diff options
Diffstat (limited to 'inc')
| -rw-r--r-- | inc/config.php | 3 | ||||
| -rw-r--r-- | inc/display.php | 6 | ||||
| -rw-r--r-- | inc/functions.php | 8 | ||||
| -rw-r--r-- | inc/mod/pages.php | 9 |
4 files changed, 14 insertions, 12 deletions
diff --git a/inc/config.php b/inc/config.php index 28a7a4db..36518028 100644 --- a/inc/config.php +++ b/inc/config.php @@ -1130,6 +1130,9 @@ // 'type' => 'scp' //); + // Regex for board URIs + $config['board_regex'] = '[0-9a-zA-Z$_\x{0080}-\x{FFFF}]{1,58}'; + // Complex regular expression to catch URLs $config['url_regex'] = '/' . '(https?|ftp):\/\/' . '(([\w\-]+\.)+[a-zA-Z]{2,6}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' . '(:\d+)?' . '(\/([\w\-~.#\/?=&;:+%!*\[\]@$\'()+,|\^]+)?)?' . '/'; diff --git a/inc/display.php b/inc/display.php index a7e4826e..0992166d 100644 --- a/inc/display.php +++ b/inc/display.php @@ -235,7 +235,7 @@ function bidi_cleanup($str){ function secure_link_confirm($text, $title, $confirm_message, $href) { global $config; - return '<a onclick="if (event.which==2) return true;if (confirm(\'' . htmlentities(addslashes($confirm_message)) . '\')) document.location=\'?/' . htmlentities(addslashes($href . '/' . make_secure_link_token($href))) . '\';return false;" title="' . htmlentities($title) . '" href="?/' . $href . '">' . $text . '</a>'; + return '<a onclick="if (event.which==2) return true;if (confirm(\'' . htmlentities(addslashes($confirm_message)) . '\')) document.location=\'?/' . htmlspecialchars(addslashes($href . '/' . make_secure_link_token($href))) . '\';return false;" title="' . htmlentities($title) . '" href="?/' . $href . '">' . $text . '</a>'; } function secure_link($href) { return $href . '/' . make_secure_link_token($href); @@ -299,7 +299,7 @@ class Post { // Fix internal links // Very complicated regex $this->body = preg_replace( - '/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), '\w+') . ')/', + '/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), $config['board_regex']) . ')/u', '<a $1href="?/$4', $this->body ); @@ -398,7 +398,7 @@ class Thread { // Fix internal links // Very complicated regex $this->body = preg_replace( - '/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), '\w+') . ')/', + '/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), $config['board_regex']) . ')/u', '<a $1href="?/$4', $this->body ); diff --git a/inc/functions.php b/inc/functions.php index d5692be5..6db21c54 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -98,18 +98,18 @@ function loadConfig() { 'https?:\/\/' . $_SERVER['HTTP_HOST']) . preg_quote($config['root'], '/') . '(' . - str_replace('%s', '\w+', preg_quote($config['board_path'], '/')) . + str_replace('%s', $config['board_regex'], preg_quote($config['board_path'], '/')) . '(' . preg_quote($config['file_index'], '/') . '|' . str_replace('%d', '\d+', preg_quote($config['file_page'])) . ')?' . '|' . - str_replace('%s', '\w+', preg_quote($config['board_path'], '/')) . + str_replace('%s', $config['board_regex'], preg_quote($config['board_path'], '/')) . preg_quote($config['dir']['res'], '/') . str_replace('%d', '\d+', preg_quote($config['file_page'], '/')) . '|' . preg_quote($config['file_mod'], '/') . '\?\/.+' . - ')([#?](.+)?)?$/i'; + ')([#?](.+)?)?$/ui'; } else { // CLI mode $config['referer_match'] = '//'; @@ -1468,7 +1468,7 @@ function markup(&$body, $track_cites = false) { } // Cross-board linking - if (preg_match_all('/(^|\s)>>>\/(\w+?)\/(\d+)?([\s,.)?]|$)/m', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) { + if (preg_match_all('/(^|\s)>>>\/(' . $config['board_regex'] . 'f?)\/(\d+)?([\s,.)?]|$)/um', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) { if (count($cites[0]) > $config['max_cites']) { error($config['error']['toomanycross']); } diff --git a/inc/mod/pages.php b/inc/mod/pages.php index fdf9d8e9..ab4cdaaf 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -443,7 +443,7 @@ function mod_new_board() { if ($_POST['title'] == '') error(sprintf($config['error']['required'], 'title')); - if (!preg_match('/^\w+$/', $_POST['uri'])) + if (!preg_match('/^' . $config['board_regex'] . '$/u', $_POST['uri'])) error(sprintf($config['error']['invalidfield'], 'URI')); if (openBoard($_POST['uri'])) { @@ -746,7 +746,6 @@ function mod_page_ip($ip) { openBoard($board['uri']); if (!hasPermission($config['mod']['show_ip'], $board['uri'])) continue; - $query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri'])); $query->bindValue(':ip', $ip); $query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT); @@ -1420,7 +1419,7 @@ function mod_user($uid) { $boards = array(); foreach ($_POST as $name => $value) { - if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards)) + if (preg_match('/^board_(' . $config['board_regex'] . ')$/u', $name, $matches) && in_array($matches[1], $_boards)) $boards[] = $matches[1]; } } @@ -1541,7 +1540,7 @@ function mod_user_new() { $boards = array(); foreach ($_POST as $name => $value) { - if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards)) + if (preg_match('/^board_(' . $config['board_regex'] . ')$/u', $name, $matches) && in_array($matches[1], $_boards)) $boards[] = $matches[1]; } } @@ -2135,7 +2134,7 @@ function mod_debug_antispam() { $where .= ' AND `thread` = ' . $pdo->quote($_POST['thread']); if (isset($_POST['purge'])) { - $query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where); + $query = prepare(', DATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where); $query->bindValue(':expires', $config['spam']['hidden_inputs_expire']); $query->execute() or error(db_error()); } |