From 42cba538878cb695ba8b3093f72bc66ccd2fa074 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 31 Jul 2013 02:08:55 -0400
Subject: Allow Unicode in board URIs.

---
 inc/config.php    | 3 +++
 inc/display.php   | 6 +++---
 inc/functions.php | 8 ++++----
 inc/mod/pages.php | 9 ++++-----
 4 files changed, 14 insertions(+), 12 deletions(-)

(limited to 'inc')

diff --git a/inc/config.php b/inc/config.php
index 28a7a4db..36518028 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1130,6 +1130,9 @@
 	//	'type' => 'scp'
 	//);
 	
+	// Regex for board URIs
+	$config['board_regex'] = '[0-9a-zA-Z$_\x{0080}-\x{FFFF}]{1,58}';
+	
 	// Complex regular expression to catch URLs
 	$config['url_regex'] = '/' . '(https?|ftp):\/\/' . '(([\w\-]+\.)+[a-zA-Z]{2,6}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' . '(:\d+)?' . '(\/([\w\-~.#\/?=&;:+%!*\[\]@$\'()+,|\^]+)?)?' . '/';
 
diff --git a/inc/display.php b/inc/display.php
index a7e4826e..0992166d 100644
--- a/inc/display.php
+++ b/inc/display.php
@@ -235,7 +235,7 @@ function bidi_cleanup($str){
 function secure_link_confirm($text, $title, $confirm_message, $href) {
 	global $config;
 
-	return '<a onclick="if (event.which==2) return true;if (confirm(\'' . htmlentities(addslashes($confirm_message)) . '\')) document.location=\'?/' . htmlentities(addslashes($href . '/' . make_secure_link_token($href))) . '\';return false;" title="' . htmlentities($title) . '" href="?/' . $href . '">' . $text . '</a>';
+	return '<a onclick="if (event.which==2) return true;if (confirm(\'' . htmlentities(addslashes($confirm_message)) . '\')) document.location=\'?/' . htmlspecialchars(addslashes($href . '/' . make_secure_link_token($href))) . '\';return false;" title="' . htmlentities($title) . '" href="?/' . $href . '">' . $text . '</a>';
 }
 function secure_link($href) {
 	return $href . '/' . make_secure_link_token($href);
@@ -299,7 +299,7 @@ class Post {
 			// Fix internal links
 			// Very complicated regex
 			$this->body = preg_replace(
-				'/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), '\w+') . ')/',
+				'/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), $config['board_regex']) . ')/u',
 				'<a $1href="?/$4',
 				$this->body
 			);
@@ -398,7 +398,7 @@ class Thread {
 			// Fix internal links
 			// Very complicated regex
 			$this->body = preg_replace(
-				'/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), '\w+') . ')/',
+				'/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), $config['board_regex']) . ')/u',
 				'<a $1href="?/$4',
 				$this->body
 			);
diff --git a/inc/functions.php b/inc/functions.php
index d5692be5..6db21c54 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -98,18 +98,18 @@ function loadConfig() {
 					'https?:\/\/' . $_SERVER['HTTP_HOST']) .
 					preg_quote($config['root'], '/') .
 				'(' .
-						str_replace('%s', '\w+', preg_quote($config['board_path'], '/')) .
+						str_replace('%s', $config['board_regex'], preg_quote($config['board_path'], '/')) .
 						'(' .
 							preg_quote($config['file_index'], '/') . '|' .
 							str_replace('%d', '\d+', preg_quote($config['file_page'])) .
 						')?' .
 					'|' .
-						str_replace('%s', '\w+', preg_quote($config['board_path'], '/')) .
+						str_replace('%s', $config['board_regex'], preg_quote($config['board_path'], '/')) .
 						preg_quote($config['dir']['res'], '/') .
 						str_replace('%d', '\d+', preg_quote($config['file_page'], '/')) .
 					'|' .
 						preg_quote($config['file_mod'], '/') . '\?\/.+' .
-				')([#?](.+)?)?$/i';
+				')([#?](.+)?)?$/ui';
 		} else {
 			// CLI mode
 			$config['referer_match'] = '//';
@@ -1468,7 +1468,7 @@ function markup(&$body, $track_cites = false) {
 	}
 		
 	// Cross-board linking
-	if (preg_match_all('/(^|\s)&gt;&gt;&gt;\/(\w+?)\/(\d+)?([\s,.)?]|$)/m', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
+	if (preg_match_all('/(^|\s)&gt;&gt;&gt;\/(' . $config['board_regex'] . 'f?)\/(\d+)?([\s,.)?]|$)/um', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
 		if (count($cites[0]) > $config['max_cites']) {
 			error($config['error']['toomanycross']);
 		}
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index fdf9d8e9..ab4cdaaf 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -443,7 +443,7 @@ function mod_new_board() {
 		if ($_POST['title'] == '')
 			error(sprintf($config['error']['required'], 'title'));
 		
-		if (!preg_match('/^\w+$/', $_POST['uri']))
+		if (!preg_match('/^' . $config['board_regex'] . '$/u', $_POST['uri']))
 			error(sprintf($config['error']['invalidfield'], 'URI'));
 		
 		if (openBoard($_POST['uri'])) {
@@ -746,7 +746,6 @@ function mod_page_ip($ip) {
 		openBoard($board['uri']);
 		if (!hasPermission($config['mod']['show_ip'], $board['uri']))
 			continue;
-		
 		$query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri']));
 		$query->bindValue(':ip', $ip);
 		$query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT);
@@ -1420,7 +1419,7 @@ function mod_user($uid) {
 		
 			$boards = array();
 			foreach ($_POST as $name => $value) {
-				if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards))
+				if (preg_match('/^board_(' . $config['board_regex'] . ')$/u', $name, $matches) && in_array($matches[1], $_boards))
 					$boards[] = $matches[1];
 			}
 		}
@@ -1541,7 +1540,7 @@ function mod_user_new() {
 			
 			$boards = array();
 			foreach ($_POST as $name => $value) {
-				if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards))
+				if (preg_match('/^board_(' . $config['board_regex'] . ')$/u', $name, $matches) && in_array($matches[1], $_boards))
 					$boards[] = $matches[1];
 			}
 		}
@@ -2135,7 +2134,7 @@ function mod_debug_antispam() {
 			$where .= ' AND `thread` = ' . $pdo->quote($_POST['thread']);
 		
 		if (isset($_POST['purge'])) {
-			$query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where);
+			$query = prepare(', DATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where);
 			$query->bindValue(':expires', $config['spam']['hidden_inputs_expire']);
 			$query->execute() or error(db_error());
 		}
-- 
cgit v1.3