Changeset 3622:d7c2089bb952

Timestamp:

12/19/17 06:50:17 (8 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Parents:

3621:e1a3f3cf4930 (diff), 3611:e8ccb1c08e9f (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Merge 2.12 commits since 2.12.1 in default branch

Files:

• inc/admin/lib.dc.page.php (modified) (4 diffs)
• inc/admin/lib.dc.page.php (modified) (1 diff)
• inc/core/class.dc.blog.php (modified) (2 diffs)
• inc/core/class.dc.blog.php (modified) (1 diff)
• locales/fr/plugins.po (modified) (1 diff)

inc/admin/lib.dc.page.php

@@ -94 +94 @@
           # Content-Type
           $headers['content-type'] = 'Content-Type: text/html; charset=UTF-8';
+
+          # Referrer Policy for admin pages
+          $headers['referrer'] = 'Referrer-Policy: strict-origin';
 
           # Prevents Clickjacking as far as possible
@@ -352 +355 @@
 
           if (!$GLOBALS['__resources']['ctxhelp']) {
-               echo
-               '<p id="help-button"><a href="'.$core->adminurl->get("admin.help").'" class="outgoing" title="'.
-               __('Global help').'">'.__('Global help').'</a></p>';
+               if (!$core->auth->user_prefs->interface->hidehelpbutton) {
+                    echo
+                    '<p id="help-button"><a href="'.$core->adminurl->get("admin.help").'" class="outgoing" title="'.
+                    __('Global help').'">'.__('Global help').'</a></p>';
+               }
           }
 
@@ -419 +424 @@
           header('Content-Type: text/html; charset=UTF-8');
 
-          // Prevents Clickjacking as far as possible
+          # Referrer Policy for admin pages
+          header('Referrer-Policy: strict-origin');
+
+          # Prevents Clickjacking as far as possible
           header('X-Frame-Options: SAMEORIGIN'); // FF 3.6.9+ Chrome 4.1+ IE 8+ Safari 4+ Opera 10.5+
 
@@ -596 +604 @@
      {
           global $core;
+
+          if ($core->auth->user_prefs->interface->hidehelpbutton) {
+               return;
+          }
+
           $args = func_get_args();
-
           $args = new ArrayObject($args);
 

inc/admin/lib.dc.page.php

@@ -122 +122 @@
                     $csp_prefix."'self' 'unsafe-inline'".$csp_suffix;
                $csp['img-src'] = $core->blog->settings->system->csp_admin_img ?:
-                    $csp_prefix."'self' data: media.dotaddict.org blob:";
+                    $csp_prefix."'self' data: http://media.dotaddict.org blob:";
 
                # Cope with blog post preview (via public URL in iframe)

inc/core/class.dc.blog.php

@@ -694 +694 @@
           if (!$rs->isEmpty())
           {
-               if ($this->con->driver() == 'mysql' || $this->con->driver() == 'mysqli') {
+               if ($this->con->driver() == 'mysql' || $this->con->driver() == 'mysqli' || $this->con->driver() == 'mysqlimb4') {
                     $clause = "REGEXP '^".$this->con->escape($url)."[0-9]+$'";
                } elseif ($this->con->driver() == 'pgsql') {
@@ -1939 +1939 @@
           if (!$rs->isEmpty())
           {
-               if ($this->con->driver() == 'mysql' || $this->con->driver() == 'mysqli') {
+               if ($this->con->driver() == 'mysql' || $this->con->driver() == 'mysqli' || $this->con->driver() == 'mysqlimb4') {
                     $clause = "REGEXP '^".$this->con->escape(preg_quote($url))."[0-9]+$'";
                } elseif ($this->con->driver() == 'pgsql') {

inc/core/class.dc.blog.php

@@ -1940 +1940 @@
           {
                if ($this->con->driver() == 'mysql' || $this->con->driver() == 'mysqli' || $this->con->driver() == 'mysqlimb4') {
-                    $clause = "REGEXP '^".$this->con->escape($url)."[0-9]+$'";
+                    $clause = "REGEXP '^".$this->con->escape(preg_quote($url))."[0-9]+$'";
                } elseif ($this->con->driver() == 'pgsql') {
-                    $clause = "~ '^".$this->con->escape($url)."[0-9]+$'";
+                    $clause = "~ '^".$this->con->escape(preg_quote($url))."[0-9]+$'";
                } else {
-                    $clause = "LIKE '".$this->con->escape($url)."%'";
+                    $clause = "LIKE '".
+                              $this->con->escape(preg_replace(array('%','_','!'),array('!%','!_','!!'),$url)).
+                              "%' ESCAPE '!'";
                }
                $strReq = 'SELECT post_url FROM '.$this->prefix.'post '.

locales/fr/plugins.po

@@ -2001 +2001 @@
 msgstr "Liens de navigation"
 
+msgid "Open URL on a new tab"
+msgstr "S'ouvre dans un nouvel onglet"
+
+msgid "the link will open a new window"
+msgstr "Ce lien s'ouvrira dans une nouvelle fenêtre"
+
 msgid "Selected entries"
 msgstr "Billets sélectionnés"