harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement custom escaping

Browse Source 
(cherry picked from commit 93a310582f)
This commit is contained in:
M.Dent 2018-10-07 23:08:47 +00:00 committed by Mario
parent d1270aab4d
commit bf878dc446
4 changed files with 64 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
Zotlabs/Lib/NativeWiki.php
View File

@ -26,7 +26,8 @@ class NativeWiki {
$w['rawName'] = get_iconfig($w, 'wiki', 'rawName'); $w['rawName'] = get_iconfig($w, 'wiki', 'rawName');
$w['htmlName'] = escape_tags($w['rawName']); $w['htmlName'] = escape_tags($w['rawName']);
$w['urlName'] = urlencode(urlencode($w['rawName'])); //$w['urlName'] = urlencode(urlencode($w['rawName']));
$w['urlName'] = self::name_encode($w['rawName']);
$w['mimeType'] = get_iconfig($w, 'wiki', 'mimeType'); $w['mimeType'] = get_iconfig($w, 'wiki', 'mimeType');
$w['typelock'] = get_iconfig($w, 'wiki', 'typelock'); $w['typelock'] = get_iconfig($w, 'wiki', 'typelock');
$w['lockstate'] = (($w['allow_cid'] || $w['allow_gid'] || $w['deny_cid'] || $w['deny_gid']) ? 'lock' : 'unlock'); $w['lockstate'] = (($w['allow_cid'] || $w['allow_gid'] || $w['deny_cid'] || $w['deny_gid']) ? 'lock' : 'unlock');
@ -233,7 +234,8 @@ class NativeWiki {
'wiki' => $w, 'wiki' => $w,
'rawName' => $rawName, 'rawName' => $rawName,
'htmlName' => escape_tags($rawName), 'htmlName' => escape_tags($rawName),
'urlName' => urlencode(urlencode($rawName)), //'urlName' => urlencode(urlencode($rawName)),
'urlName' => self::name_encode($rawName),
'mimeType' => $mimeType, 'mimeType' => $mimeType,
'typelock' => $typelock 'typelock' => $typelock
); );
@ -249,7 +251,8 @@ class NativeWiki {
WHERE resource_type = '%s' AND iconfig.v = '%s' AND uid = %d WHERE resource_type = '%s' AND iconfig.v = '%s' AND uid = %d
AND item_deleted = 0 $sql_extra limit 1", AND item_deleted = 0 $sql_extra limit 1",
dbesc(NWIKI_ITEM_RESOURCE_TYPE), dbesc(NWIKI_ITEM_RESOURCE_TYPE),
dbesc(urldecode($urlName)), //dbesc(urldecode($urlName)),
dbesc($urlName),
intval($uid) intval($uid)
); );
@ -286,4 +289,31 @@ class NativeWiki {
return array('read' => true, 'write' => $write, 'success' => true); return array('read' => true, 'write' => $write, 'success' => true);
} }
} }
public static function name_encode ($string) {
$encoding = mb_internal_encoding();
mb_internal_encoding("UTF-8");
$ret = mb_ereg_replace_callback ('[^A-Za-z0-9\-\_\.\~]',function ($char) {
$charhex = unpack('H*',$char[0]);
$ret = '('.$charhex[1].')';
return $ret;
}
,$string);
mb_internal_encoding($encoding);
return $ret;
}
public static function name_decode ($string) {
$encoding = mb_internal_encoding();
mb_internal_encoding("UTF-8");
$ret = mb_ereg_replace_callback ('(\(([0-9a-f]+)\))',function ($chars) {
return pack('H*',$chars[2]);
}
,$string);
mb_internal_encoding($encoding);
return $ret;
}
} }

12
Zotlabs/Lib/NativeWikiPage.php
View File

@ -44,7 +44,8 @@ class NativeWikiPage {
$pages[] = [ $pages[] = [
'resource_id' => $resource_id, 'resource_id' => $resource_id,
'title' => escape_tags($title), 'title' => escape_tags($title),
'url' => str_replace('%2F','/',urlencode(str_replace('%2F','/',urlencode($title)))), //'url' => str_replace('%2F','/',urlencode(str_replace('%2F','/',urlencode($title)))),
'url' => Zlib\NativeWiki::name_encode($title),
'link_id' => 'id_' . substr($resource_id, 0, 10) . '_' . $page_item['id'] 'link_id' => 'id_' . substr($resource_id, 0, 10) . '_' . $page_item['id']
]; ];
} }
@ -98,7 +99,8 @@ class NativeWikiPage {
$page = [ $page = [
'rawName' => $name, 'rawName' => $name,
'htmlName' => escape_tags($name), 'htmlName' => escape_tags($name),
'urlName' => urlencode($name), //'urlName' => urlencode($name),
Zlib\NativeWiki::name_encode($name)
]; ];
@ -154,7 +156,8 @@ class NativeWikiPage {
$page = [ $page = [
'rawName' => $pageNewName, 'rawName' => $pageNewName,
'htmlName' => escape_tags($pageNewName), 'htmlName' => escape_tags($pageNewName),
'urlName' => urlencode(escape_tags($pageNewName)) //'urlName' => urlencode(escape_tags($pageNewName))
Zlib\NativeWiki::name_encode($pageNewName)
]; ];
return [ 'success' => true, 'page' => $page ]; return [ 'success' => true, 'page' => $page ];
@ -527,7 +530,8 @@ class NativeWikiPage {
$pages = $pageURLs = array(); $pages = $pageURLs = array();
foreach ($match[1] as $m) { foreach ($match[1] as $m) {
// TODO: Why do we need to double urlencode for this to work? // TODO: Why do we need to double urlencode for this to work?
$pageURLs[] = urlencode(urlencode(escape_tags($m))); //$pageURLs[] = urlencode(urlencode(escape_tags($m)));
$pageURLs[] = Zlib\NativeWiki::name_encode(escape_tags($m));
$pages[] = $m; $pages[] = $m;
} }
$idx = 0; $idx = 0;

32
Zotlabs/Module/Wiki.php
View File

@ -237,7 +237,8 @@ class Wiki extends Controller {
// /wiki/channel/wiki -> No page was specified, so redirect to Home.md // /wiki/channel/wiki -> No page was specified, so redirect to Home.md
$wikiUrlName = urlencode(argv(2)); //$wikiUrlName = urlencode(argv(2));
$wikiUrlName = NativeWiki::name_encode(argv(2));
goaway(z_root() . '/' . argv(0) . '/' . argv(1) . '/' . $wikiUrlName . '/Home'); goaway(z_root() . '/' . argv(0) . '/' . argv(1) . '/' . $wikiUrlName . '/Home');
case 4: case 4:
@ -246,7 +247,8 @@ class Wiki extends Controller {
// GET /wiki/channel/wiki/page // GET /wiki/channel/wiki/page
// Fetch the wiki info and determine observer permissions // Fetch the wiki info and determine observer permissions
$wikiUrlName = urldecode(argv(2)); //$wikiUrlName = urldecode(argv(2));
$wikiUrlName = NativeWiki::name_decode(argv(2));
$page_name = ''; $page_name = '';
$ignore_language = false; $ignore_language = false;
@ -262,7 +264,8 @@ class Wiki extends Controller {
$page_name .= argv($x); $page_name .= argv($x);
} }
$pageUrlName = urldecode($page_name); //$pageUrlName = urldecode($page_name);
$pageUrlName = NativeWiki::name_decode($page_name);
$langPageUrlName = urldecode(\App::$language . '/' . $page_name); $langPageUrlName = urldecode(\App::$language . '/' . $page_name);
$w = NativeWiki::exists_by_name($owner['channel_id'], $wikiUrlName); $w = NativeWiki::exists_by_name($owner['channel_id'], $wikiUrlName);
@ -289,8 +292,10 @@ class Wiki extends Controller {
$wiki_editor = true; $wiki_editor = true;
} }
$wikiheaderName = urldecode($wikiUrlName); //$wikiheaderName = urldecode($wikiUrlName);
$wikiheaderPage = urldecode($pageUrlName); $wikiheaderName = NativeWiki::name_decode($wikiUrlName);
//$wikiheaderPage = urldecode($pageUrlName);
$wikiheaderPage = NativeWiki::name_decode($pageUrlName);
$renamePage = (($wikiheaderPage === 'Home') ? '' : t('Rename page')); $renamePage = (($wikiheaderPage === 'Home') ? '' : t('Rename page'));
$sharePage = t('Share'); $sharePage = t('Share');
@ -361,12 +366,13 @@ class Wiki extends Controller {
$placeholder = t('Short description of your changes (optional)'); $placeholder = t('Short description of your changes (optional)');
$zrl = urlencode( z_root() . '/wiki/' . argv(1) . '/' . $wikiUrlName . '/' . $pageUrlName );
$o .= replace_macros(get_markup_template('wiki.tpl'),array( $o .= replace_macros(get_markup_template('wiki.tpl'),array(
'$wikiheaderName' => $wikiheaderName, '$wikiheaderName' => $wikiheaderName,
'$wikiheaderPage' => $wikiheaderPage, '$wikiheaderPage' => $wikiheaderPage,
'$renamePage' => $renamePage, '$renamePage' => $renamePage,
'$sharePage' => $sharePage, '$sharePage' => $sharePage,
'$shareLink' => urlencode('#^[zrl=' . z_root() . '/wiki/' . argv(1) . '/' . $wikiUrlName . '/' . $pageUrlName . ']' . '[ ' . $owner['channel_name'] . ' ] ' . $wikiheaderName . ' - ' . $wikiheaderPage . '[/zrl]'), '$shareLink' => '#^[zrl=' . $zrl . ']' . '[ ' . $owner['channel_name'] . ' ] ' . $wikiheaderName . ' - ' . $wikiheaderPage . '[/zrl]',
'$showPageControls' => $showPageControls, '$showPageControls' => $showPageControls,
'$editOrSourceLabel' => (($showPageControls) ? t('Edit') : t('Source')), '$editOrSourceLabel' => (($showPageControls) ? t('Edit') : t('Source')),
'$tools_label' => 'Page Tools', '$tools_label' => 'Page Tools',
@ -465,7 +471,8 @@ class Wiki extends Controller {
$wiki['postVisible'] = ((intval($_POST['postVisible'])) ? 1 : 0); $wiki['postVisible'] = ((intval($_POST['postVisible'])) ? 1 : 0);
$wiki['rawName'] = $name; $wiki['rawName'] = $name;
$wiki['htmlName'] = escape_tags($name); $wiki['htmlName'] = escape_tags($name);
$wiki['urlName'] = urlencode(urlencode($name)); //$wiki['urlName'] = urlencode(urlencode($name));
$wiki['urlName'] = NativeWiki::name_encode($name);
$wiki['mimeType'] = $_POST['mimeType']; $wiki['mimeType'] = $_POST['mimeType'];
$wiki['typelock'] = $_POST['typelock']; $wiki['typelock'] = $_POST['typelock'];
@ -514,7 +521,8 @@ class Wiki extends Controller {
$arr = []; $arr = [];
$arr['urlName'] = urlencode(urlencode($_POST['origRawName'])); //$arr['urlName'] = urlencode(urlencode($_POST['origRawName']));
$arr['urlName'] = NativeWiki::name_encode($_POST['origRawName']);
if($_POST['updateRawName']) if($_POST['updateRawName'])
$arr['updateRawName'] = $_POST['updateRawName']; $arr['updateRawName'] = $_POST['updateRawName'];
@ -525,7 +533,7 @@ class Wiki extends Controller {
return; //not reached return; //not reached
} }
$wiki = NativeWiki::exists_by_name($owner['channel_id'], urldecode($arr['urlName'])); $wiki = NativeWiki::exists_by_name($owner['channel_id'], $arr['urlName']);
if($wiki['resource_id']) { if($wiki['resource_id']) {
@ -590,7 +598,7 @@ class Wiki extends Controller {
// backslashes won't work well in the javascript functions // backslashes won't work well in the javascript functions
$name = str_replace('\\','',$name); $name = str_replace('\\','',$name);
if(urlencode(escape_tags($name)) === '') { if(NativeWiki::name_encode(escape_tags($name)) === '') {
json_return_and_die(array('message' => 'Error creating page. Invalid name (' . print_r($_POST,true) . ').', 'success' => false)); json_return_and_die(array('message' => 'Error creating page. Invalid name (' . print_r($_POST,true) . ').', 'success' => false));
} }
@ -798,7 +806,7 @@ class Wiki extends Controller {
if ($pageUrlName === 'Home') { if ($pageUrlName === 'Home') {
json_return_and_die(array('message' => 'Cannot rename Home','success' => false)); json_return_and_die(array('message' => 'Cannot rename Home','success' => false));
} }
if(urlencode(escape_tags($pageNewName)) === '') { if(NativeWiki::encode_name(escape_tags($pageNewName)) === '') {
json_return_and_die(array('message' => 'Error renaming page. Invalid name.', 'success' => false)); json_return_and_die(array('message' => 'Error renaming page. Invalid name.', 'success' => false));
} }
// Determine if observer has permission to rename pages // Determine if observer has permission to rename pages
@ -814,7 +822,7 @@ class Wiki extends Controller {
if($renamed['success']) { if($renamed['success']) {
$commit = NativeWikiPage::commit(array( $commit = NativeWikiPage::commit(array(
'channel_id' => $owner['channel_id'], 'channel_id' => $owner['channel_id'],
'commit_msg' => 'Renamed ' . urldecode($pageUrlName) . ' to ' . $renamed['page']['htmlName'], 'commit_msg' => 'Renamed ' . NativeWiki::name_decode($pageUrlName) . ' to ' . $renamed['page']['htmlName'],
'resource_id' => $resource_id, 'resource_id' => $resource_id,
'observer_hash' => $observer_hash, 'observer_hash' => $observer_hash,
'pageUrlName' => $pageNewName 'pageUrlName' => $pageNewName

3
Zotlabs/Widget/Wiki_pages.php
View File

@ -2,6 +2,7 @@
namespace Zotlabs\Widget; namespace Zotlabs\Widget;
use Zotlabs\Lib\NativeWiki;
class Wiki_pages { class Wiki_pages {
@ -21,7 +22,7 @@ class Wiki_pages {
$can_create = perm_is_allowed(\App::$profile['uid'],get_observer_hash(),'write_wiki'); $can_create = perm_is_allowed(\App::$profile['uid'],get_observer_hash(),'write_wiki');
$can_delete = ((local_channel() && (local_channel() == \App::$profile['uid'])) ? true : false); $can_delete = ((local_channel() && (local_channel() == \App::$profile['uid'])) ? true : false);
$pageName = addslashes(escape_tags(urldecode(argv(3)))); $pageName = NativeWiki::name_decode(escape_tags(argv(3)));
return replace_macros(get_markup_template('wiki_page_not_found.tpl'), array( return replace_macros(get_markup_template('wiki_page_not_found.tpl'), array(
'$resource_id' => $arr['resource_id'], '$resource_id' => $arr['resource_id'],