From ca0a4274dca80c53b1e5fed6f6f7244999a8877e Mon Sep 17 00:00:00 2001 From: Dmitriy Simushev Date: Thu, 30 Jan 2014 09:09:15 +0000 Subject: [PATCH 1/9] Add Handlebars.php to the project via composer --- .gitignore | 7 +++++++ src/composer.json | 8 ++++++++ 2 files changed, 15 insertions(+) create mode 100644 src/composer.json diff --git a/.gitignore b/.gitignore index 1fc5e393..3d193d4c 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,10 @@ src/mibew/plugins/* src/mibew/locales/* !src/mibew/locales/en/ !src/mibew/locales/names/ + +# Do not index composer files +src/composer.phar +src/composer.lock + +# Do not index third-party libraries +src/mibew/vendor diff --git a/src/composer.json b/src/composer.json new file mode 100644 index 00000000..4152f80a --- /dev/null +++ b/src/composer.json @@ -0,0 +1,8 @@ +{ + "require": { + "xamin/handlebars.php": "dev-master#44a6f96e9658ef526bbb2a06bc754abc71cdba99" + }, + "config": { + "vendor-dir": "mibew/vendor" + } +} \ No newline at end of file From 825da2027f211e2abedd54f04d6c28142abd28e6 Mon Sep 17 00:00:00 2001 From: Dmitriy Simushev Date: Fri, 31 Jan 2014 09:44:24 +0000 Subject: [PATCH 2/9] Remove ".idea" folder --- .gitignore | 1 - src/.idea/.name | 1 - src/.idea/codeStyleSettings.xml | 31 ------- src/.idea/encodings.xml | 13 --- .../inspectionProfiles/Project_Default.xml | 11 --- .../inspectionProfiles/profiles_settings.xml | 7 -- src/.idea/messenger.iml | 15 ---- src/.idea/misc.xml | 8 -- src/.idea/modules.xml | 9 --- src/.idea/projectCodeStyle.xml | 80 ------------------- src/.idea/scopes/scope_settings.xml | 5 -- src/.idea/vcs.xml | 7 -- 12 files changed, 188 deletions(-) delete mode 100644 src/.idea/.name delete mode 100644 src/.idea/codeStyleSettings.xml delete mode 100644 src/.idea/encodings.xml delete mode 100644 src/.idea/inspectionProfiles/Project_Default.xml delete mode 100644 src/.idea/inspectionProfiles/profiles_settings.xml delete mode 100644 src/.idea/messenger.iml delete mode 100644 src/.idea/misc.xml delete mode 100644 src/.idea/modules.xml delete mode 100644 src/.idea/projectCodeStyle.xml delete mode 100644 src/.idea/scopes/scope_settings.xml delete mode 100644 src/.idea/vcs.xml diff --git a/.gitignore b/.gitignore index 3d193d4c..e75c5ae8 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,3 @@ -src/.idea/workspace.xml src/mibew/install/package src/absent_* src/release* diff --git a/src/.idea/.name b/src/.idea/.name deleted file mode 100644 index 4c926610..00000000 --- a/src/.idea/.name +++ /dev/null @@ -1 +0,0 @@ -messenger \ No newline at end of file diff --git a/src/.idea/codeStyleSettings.xml b/src/.idea/codeStyleSettings.xml deleted file mode 100644 index de6382eb..00000000 --- a/src/.idea/codeStyleSettings.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - - - - - diff --git a/src/.idea/encodings.xml b/src/.idea/encodings.xml deleted file mode 100644 index 0b99745d..00000000 --- a/src/.idea/encodings.xml +++ /dev/null @@ -1,13 +0,0 @@ - - - - - - - - - - - - - diff --git a/src/.idea/inspectionProfiles/Project_Default.xml b/src/.idea/inspectionProfiles/Project_Default.xml deleted file mode 100644 index c66df003..00000000 --- a/src/.idea/inspectionProfiles/Project_Default.xml +++ /dev/null @@ -1,11 +0,0 @@ - - - - \ No newline at end of file diff --git a/src/.idea/inspectionProfiles/profiles_settings.xml b/src/.idea/inspectionProfiles/profiles_settings.xml deleted file mode 100644 index 3b312839..00000000 --- a/src/.idea/inspectionProfiles/profiles_settings.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/src/.idea/messenger.iml b/src/.idea/messenger.iml deleted file mode 100644 index 54192b37..00000000 --- a/src/.idea/messenger.iml +++ /dev/null @@ -1,15 +0,0 @@ - - - - - - - - - - - - - - - diff --git a/src/.idea/misc.xml b/src/.idea/misc.xml deleted file mode 100644 index 11e74ae4..00000000 --- a/src/.idea/misc.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - - http://www.w3.org/1999/xhtml - - - - diff --git a/src/.idea/modules.xml b/src/.idea/modules.xml deleted file mode 100644 index 3160e9b9..00000000 --- a/src/.idea/modules.xml +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/src/.idea/projectCodeStyle.xml b/src/.idea/projectCodeStyle.xml deleted file mode 100644 index 596456e4..00000000 --- a/src/.idea/projectCodeStyle.xml +++ /dev/null @@ -1,80 +0,0 @@ - - - - - - - diff --git a/src/.idea/scopes/scope_settings.xml b/src/.idea/scopes/scope_settings.xml deleted file mode 100644 index 922003b8..00000000 --- a/src/.idea/scopes/scope_settings.xml +++ /dev/null @@ -1,5 +0,0 @@ - - - - \ No newline at end of file diff --git a/src/.idea/vcs.xml b/src/.idea/vcs.xml deleted file mode 100644 index 9ab281ac..00000000 --- a/src/.idea/vcs.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - - - - From 8d3dcacded78acaa5e3cc317c5a556a509275c3e Mon Sep 17 00:00:00 2001 From: Dmitriy Simushev Date: Fri, 31 Jan 2014 12:52:59 +0000 Subject: [PATCH 3/9] Use sanitization for locale constants --- src/mibew/b.php | 3 +- src/mibew/libs/chat.php | 12 ++- .../RequestProcessor/ThreadProcessor.php | 8 +- src/mibew/libs/classes/Mibew/Thread.php | 38 ++++--- src/mibew/libs/common/locale.php | 51 +++++---- src/mibew/libs/common/string.php | 101 ++++++++++++++++++ src/mibew/libs/invitation.php | 9 +- src/mibew/mail.php | 5 +- src/mibew/operator/redirect.php | 6 +- 9 files changed, 183 insertions(+), 50 deletions(-) diff --git a/src/mibew/b.php b/src/mibew/b.php index a5536140..f364917a 100644 --- a/src/mibew/b.php +++ b/src/mibew/b.php @@ -33,7 +33,8 @@ if ($referer && isset($_SESSION['threadid'])) { $msg = getstring2_( "chat.client.visited.page", array($referer), - $thread->locale + $thread->locale, + true ); $thread->postMessage(Thread::KIND_FOR_AGENT, $msg); } diff --git a/src/mibew/libs/chat.php b/src/mibew/libs/chat.php index a5a6457a..47d73e69 100644 --- a/src/mibew/libs/chat.php +++ b/src/mibew/libs/chat.php @@ -723,14 +723,15 @@ function chat_start_for_user( Thread::KIND_FOR_AGENT, getstring2( 'chat.visitor.invitation.accepted', - array($operator_name) + array($operator_name), + true ) ); } else { if ($referrer) { $thread->postMessage( Thread::KIND_FOR_AGENT, - getstring2('chat.came.from', array($referrer)) + getstring2('chat.came.from', array($referrer), true) ); } if ($requested_operator && !$requested_operator_online) { @@ -738,11 +739,12 @@ function chat_start_for_user( Thread::KIND_INFO, getstring2( 'chat.requested_operator.offline', - array(get_operator_name($requested_operator)) + array(get_operator_name($requested_operator)), + true ) ); } else { - $thread->postMessage(Thread::KIND_INFO, getstring('chat.wait')); + $thread->postMessage(Thread::KIND_INFO, getstring('chat.wait', true)); } } @@ -750,7 +752,7 @@ function chat_start_for_user( if ($info) { $thread->postMessage( Thread::KIND_FOR_AGENT, - getstring2('chat.visitor.info', array($info)) + getstring2('chat.visitor.info', array($info), true) ); } diff --git a/src/mibew/libs/classes/Mibew/RequestProcessor/ThreadProcessor.php b/src/mibew/libs/classes/Mibew/RequestProcessor/ThreadProcessor.php index afdd3962..3adeaba7 100644 --- a/src/mibew/libs/classes/Mibew/RequestProcessor/ThreadProcessor.php +++ b/src/mibew/libs/classes/Mibew/RequestProcessor/ThreadProcessor.php @@ -533,7 +533,7 @@ class ThreadProcessor extends ClientSideProcessor if ($email) { $thread->postMessage( Thread::KIND_FOR_AGENT, - getstring2('chat.visitor.email', array($email)) + getstring2('chat.visitor.email', array($email), true) ); } @@ -647,19 +647,19 @@ class ThreadProcessor extends ClientSideProcessor if ($referrer) { $thread->postMessage( Thread::KIND_FOR_AGENT, - getstring2('chat.came.from', array($referrer)) + getstring2('chat.came.from', array($referrer), true) ); } if ($email) { $thread->postMessage( Thread::KIND_FOR_AGENT, - getstring2('chat.visitor.email', array($email)) + getstring2('chat.visitor.email', array($email), true) ); } if ($info) { $thread->postMessage( Thread::KIND_FOR_AGENT, - getstring2('chat.visitor.info', array($info)) + getstring2('chat.visitor.info', array($info), true) ); } $thread->postMessage(Thread::KIND_USER, $message, array('name' => $name)); diff --git a/src/mibew/libs/classes/Mibew/Thread.php b/src/mibew/libs/classes/Mibew/Thread.php index 6ccb5df7..e4057353 100644 --- a/src/mibew/libs/classes/Mibew/Thread.php +++ b/src/mibew/libs/classes/Mibew/Thread.php @@ -364,7 +364,7 @@ class Thread // Send message $thread->postMessage( self::KIND_EVENTS, - getstring_("chat.status.user.reopenedthread", $thread->locale) + getstring_("chat.status.user.reopenedthread", $thread->locale, true) ); return $thread; @@ -602,7 +602,8 @@ class Thread // Send message to user $message_to_post = getstring_( "chat.status.operator.dead", - $this->locale + $this->locale, + true ); $this->postMessage( self::KIND_CONN, @@ -626,7 +627,8 @@ class Thread // And send a message to operator $message_to_post = getstring_( "chat.status.user.dead", - $this->locale + $this->locale, + true ); $this->postMessage( self::KIND_FOR_AGENT, @@ -708,13 +710,15 @@ class Thread $message_to_post = getstring2_( "chat.status.operator.changed", array($operator_name, $this->agentName), - $this->locale + $this->locale, + true ); } else { $message_to_post = getstring2_( "chat.status.operator.returned", array($operator_name), - $this->locale + $this->locale, + true ); } @@ -867,7 +871,8 @@ class Thread getstring2_( "chat.status.user.left", array($this->userName), - $this->locale + $this->locale, + true ) ); } else { @@ -876,7 +881,8 @@ class Thread self::KIND_FOR_AGENT, getstring_( "chat.visitor.invitation.canceled", - $this->locale + $this->locale, + true ) ); } else { @@ -885,7 +891,8 @@ class Thread getstring2_( "chat.status.operator.left", array($this->agentName), - $this->locale + $this->locale, + true ) ); } @@ -942,20 +949,23 @@ class Thread $message = getstring2_( "chat.status.operator.changed", array($operator_name, $this->agentName), - $this->locale + $this->locale, + true ); } else { $message = getstring2_( "chat.status.operator.returned", array($operator_name), - $this->locale + $this->locale, + true ); } } else { $message = getstring2_( "chat.status.operator.joined", array($operator_name), - $this->locale + $this->locale, + true ); } } elseif ($this->state == self::STATE_CHATTING) { @@ -965,7 +975,8 @@ class Thread $message = getstring2_( "chat.status.operator.changed", array($operator_name, $this->agentName), - $this->locale + $this->locale, + true ); } } else { @@ -1015,7 +1026,8 @@ class Thread $message = getstring2_( "chat.status.user.changedname", array($old_name, $new_name), - $this->locale + $this->locale, + true ); $this->postMessage(self::KIND_EVENTS, $message); } diff --git a/src/mibew/libs/common/locale.php b/src/mibew/libs/common/locale.php index ee3689eb..0adf3f4c 100644 --- a/src/mibew/libs/common/locale.php +++ b/src/mibew/libs/common/locale.php @@ -287,7 +287,7 @@ function getoutputenc() : MIBEW_ENCODING; } -function getstring_($text, $locale) +function getstring_($text, $locale, $raw = false) { global $messages; if (!isset($messages[$locale])) { @@ -296,53 +296,66 @@ function getstring_($text, $locale) $localized = $messages[$locale]; if (isset($localized[$text])) { - return $localized[$text]; + return $raw + ? $localized[$text] + : sanitize_string($localized[$text], 'low', 'moderate'); } if ($locale != 'en') { - return getstring_($text, 'en'); + return getstring_($text, 'en', $raw); } - return "!" . $text; + return "!" . ($raw ? $text : sanitize_string($text, 'low', 'moderate')); } -function getstring($text) +function getstring($text, $raw = false) { - return getstring_($text, CURRENT_LOCALE); + return getstring_($text, CURRENT_LOCALE, $raw); } -function getlocal($text) +function getlocal($text, $raw = false) { - return myiconv(MIBEW_ENCODING, getoutputenc(), getstring_($text, CURRENT_LOCALE)); + return getlocal_($text, CURRENT_LOCALE, $raw); } -function getlocal_($text, $locale) +function getlocal_($text, $locale, $raw = false) { - return myiconv(MIBEW_ENCODING, getoutputenc(), getstring_($text, $locale)); + $string = myiconv( + MIBEW_ENCODING, + getoutputenc(), + getstring_($text, $locale, true) + ); + + return $raw ? $string : sanitize_string($string, 'low', 'moderate'); } -function getstring2_($text, $params, $locale) +function getstring2_($text, $params, $locale, $raw = false) { - $string = getstring_($text, $locale); + $string = getstring_($text, $locale, true); for ($i = 0; $i < count($params); $i++) { $string = str_replace("{" . $i . "}", $params[$i], $string); } - return $string; + return $raw ? $string : sanitize_string($string, 'low', 'moderate'); } -function getstring2($text, $params) +function getstring2($text, $params, $raw = false) { - return getstring2_($text, $params, CURRENT_LOCALE); + return getstring2_($text, $params, CURRENT_LOCALE, $raw); } -function getlocal2($text, $params) +function getlocal2($text, $params, $raw = false) { - $string = myiconv(MIBEW_ENCODING, getoutputenc(), getstring_($text, CURRENT_LOCALE)); + $string = myiconv( + MIBEW_ENCODING, + getoutputenc(), + getstring_($text, CURRENT_LOCALE, true) + ); + for ($i = 0; $i < count($params); $i++) { $string = str_replace("{" . $i . "}", $params[$i], $string); } - return $string; + return $raw ? $string : sanitize_string($string, 'low', 'moderate'); } /* prepares for Javascript string */ @@ -354,7 +367,7 @@ function get_local_for_js($text, $params) $string = str_replace("{" . $i . "}", $params[$i], $string); } - return $string; + return sanitize_string($string, 'low', 'moderate'); } function locale_load_id_list($name) diff --git a/src/mibew/libs/common/string.php b/src/mibew/libs/common/string.php index db3feeab..3802d0fe 100644 --- a/src/mibew/libs/common/string.php +++ b/src/mibew/libs/common/string.php @@ -54,3 +54,104 @@ function escape_with_cdata($text) { return "", "]]>]]>"; } + +/** + * Simple HTML sanitation. + * + * Includes some code from the PHP StripAttributes Class For XML and HTML. + * + * @param string $string Target string + * @param string $tags_level Sanitation level for tags. Available values are + * "high", "moderate" and "low". + * @param string $attr_level Sanitation level for attributes. Available values + * are "high", "moderate" and "low". + * @return string Sanitized string with stripped dangerous tags and attributes. + * + * @author David (semlabs.co.uk) + * @copyright (c) 2009, David (semlabs.co.uk) + * @license MIT + * @link http://semlabs.co.uk/journal/php-strip-attributes-class-for-xml-and-html + */ +function sanitize_string($string, $tags_level = 'high', $attr_level = 'high') +{ + $sanitize_tags = array( + 'high' => '', + 'moderate' => '
', + 'low' => '