From 840b1452914910ebdbf09821f1fc8dabe44e8567 Mon Sep 17 00:00:00 2001 From: Ozh Date: Sun, 9 Dec 2012 22:04:25 +0000 Subject: [PATCH] Proper use of escaping functions. Fixes issue 1079. Fixes issue 909. Thanks @nic_waller git-svn-id: http://yourls.googlecode.com/svn/trunk@815 12232710-3e20-11de-b438-597f59cd7555 --- includes/functions-html.php | 103 +++++++++++++++++++++++------------- js/insert.js | 2 +- yourls-infos.php | 4 +- 3 files changed, 68 insertions(+), 41 deletions(-) diff --git a/includes/functions-html.php b/includes/functions-html.php index 26bde56..2a2f01b 100644 --- a/includes/functions-html.php +++ b/includes/functions-html.php @@ -267,7 +267,7 @@ function yourls_share_box( $longurl, $shorturl, $title='', $text='', $shortlink_ $text = ( $text ? '"'.$text.'" ' : '' ); $title = ( $title ? "$title " : '' ); - $share = htmlspecialchars_decode( $title.$text.$shorturl ); + $share = yourls_esc_textarea( $title.$text.$shorturl ); $count = 140 - strlen( $share ); $hidden = ( $hidden ? 'style="display:none;"' : '' ); @@ -286,11 +286,11 @@ function yourls_share_box( $longurl, $shorturl, $title='', $text='', $shortlink_
-

-

Long link: +

+

Long link: -
Stats: + - +
Stats: + +

@@ -346,9 +346,10 @@ function yourls_table_edit_row( $keyword ) { $keyword = yourls_sanitize_string( $keyword ); $id = yourls_string2htmlid( $keyword ); // used as HTML #id $url = yourls_get_keyword_longurl( $keyword ); + $title = htmlspecialchars( yourls_get_keyword_title( $keyword ) ); - $safe_url = stripslashes( $url ); - $safe_title = stripslashes( $title ); + $safe_url = yourls_esc_attr( $url ); + $safe_title = yourls_esc_attr( $title ); $www = yourls_link(); $save_link = yourls_nonce_url( 'save-link_'.$id, @@ -359,7 +360,7 @@ function yourls_table_edit_row( $keyword ) { if( $url ) { $return = <<Original URL: Short URL: $www
Title:   +Long URL:
Short URL: $www
Title:   RETURN; } else { $return = 'Error, URL not found'; @@ -373,31 +374,11 @@ function yourls_table_edit_row( $keyword ) { // Add a link row function yourls_table_add_row( $keyword, $url, $title = '', $ip, $clicks, $timestamp ) { $keyword = yourls_sanitize_string( $keyword ); - $display_keyword = htmlentities( $keyword ); - - $url = yourls_sanitize_url( $url ); - $display_url = htmlentities( yourls_trim_long_string( $url ) ); - $title_url = htmlspecialchars( $url ); - - $title = yourls_sanitize_title( $title ) ; - $display_title = yourls_trim_long_string( $title ); - $title = htmlspecialchars( $title ); - - $id = yourls_string2htmlid( $keyword ); // used as HTML #id - $date = date( 'M d, Y H:i', $timestamp+( YOURLS_HOURS_OFFSET * 3600 ) ); - $clicks = number_format( $clicks, 0, '', '' ); - + $id = yourls_string2htmlid( $keyword ); // used as HTML #id $shorturl = yourls_link( $keyword ); + $statlink = yourls_statlink( $keyword ); - if( yourls_is_ssl() ) - $statlink = str_replace( 'http://', 'https://', $statlink ); - - if( $title ) { - $display_link = "$display_title
$display_url"; - } else { - $display_link = "$display_url"; - } - + $delete_link = yourls_nonce_url( 'delete-link_'.$id, yourls_add_query_arg( array( 'id' => $id, 'action' => 'delete', 'keyword' => $keyword ), yourls_admin_url( 'admin-ajax.php' ) ) ); @@ -406,7 +387,7 @@ function yourls_table_add_row( $keyword, $url, $title = '', $ip, $clicks, $times yourls_add_query_arg( array( 'id' => $id, 'action' => 'edit', 'keyword' => $keyword ), yourls_admin_url( 'admin-ajax.php' ) ) ); - // Action button links + // Action link buttons: the array $actions = array( 'stats' => array( 'href' => $statlink, @@ -437,6 +418,8 @@ function yourls_table_add_row( $keyword, $url, $title = '', $ip, $clicks, $times ) ); $actions = yourls_apply_filter( 'table_add_row_action_array', $actions ); + + // Action link buttons: the HTML $action_links = ''; foreach( $actions as $key => $action ) { $onclick = isset( $action['onclick'] ) ? 'onclick="' . $action['onclick'] . '"' : '' ; @@ -445,10 +428,53 @@ function yourls_table_add_row( $keyword, $url, $title = '', $ip, $clicks, $times ); } $action_links = yourls_apply_filter( 'action_links', $action_links, $keyword, $url, $ip, $clicks, $timestamp ); - - $row = <<$display_keyword$display_link$date$ip$clicks$action_links -ROW; + + if( ! $title ) + $title = $url; + + // Row cells: the array + $cells = array( + 'keyword' => array( + 'template' => '%keyword_html%', + 'shorturl' => yourls_esc_url( $shorturl ), + 'keyword_html' => yourls_esc_html( $keyword ), + ), + 'url' => array( + 'template' => '%title_html%
%long_url_html%', + 'long_url' => yourls_esc_url( $url ), + 'title_attr' => yourls_esc_attr( $title ), + 'title_html' => yourls_esc_html( yourls_trim_long_string( $title ) ), + 'long_url_html' => yourls_esc_html( yourls_trim_long_string( $url ) ), + ), + 'timestamp' => array( + 'template' => '%date%', + 'date' => date( 'M d, Y H:i', $timestamp +( YOURLS_HOURS_OFFSET * 3600 ) ), + ), + 'ip' => array( + 'template' => '%ip%', + 'ip' => $ip, + ), + 'clicks' => array( + 'template' => '%clicks%', + 'clicks' => number_format( $clicks, 0, '', '' ), + ), + 'actions' => array( + 'template' => '%actions% ', + 'actions' => $action_links, + 'id' => $id, + 'keyword' => $keyword, + ), + ); + $cells = yourls_apply_filter( 'table_add_row_cell_array', $cells, $keyword, $url, $title, $ip, $clicks, $timestamp ); + + // Row cells: the HTML. Replace every %stuff% in 'template' with 'stuff' value. + $row = ""; + foreach( $cells as $cell_id => $elements ) { + $row .= sprintf( '', $cell_id, $cell_id . '-' . $id ); + $row .= preg_replace( '/%([^%]+)?%/e', '$elements["$1"]', $elements['template'] ); + $row .= ''; + } + $row .= ""; $row = yourls_apply_filter( 'table_add_row', $row, $keyword, $url, $title, $ip, $clicks, $timestamp ); return $row; @@ -495,8 +521,9 @@ function yourls_html_link( $href, $title = '', $element = '' ) { if( !$title ) $title = $href; if( $element ) - $element = "id='$element'"; - echo yourls_apply_filter( 'html_link', "$title" ); + $element = sprintf( 'id="%s"', yourls_esc_attr( $element ) ); + $link = sprintf( '%s', yourls_esc_url( $href ), $element, yourls_esc_html( $title ) ); + echo yourls_apply_filter( 'html_link', $link ); } // Display the login screen. Nothing past this point. diff --git a/js/insert.js b/js/insert.js index f7dc543..c00f56d 100644 --- a/js/insert.js +++ b/js/insert.js @@ -127,7 +127,7 @@ function hide_edit(id) { // Save edition of a link function edit_save(id) { add_loading("#edit-close-" + id); - var newurl = $("#edit-url-" + id).val(); + var newurl = encodeURI( $("#edit-url-" + id).val() ); var newkeyword = $("#edit-keyword-" + id).val(); var title = $("#edit-title-" + id).val(); var keyword = $('#old_keyword_'+id).val(); diff --git a/yourls-infos.php b/yourls-infos.php index 80bff33..a58b678 100644 --- a/yourls-infos.php +++ b/yourls-infos.php @@ -206,9 +206,9 @@ yourls_html_menu(); ?> -

+

-

Short URL: +

Short URL: