';', $row);
125+
$csvRow = array_map(['phpMyFAQ\Report', 'sanitize'], $row);
126+
$content .= implode(';', $csvRow);
126127
$content .= "\r\n";
127128
}
128129

‎phpmyfaq/content/core/config/constants.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@
113113
*
114114
* - hash (default)
115115
* - bcrypt
116-
* - crypt (not recommended)
116+
* - crypt (not recommended, marked as deprecated, will be removed with v3.3)
117117
*
118118
* WARNING: DO NOT CHANGE THIS VALUE AFTER YOUR INITIAL INSTALLATION!
119119
* OTHERWISE, ALL YOUR REGISTERED USERS HAVE TO REQUEST A NEW PASSWORD.

‎phpmyfaq/register.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@
3030
$request = Request::createFromGlobals();
3131

3232
if (!$faqConfig->get('security.enableRegistration')) {
33-
$response = new RedirectResponse('$faqSystem->getSystemUri($faqConfig)');
34-
$response->send();
33+
$redirect = new RedirectResponse($faqSystem->getSystemUri($faqConfig));
34+
$redirect->send();
3535
}
3636

3737
try {

‎phpmyfaq/services/azure/callback.php

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,16 @@
1717

1818
use GuzzleHttp\Exception\GuzzleException;
1919
use phpMyFAQ\Auth\AuthAzureActiveDirectory;
20+
use phpMyFAQ\Configuration;
2021
use phpMyFAQ\Filter;
2122
use phpMyFAQ\Session;
2223
use phpMyFAQ\Auth\Azure\OAuth;
2324
use phpMyFAQ\User\CurrentUser;
2425
use Symfony\Component\HttpFoundation\RedirectResponse;
2526

27+
session_start();
28+
session_regenerate_id(true);
29+
2630
//
2731
// Prepend and start the PHP session
2832
//
@@ -36,13 +40,17 @@
3640
require PMF_ROOT_DIR . '/src/Bootstrap.php';
3741
require PMF_CONFIG_DIR . '/azure.php';
3842

43+
$faqConfig = Configuration::getConfigurationInstance();
44+
3945
$code = Filter::filterInput(INPUT_GET, 'code', FILTER_SANITIZE_SPECIAL_CHARS);
4046
$error = Filter::filterInput(INPUT_GET, 'error_description', FILTER_SANITIZE_SPECIAL_CHARS);
4147

4248
$session = new Session($faqConfig);
4349
$oAuth = new OAuth($faqConfig, $session);
4450
$auth = new AuthAzureActiveDirectory($faqConfig, $oAuth);
4551

52+
$redirect = new RedirectResponse($faqConfig->getDefaultUrl());
53+
4654
if ($session->getCurrentSessionKey()) {
4755
try {
4856
$token = $oAuth->getOAuthToken($code);
@@ -76,14 +84,14 @@
7684
$user->setSuccess(true);
7785

7886
// @todo -> redirect to where the user came from
79-
$response = new RedirectResponse($faqConfig->getDefaultUrl());
80-
$response->send();
87+
$redirect->send();
8188
} catch (GuzzleException $e) {
8289
echo $e->getMessage();
8390
} catch (Exception $e) {
8491
echo $e->getMessage();
8592
}
8693
} else {
87-
$response = new RedirectResponse($faqConfig->getDefaultUrl());
88-
$response->send();
94+
$redirect->send();
8995
}
96+
97+

‎phpmyfaq/services/twitter/clearsessions.php

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@
77
* v. 2.0. If a copy of the MPL was not distributed with this file, You can
88
* obtain one at https://mozilla.org/MPL/2.0/.
99
*
10-
* @package phpMyFAQ
11-
* @author Thorsten Rinne <[email protected]>
10+
* @package phpMyFAQ
11+
* @author Thorsten Rinne <[email protected]>
1212
* @copyright 2010-2023 phpMyFAQ Team
13-
* @license https://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
14-
* @link https://www.phpmyfaq.de
15-
* @since 2010-09-18
13+
* @license https://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
14+
* @link https://www.phpmyfaq.de
15+
* @since 2010-09-18
1616
*/
1717

1818
use Symfony\Component\HttpFoundation\RedirectResponse;
@@ -30,6 +30,7 @@
3030
require PMF_ROOT_DIR . '/src/Bootstrap.php';
3131

3232
session_destroy();
33+
session_start();
3334

3435
$response = new RedirectResponse('./connect.php');
3536
$response->send();

‎phpmyfaq/services/twitter/index.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
use Abraham\TwitterOAuth\TwitterOAuth;
2020
use Abraham\TwitterOAuth\TwitterOAuthException;
2121
use Symfony\Component\HttpFoundation\RedirectResponse;
22+
use phpMyFAQ\Configuration;
23+
use Symfony\Component\HttpFoundation\RedirectResponse;
2224

2325
//
2426
// Prepend and start the PHP session
@@ -31,6 +33,8 @@
3133
//
3234
require PMF_ROOT_DIR . '/src/Bootstrap.php';
3335

36+
$faqConfig = Configuration::getConfigurationInstance();
37+
3438
if (
3539
empty($_SESSION['access_token']) ||
3640
empty($_SESSION['access_token']['oauth_token']) ||

‎phpmyfaq/services/twitter/redirect.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
*/
1818

1919
use Abraham\TwitterOAuth\TwitterOAuth;
20+
use phpMyFAQ\Configuration;
2021
use Symfony\Component\HttpFoundation\RedirectResponse;
2122

2223
//
@@ -30,6 +31,8 @@
3031
//
3132
require PMF_ROOT_DIR . '/src/Bootstrap.php';
3233

34+
$faqConfig = Configuration::getConfigurationInstance();
35+
3336
$connection = new TwitterOAuth(
3437
$faqConfig->get('socialnetworks.twitterConsumerKey'),
3538
$faqConfig->get('socialnetworks.twitterConsumerSecret')

0 commit comments

Comments
 (0)