Skip to content

Commit c66acf6

Browse files
author
bnu
committed
Merge branch 'hotfix/1.8.27'
2 parents d824558 + 92073d0 commit c66acf6

File tree

6 files changed

+96
-37
lines changed

6 files changed

+96
-37
lines changed

‎addons/blogapi/blogapi.addon.php

+91-33
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,10 @@
9999
$category_list = $oDocumentModel->getCategoryList($this->module_srl);
100100

101101
// Specifies a temporary file storage
102-
$tmp_uploaded_path = sprintf(_XE_PATH_ . 'files/cache/blogapi/%s/%s/', $this->mid, $user_id);
103-
$uploaded_target_path = sprintf(_XE_PATH_ . 'files/cache/blogapi/%s/%s/', $this->mid, $user_id);
102+
$logged_info = Context::get('logged_info');
103+
$mediaPath = sprintf('files/cache/blogapi/%s/%s/', $this->mid, $logged_info->member_srl);
104+
$mediaAbsPath = _XE_PATH_ . $mediaPath;
105+
$mediaUrlPath = Context::getRequestUri() . $mediaPath;
104106

105107
switch($method_name)
106108
{
@@ -167,22 +169,56 @@
167169
foreach($fileinfo as $key => $val)
168170
{
169171
$nodename = (string)$val->name;
170-
if($nodename == 'bits')
172+
if($nodename === 'bits')
173+
{
171174
$filedata = base64_decode((string)$val->value->base64);
172-
elseif($nodename == 'name')
173-
$filename = (string)$val->value->string;
175+
}
176+
else if($nodename === 'name')
177+
{
178+
$filename = pathinfo((string)$val->value->string, PATHINFO_BASENAME);
179+
}
174180
}
175181

176-
$tmp_arr = explode('/', $filename);
177-
$filename = array_pop($tmp_arr);
182+
if($logged_info->is_admin != 'Y')
183+
{
184+
// check file type
185+
if(isset($file_module_config->allowed_filetypes) && $file_module_config->allowed_filetypes !== '*.*')
186+
{
187+
$filetypes = explode(';', $file_module_config->allowed_filetypes);
188+
$ext = array();
189+
190+
foreach($filetypes as $item)
191+
{
192+
$item = explode('.', $item);
193+
$ext[] = strtolower(array_pop($item));
194+
}
195+
196+
$uploaded_ext = explode('.', $filename);
197+
$uploaded_ext = strtolower(array_pop($uploaded_ext));
178198

179-
FileHandler::makeDir($tmp_uploaded_path);
199+
if(!in_array($uploaded_ext, $ext))
200+
{
201+
printContent(getXmlRpcFailure(1, 'Not allowed file type'));
202+
break;
203+
}
204+
}
205+
206+
$allowed_filesize = $file_module_config->allowed_filesize * 1024 * 1024;
207+
if($allowed_filesize < strlen($filedata))
208+
{
209+
printContent(getXmlRpcFailure(1, 'This file exceeds the attachment limit'));
210+
break;
211+
}
212+
}
180213

181-
$target_filename = sprintf('%s%s', $tmp_uploaded_path, $filename);
214+
$temp_filename = Password::createSecureSalt(12, 'alnum');
215+
$target_filename = sprintf('%s%s', $mediaAbsPath, $temp_filename);
216+
FileHandler::makeDir($mediaAbsPath);
182217
FileHandler::writeFile($target_filename, $filedata);
183-
$obj = new stdClass();
184-
$obj->url = Context::getRequestUri() . $target_filename;
218+
FileHandler::writeFile($target_filename . '_source_filename', $filename);
185219

220+
$obj = new stdClass();
221+
$obj->url = Context::getRequestUri() . $mediaPath . $temp_filename;
186222
$content = getXmlRpcResponse($obj);
187223
printContent($content);
188224
break;
@@ -291,21 +327,34 @@
291327
$obj->module_srl = $this->module_srl;
292328

293329
// Attachment
294-
if(is_dir($tmp_uploaded_path))
330+
if(is_dir($mediaAbsPath))
295331
{
296-
$file_list = FileHandler::readDir($tmp_uploaded_path);
332+
$file_list = FileHandler::readDir($mediaAbsPath, '/(_source_filename)$/is');
297333
$file_count = count($file_list);
298334
if($file_count)
299335
{
300336
$oFileController = getController('file');
301-
for($i = 0; $i < $file_count; $i++)
337+
$oFileModel = getModel('file');
338+
foreach($file_list as $file)
302339
{
303-
$file_info['tmp_name'] = sprintf('%s%s', $tmp_uploaded_path, $file_list[$i]);
304-
$file_info['name'] = $file_list[$i];
340+
$filename = FileHandler::readFile($mediaAbsPath . $file);
341+
$temp_filename = str_replace('_source_filename', '', $file);
342+
343+
$file_info = array();
344+
$file_info['tmp_name'] = sprintf('%s%s', $mediaAbsPath, $temp_filename);
345+
$file_info['name'] = $filename;
305346
$fileOutput = $oFileController->insertFile($file_info, $this->module_srl, $document_srl, 0, true);
306-
$uploaded_filename = $fileOutput->get('uploaded_filename');
307-
$source_filename = $fileOutput->get('source_filename');
308-
$obj->content = str_replace($uploaded_target_path . $source_filename, sprintf('/files/attach/images/%s/%s%s', $this->module_srl, getNumberingPath($document_srl, 3), $uploaded_filename), $obj->content);
347+
348+
if($fileOutput->get('direct_download') === 'N')
349+
{
350+
$replace_url = Context::getRequestUri() . $oFileModel->getDownloadUrl($fileOutput->file_srl, $fileOutput->sid, $this->module_srl);
351+
}
352+
else
353+
{
354+
$replace_url = Context::getRequestUri() . $fileOutput->get('uploaded_filename');
355+
}
356+
357+
$obj->content = str_replace($mediaUrlPath . $temp_filename, $replace_url, $obj->content);
309358
}
310359
$obj->uploaded_count = $file_count;
311360
}
@@ -332,7 +381,7 @@
332381
{
333382
$content = getXmlRpcResponse(strval($document_srl));
334383
}
335-
FileHandler::removeDir($tmp_uploaded_path);
384+
FileHandler::removeDir($mediaAbsPath);
336385

337386
printContent($content);
338387
break;
@@ -404,27 +453,36 @@
404453
// Document srl
405454
$obj->document_srl = $document_srl;
406455
$obj->module_srl = $this->module_srl;
456+
407457
// Attachment
408-
if(is_dir($tmp_uploaded_path))
458+
if(is_dir($mediaAbsPath))
409459
{
410-
$file_list = FileHandler::readDir($tmp_uploaded_path);
460+
$file_list = FileHandler::readDir($mediaAbsPath, '/(_source_filename)$/is');
411461
$file_count = count($file_list);
412462
if($file_count)
413463
{
414464
$oFileController = getController('file');
415-
for($i = 0; $i < $file_count; $i++)
465+
$oFileModel = getModel('file');
466+
foreach($file_list as $file)
416467
{
417-
$file_info['tmp_name'] = sprintf('%s%s', $tmp_uploaded_path, $file_list[$i]);
418-
$file_info['name'] = $file_list[$i];
419-
420-
$moved_filename = sprintf('./files/attach/images/%s/%s/%s', $this->module_srl, $document_srl, $file_info['name']);
421-
if(file_exists($moved_filename))
422-
continue;
468+
$filename = FileHandler::readFile($mediaAbsPath . $file);
469+
$temp_filename = str_replace('_source_filename', '', $file);
423470

471+
$file_info = array();
472+
$file_info['tmp_name'] = sprintf('%s%s', $mediaAbsPath, $temp_filename);
473+
$file_info['name'] = $filename;
424474
$fileOutput = $oFileController->insertFile($file_info, $this->module_srl, $document_srl, 0, true);
425-
$uploaded_filename = $fileOutput->get('uploaded_filename');
426-
$source_filename = $fileOutput->get('source_filename');
427-
$obj->content = str_replace($uploaded_target_path . $source_filename, sprintf('/files/attach/images/%s/%s%s', $this->module_srl, getNumberingPath($document_srl, 3), $uploaded_filename), $obj->content);
475+
476+
if($fileOutput->get('direct_download') === 'N')
477+
{
478+
$replace_url = Context::getRequestUri() . $oFileModel->getDownloadUrl($fileOutput->file_srl, $fileOutput->sid, $this->module_srl);
479+
}
480+
else
481+
{
482+
$replace_url = Context::getRequestUri() . $fileOutput->get('uploaded_filename');
483+
}
484+
485+
$obj->content = str_replace($mediaUrlPath . $temp_filename, $replace_url, $obj->content);
428486
}
429487
$obj->uploaded_count += $file_count;
430488
}
@@ -440,7 +498,7 @@
440498
else
441499
{
442500
$content = getXmlRpcResponse(true);
443-
FileHandler::removeDir($tmp_uploaded_path);
501+
FileHandler::removeDir($mediaAbsPath);
444502
}
445503

446504
printContent($content);

‎config/config.inc.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
/**
3030
* Display XE's full version.
3131
*/
32-
define('__XE_VERSION__', '1.8.26');
32+
define('__XE_VERSION__', '1.8.27');
3333
define('__XE_VERSION_ALPHA__', (stripos(__XE_VERSION__, 'alpha') !== false));
3434
define('__XE_VERSION_BETA__', (stripos(__XE_VERSION__, 'beta') !== false));
3535
define('__XE_VERSION_RC__', (stripos(__XE_VERSION__, 'rc') !== false));

‎modules/member/member.controller.php

+1
Original file line numberDiff line numberDiff line change
@@ -1469,6 +1469,7 @@ function putSignature($member_srl, $signature)
14691469
{
14701470
$signature = trim(removeHackTag($signature));
14711471
$signature = preg_replace('/<(\/?)(embed|object|param)/is', '&lt;$1$2', $signature);
1472+
$signature = removeHackTag($signature);
14721473

14731474
$check_signature = trim(str_replace(array('&nbsp;',"\n","\r"),'',strip_tags($signature,'<img><object>')));
14741475
$path = sprintf('files/member_extra_info/signature/%s/', getNumberingPath($member_srl));

‎modules/member/member.model.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -1006,7 +1006,7 @@ function getSignature($member_srl)
10061006
{
10071007
$buff = FileHandler::readFile($filename);
10081008
$signature = preg_replace('/<\?.*\?>/', '', $buff);
1009-
$GLOBALS['__member_info__']['signature'][$member_srl] = $signature;
1009+
$GLOBALS['__member_info__']['signature'][$member_srl] = removeHackTag($signature);
10101010
}
10111011
else $GLOBALS['__member_info__']['signature'][$member_srl] = null;
10121012
}

‎tests/Install/AutoinstallCept.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
$db_config = $config['modules']['config']['Db'];
99

1010
$dsn = $db_config['dsn'];
11-
$dsn = split('[;:]', $dsn);
11+
$dsn = preg_split('/[;:]/', $dsn);
1212
$db_type = array_shift($dsn);
1313
$dbinfo = [
1414
'type' => $db_type,

‎tests/Install/InstallCept.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
$db_config = $config['modules']['config']['Db'];
99

1010
$dsn = $db_config['dsn'];
11-
$dsn = split('[;:]', $dsn);
11+
$dsn = preg_split('/[;:]/', $dsn);
1212
$db_type = array_shift($dsn);
1313
$dbinfo = [
1414
'type' => $db_type,

0 commit comments

Comments
 (0)