Changes in [1118:d81eaf4c347e:1119:cac97427d8d3]

Files:

• CHANGELOG (modified) (1 diff)
• inc/core/class.dc.blog.php (modified) (1 diff)
• inc/load_plugin_file.php (modified) (1 diff)
• inc/swf/swfupload.swf (modified) (previous)
• plugins/aboutConfig/index.php (modified) (1 diff)
• plugins/tags/_public.php (modified) (2 diffs)
• plugins/tags/js/post.js (modified) (1 diff)
• plugins/tags/js/posts_actions.js (modified) (1 diff)
• plugins/userPref/index.php (modified) (1 diff)

CHANGELOG

@@ -1 @@
-Dotclear 2.5.0 - 2013-02-24
-===========================================================
+Dotclear 2.5.0 - 2013-03-12
+===========================================================
+* Security fix: XSS vulnerabilities in swfupload.swf (media enhanced uploader)
 * Ductile theme may now use webfont (from Google, Adobe and similar providers)
 * daInstaller plugin is now included in the official distribution

inc/core/class.dc.blog.php

@@ -228 +228 @@
                'SELECT post_id, COUNT(post_id) AS nb_comment,comment_trackback '.
                'FROM '.$this->prefix.'comment '.
-               'WHERE post_id'.$this->con->in($a_ids).
-               'AND comment_status = 1 ';
+               'WHERE comment_status = 1 '.
+               (count($a_ids) > 0 ? 'AND post_id'.$this->con->in($a_ids) : ' ');
           
           if ($del) {

inc/load_plugin_file.php

@@ -47 +47 @@
 }
 
+// Only $_GET['pf'] is allowed in URL
+if (count($_GET) > 1)
+{
+    header('Content-Type: text/plain');
+    http::head(403,'Forbidden');
+    exit;
+}
+
 $allow_types = array('png','jpg','jpeg','gif','css','js','swf');
 

plugins/aboutConfig/index.php

@@ -76 +76 @@
      if ($s['type'] == 'boolean') {
           $field = form::combo(array($field_name.'['.$ns.']['.$id.']',$field_name.'_'.$id),
-          array(__('yes') => 1, __('no') => 0),$s['value']);
+          array(__('yes') => 1, __('no') => 0),$s['value'] ? 1 : 0);
      } else {
           $field = form::field(array($field_name.'['.$ns.']['.$id.']',$field_name.'_'.$id),40,null,

plugins/tags/_public.php

@@ -56 +56 @@
                return
                "<?php\n".
-               "@\$params['from'] .= ', '.\$core->prefix.'meta META ';\n".
-               "@\$params['sql'] .= 'AND META.post_id = P.post_id ';\n".
+               "if (!isset(\$params)) { \$params = array(); }\n".
+               "if (!isset(\$params['from'])) { \$params['from'] = ''; }\n".
+               "if (!isset(\$params['sql'])) { \$params['sql'] = ''; }\n".
+               "\$params['from'] .= ', '.\$core->prefix.'meta META ';\n".
+               "\$params['sql'] .= 'AND META.post_id = P.post_id ';\n".
                "\$params['sql'] .= \"AND META.meta_type = 'tag' \";\n".
                "\$params['sql'] .= \"AND META.meta_id = '".$core->con->escape($attr['tag'])."' \";\n".
@@ -66 +69 @@
                return
                '<?php if ($_ctx->exists("meta") && ($_ctx->meta->meta_type == "tag")) { '.
-                    "@\$params['from'] .= ', '.\$core->prefix.'meta META ';\n".
-                    "@\$params['sql'] .= 'AND META.post_id = P.post_id ';\n".
+                    "if (!isset(\$params)) { \$params = array(); }\n".
+                    "if (!isset(\$params['from'])) { \$params['from'] = ''; }\n".
+                    "if (!isset(\$params['sql'])) { \$params['sql'] = ''; }\n".
+                    "\$params['from'] .= ', '.\$core->prefix.'meta META ';\n".
+                    "\$params['sql'] .= 'AND META.post_id = P.post_id ';\n".
                     "\$params['sql'] .= \"AND META.meta_type = 'tag' \";\n".
                     "\$params['sql'] .= \"AND META.meta_id = '\".\$core->con->escape(\$_ctx->meta->meta_id).\"' \";\n".

plugins/tags/js/post.js

@@ -12 +12 @@
                }
                var mEdit = new metaEditor(tags_edit,meta_field,'tag');
+               mEdit.meta_url = 'plugin.php?p=tags&m=tag_posts&tag=';
                mEdit.displayMeta('tag',post_id);
                

plugins/tags/js/posts_actions.js

@@ -7 +7 @@
      var target = $('#tags_list'); 
      var mEdit = new metaEditor(target,tag_field,'tag');
+     mEdit.meta_url = 'plugin.php?p=tags&m=tag_posts&tag=';
      
      mEdit.meta_dialog = $('<input type="text" />');

plugins/userPref/index.php

@@ -72 +72 @@
      if ($s['type'] == 'boolean') {
           $field = form::combo(array($field_name.'['.$ws.']['.$id.']',$field_name.'_'.$id),
-          array(__('yes') => 1, __('no') => 0),$s['value']);
+          array(__('yes') => 1, __('no') => 0),$s['value'] ? 1 : 0);
      } else {
           $field = form::field(array($field_name.'['.$ws.']['.$id.']',$field_name.'_'.$id),40,null,