From ea2b8cce077a092e0cbf136f9a45158668cc5ecf Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Wed, 31 Jul 2013 21:24:17 -0400 Subject: Bugfix: HTML injection in post editing (introduces and fixes yet another bug) --- inc/mod/pages.php | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'inc/mod/pages.php') diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 7edc0ee6..2808dc56 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1222,7 +1222,7 @@ function mod_ban_post($board, $delete, $post, $token = false) { $_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']); $query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board)); $query->bindValue(':id', $post); - $query->bindValue(':body_nomarkup', sprintf("\n%s", $_POST['message'])); + $query->bindValue(':body_nomarkup', sprintf("\n%s", utf8tohtml($_POST['message']))); $query->execute() or error(db_error($query)); rebuildPost($post); @@ -1298,10 +1298,13 @@ function mod_edit_post($board, $edit_raw_html, $postID) { header('Location: ?/' . sprintf($config['board_path'], $board) . $config['dir']['res'] . sprintf($config['file_page'], $post['thread'] ? $post['thread'] : $postID) . '#' . $postID, true, $config['redirect_http']); } else { if ($config['minify_html']) { - $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); - $post['body'] = str_replace("\n", ' ', $post['body']); + // $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); + // $post['body'] = str_replace("\n", ' ', $post['body']); } + // Minifying this page causes an issue with newlines in the textarea. This is a temporary solution. + $config['minify_html'] = false; + mod_page(_('Edit post'), 'mod/edit_post_form.html', array('token' => $security_token, 'board' => $board, 'raw' => $edit_raw_html, 'post' => $post)); } } -- cgit v1.3 From ab364525433a7194d050e4ec13ae08d603fdad43 Mon Sep 17 00:00:00 2001 From: czaks Date: Wed, 31 Jul 2013 19:50:25 -0400 Subject: fix post editing for tinyboard markup --- inc/mod/pages.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'inc/mod/pages.php') diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 2808dc56..3ff6a9b1 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -1276,7 +1276,7 @@ function mod_edit_post($board, $edit_raw_html, $postID) { if (isset($_POST['name'], $_POST['email'], $_POST['subject'], $_POST['body'])) { if ($edit_raw_html) - $query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body` = :body WHERE `id` = :id', $board)); + $query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body` = :body, `body_nomarkup` = :body_nomarkup WHERE `id` = :id', $board)); else $query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body_nomarkup` = :body WHERE `id` = :id', $board)); $query->bindValue(':id', $postID); @@ -1284,6 +1284,10 @@ function mod_edit_post($board, $edit_raw_html, $postID) { $query->bindValue(':email', $_POST['email']); $query->bindValue(':subject', $_POST['subject']); $query->bindValue(':body', $_POST['body']); + if ($edit_raw_html) { + $body_nomarkup = '' . $_POST['body'] . ''; + $query->bindValue(':body_nomarkup', $body_nomarkup); + } $query->execute() or error(db_error($query)); if ($edit_raw_html) { -- cgit v1.3