From 57c8e4ee7cea126e68ade4913c57a46f06d1a2b0 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 28 Jul 2013 20:33:26 -0400
Subject: Strip combining characters from Unicode strings (eg. Zalgo)

---
 post.php | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 4e3a1a9f..6855fe14 100644
--- a/post.php
+++ b/post.php
@@ -357,6 +357,13 @@ if (isset($_POST['delete'])) {
 		$post['thumb'] = $board['dir'] . $config['dir']['thumb'] . $post['file_id'] . '.' . ($config['thumb_ext'] ? $config['thumb_ext'] : $post['extension']);
 	}
 	
+	if ($config['strip_combining_chars']) {
+		$post['name'] = strip_combining_chars($post['name']);
+		$post['email'] = strip_combining_chars($post['email']);
+		$post['subject'] = strip_combining_chars($post['name']);
+		$post['body'] = strip_combining_chars($post['body']);
+	}
+	
 	// Check string lengths
 	if (mb_strlen($post['name']) > 35)
 		error(sprintf($config['error']['toolong'], 'name'));	
@@ -368,7 +375,7 @@ if (isset($_POST['delete'])) {
 		error($config['error']['toolong_body']);
 	if (mb_strlen($post['password']) > 20)
 		error(sprintf($config['error']['toolong'], 'password'));
-	
+		
 	wordfilters($post['body']);
 	
 	$post['body_nomarkup'] = $post['body'];
-- 
cgit v1.3


From bd8bd3c02e6cb8e130058649e646a8c8071d3386 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 28 Jul 2013 20:46:00 -0400
Subject: Fix for last commit

---
 inc/functions.php | 5 +++--
 post.php          | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

(limited to 'post.php')

diff --git a/inc/functions.php b/inc/functions.php
index 9d398002..2915e1b6 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1552,8 +1552,9 @@ function ordutf8($string, &$offset) {
 function strip_combining_chars($str) {
 	$chars = preg_split('//u', $str, -1, PREG_SPLIT_NO_EMPTY);
 	$str = '';
-	foreach ($chars as $char) {	
-		$ord = ordutf8($char, $o = 0);
+	foreach ($chars as $char) {
+		$o = 0;
+		$ord = ordutf8($char, $o);
 		
 		if ($ord >= 768 && $ord <= 879)
 			continue;
diff --git a/post.php b/post.php
index 6855fe14..ad045b66 100644
--- a/post.php
+++ b/post.php
@@ -360,7 +360,7 @@ if (isset($_POST['delete'])) {
 	if ($config['strip_combining_chars']) {
 		$post['name'] = strip_combining_chars($post['name']);
 		$post['email'] = strip_combining_chars($post['email']);
-		$post['subject'] = strip_combining_chars($post['name']);
+		$post['subject'] = strip_combining_chars($post['subject']);
 		$post['body'] = strip_combining_chars($post['body']);
 	}
 	
-- 
cgit v1.3