Veiligheids-fix in phpBB (bugfix)

[Cybertroy]

http://www.phpbb.nl/nieuws.php?news_id=5139

Nou wat ik ook probeer en zoek in bbcode.php ik kan de aangegeven stukken text niet vinden
Hou moet ik dan deze bug fixen ??

PS. ik heb al de 2.0.6 draaien (Patch File Only)

[WebSiteNet]

Dit staat op regel 107

Code: Selecteer alles

	$bbcode_tpl['url4'] = str_replace('{URL}', 'http://\\1', $bbcode_tpl['url']); 
	$bbcode_tpl['url4'] = str_replace('{DESCRIPTION}', '\\3', $bbcode_tpl['url4']);

Dit staat op regel 200:

Code: Selecteer alles

	// matches a [url]xxxx://www.phpbb.com[/url] code.. 
	$patterns[] = "#\[url\]([\w]+?://[^ \"\n\r\t<]*?)\[/url\]#is"; 
	$replacements[] = $bbcode_tpl['url1']; 

	// [url]www.phpbb.com[/url] code.. (no xxxx:// prefix). 
	$patterns[] = "#\[url\]((www|ftp)\.[^ \"\n\r\t<]*?)\[/url\]#is"; 
	$replacements[] = $bbcode_tpl['url2']; 

	// [url=xxxx://www.phpbb.com]phpBB[/url] code.. 
	$patterns[] = "#\[url=([\w]+?://[^ \"\n\r\t<]*?)\](.*?)\[/url\]#is"; 
	$replacements[] = $bbcode_tpl['url3']; 

	// [url=www.phpbb.com]phpBB[/url] code.. (no xxxx:// prefix). 
	$patterns[] = "#\[url=((www|ftp)\.[^ \"\n\r\t<]*?)\](.*?)\[/url\]#is"; 
	$replacements[] = $bbcode_tpl['url4']; 

Dit staat op regel 621:

Code: Selecteer alles

	// matches an "xxxx://yyyy" URL at the start of a line, or after a space. 
	// xxxx can only be alpha characters. 
	// yyyy is anything up to the first space, newline, comma, double quote or < 
	$ret = preg_replace("#(^|[\n ])([\w]+?://[^ \"\n\r\t<]*)#is", "\\1<a href=\"\\2\" target=\"_blank\">\\2</a>", $ret); 

	// matches a "www|ftp.xxxx.yyyy[/zzzz]" kinda lazy URL thing 
	// Must contain at least 2 dots. xxxx contains either alphanum, or "-" 
	// zzzz is optional.. will contain everything up to the first space, newline, 
	// comma, double quote or <. 
	$ret = preg_replace("#(^|[\n ])((www|ftp)\.[^ \"\t\n\r<]*)#is", "\\1<a href=\"http://\\2\" target=\"_blank\">\\2</a>", $ret); 

[Cybertroy]

Had wel zo'n reactie verwacht

Oke dit staat er bij mij in de BBCODE.PHP (op dit moment)

regel 107

Code: Selecteer alles

$bbcode_tpl['url4'] = str_replace('{URL}', 'http://\\1', $bbcode_tpl['url']);
$bbcode_tpl['url4'] = str_replace('{DESCRIPTION}', '\\2', $bbcode_tpl['url4']);

regel 200

Code: Selecteer alles

// [url]xxxx://www.phpbb.com[/url] code..
$patterns[1] = "#\[url\]([a-z]+?://){1}([a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+\(\)]+)\[/url\]#si";
$replacements[1] = $bbcode_tpl['url1'];

// [url]www.phpbb.com[/url] code.. (no xxxx:// prefix).
$patterns[2] = "#\[url\]([a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+\(\)]+)\[/url\]#si";
$replacements[2] = $bbcode_tpl['url2'];

// [url=xxxx://www.phpbb.com]phpBB[/url] code..
$patterns[3] = "#\[url=([a-z]+?://){1}([a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+\(\)]+)\](.*?)\[/url\]#si";
$replacements[3] = $bbcode_tpl['url3'];

// [url=www.phpbb.com]phpBB[/url] code.. (no xxxx:// prefix).
$patterns[4] = "#\[url=([a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+\(\)]+)\](.*?)\[/url\]#si";
$replacements[4] = $bbcode_tpl['url4'];

en regel 620

Code: Selecteer alles

// matches an "xxxx://yyyy" URL at the start of a line, or after a space.
// xxxx can only be alpha characters.
// yyyy is anything up to the first space, newline, or comma.
$ret = preg_replace("#([\n ])([a-z]+?)://([a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+]+)#i", "\\1<a href=\"\\2://\\3\" target=\"_blank\">\\2://\\3</a>", $ret);

// matches a "www.xxxx.yyyy[/zzzz]" kinda lazy URL thing
// Must contain at least 2 dots. xxxx contains either alphanum, or "-"
// yyyy contains either alphanum, "-", or "."
// zzzz is optional.. will contain everything up to the first space, newline, or comma.
// This is slightly restrictive - it's not going to match stuff like "forums.foo.com"
// This is to keep it from getting annoying and matching stuff that's not meant to be a link.
$ret = preg_replace("#([\n ])www\.([a-z0-9\-]+)\.([a-z0-9\-.\~]+)((?:/[a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+]*)?)#i", "\\1<a href=\"http://www.\\2.\\3\\4\" target=\"_blank\">www.\\2.\\3\\4</a>", $ret);

Zoals je kan zien klop het lang niet ... Wat is er aan de hand

[WebSiteNet]

Je hebt ze wel gevonden....

[Cybertroy]

Je hebt ze wel gevonden....

Jazeker, maar dat had ik hiervoor ook al natuurlijk, anders had ik niet geweten dat het niet klopte

Maar wat moet ik nu doen, gewoon nergens naar kijken en domweg vervangen? of....

[WebSiteNet]

Vervangen. Zoals het hier staat:

http://www.phpbb.nl/nieuws.php?news_id=5139

[Cybertroy]

Vervangen. Zoals het hier staat:

http://www.phpbb.nl/nieuws.php?news_id=5139

Is reeds gebeurt, en heb tot nu toe nog geen problemen gezien dus is het goed gegaan