Fix for #62: Comments weren't sanitized properly. Thanks, @Illevyard!
This commit is contained in:
azett
parent
a1f7aaad1f
commit
2139287c05
@ -82,7 +82,7 @@ function comment_validate() {
|
|||||||
* );
|
* );
|
||||||
*/
|
*/
|
||||||
|
|
||||||
$content = isset($_POST ['content']) ? trim(stripslashes($_POST ['content'])) : null;
|
$content = isset($_POST ['content']) ? trim(addslashes($_POST ['content'])) : null;
|
||||||
|
|
||||||
$errors = array();
|
$errors = array();
|
||||||
|
|
||||||
|
|||||||
@ -1,156 +1,145 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
class comment_indexer extends fs_filelister {
|
class comment_indexer extends fs_filelister {
|
||||||
|
|
||||||
function __construct($id) {
|
function __construct($id) {
|
||||||
$f = bdb_idtofile($id,BDB_COMMENT); //todo change
|
$f = bdb_idtofile($id, BDB_COMMENT); // todo change
|
||||||
$this->_directory = $f;
|
$this->_directory = $f;
|
||||||
parent::__construct();
|
parent::__construct();
|
||||||
//substr(bdb_idtofile($id), -strlen(EXT));
|
// substr(bdb_idtofile($id), -strlen(EXT));
|
||||||
|
}
|
||||||
|
|
||||||
|
function _checkFile($directory, $file) {
|
||||||
|
$f = "$directory/$file";
|
||||||
|
if (fnmatch('comment*' . EXT, $file)) {
|
||||||
|
array_push($this->_list, basename($file, EXT));
|
||||||
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
function _checkFile($directory, $file) {
|
|
||||||
$f = "$directory/$file";
|
|
||||||
if (fnmatch('comment*'.EXT, $file)) {
|
|
||||||
array_push($this->_list, basename($file,EXT));
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// overrides parent method to return sorted results
|
|
||||||
function getList() {
|
|
||||||
sort($this->_list);
|
|
||||||
return parent::getList();
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// overrides parent method to return sorted results
|
||||||
/**
|
function getList() {
|
||||||
* function bdb_get_comments
|
sort($this->_list);
|
||||||
*
|
return parent::getList();
|
||||||
* <p>On success returns an array containing the comment <b>IDs</b>, associated to
|
|
||||||
* the entry ID in $id</p>
|
|
||||||
* <p>On failure returns false</p>
|
|
||||||
*
|
|
||||||
* @param string $id string formatted like "prefixYYMMDD-HHMMSS.EXT"
|
|
||||||
* @return mixed
|
|
||||||
*
|
|
||||||
* @see bdb_idtofile()
|
|
||||||
*/
|
|
||||||
function comment_getlist($id) {
|
|
||||||
$obj = new comment_indexer($id); //todo change syntax
|
|
||||||
return $obj->getList();
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
function comment_parse($entryid, $id) {
|
}
|
||||||
|
|
||||||
$f = comment_exists($entryid, $id);
|
/**
|
||||||
|
* function bdb_get_comments
|
||||||
|
*
|
||||||
if (!$f) return false;
|
* <p>On success returns an array containing the comment <b>IDs</b>, associated to
|
||||||
|
* the entry ID in $id</p>
|
||||||
|
* <p>On failure returns false</p>
|
||||||
$fc = io_load_file($f);
|
*
|
||||||
$arr = utils_kexplode($fc);
|
* @param string $id
|
||||||
|
* string formatted like "prefixYYMMDD-HHMMSS.EXT"
|
||||||
//$arr['EMAIL'] = apply_filters('comment_email', $arr['EMAIL']);
|
* @return mixed
|
||||||
// hackish: dash to underscore for ip-address :( todo: clean this up here or somewhere else
|
*
|
||||||
//$arr['ip_address'] = $arr['ip-address'];
|
* @see bdb_idtofile()
|
||||||
return array_change_key_case($arr, CASE_LOWER);
|
*/
|
||||||
|
function comment_getlist($id) {
|
||||||
}
|
$obj = new comment_indexer($id); // todo change syntax
|
||||||
|
return $obj->getList();
|
||||||
function comment_exists($entryid, $id) {
|
}
|
||||||
if (!preg_match('|^comment[0-9]{6}-[0-9]{6}$|', $id))
|
|
||||||
return false;
|
|
||||||
$f = entry_exists($entryid);
|
|
||||||
if (!$f) return false;
|
|
||||||
|
|
||||||
$f2 = substr($f, 0, -strlen(EXT)) . '/comments/' . $id.EXT;
|
|
||||||
if (!file_exists($f2)) return false;
|
|
||||||
|
|
||||||
return $f2;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
function comment_clean(&$arr) {
|
|
||||||
$arr['name'] = apply_filters('pre_comment_author_name', stripslashes($arr['name']));
|
|
||||||
if (isset($arr['email']))
|
|
||||||
$arr['email'] = apply_filters('pre_comment_author_email', $arr['email']);
|
|
||||||
if (isset($arr['url']))
|
|
||||||
$arr['url'] = apply_filters('pre_comment_author_url', $arr['url']);
|
|
||||||
$arr['content'] = apply_filters('pre_comment_content', stripslashes($arr['content']));
|
|
||||||
return $arr;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* function bdb_save_comment
|
|
||||||
*
|
|
||||||
* <p>Saves the content of the $comment array, associating it to the entry-ID $id.</p>
|
|
||||||
* <p>$comment must be formatted as the one returned by {@link bdb_parse_entry()}.</p>
|
|
||||||
* <p>Returns true on success, or false on failure</p>
|
|
||||||
*
|
|
||||||
* @param string $id string formatted like "prefixYYMMDD-HHMMSS"
|
|
||||||
* @param array $comment array formatted as the one returned by {@link bdb_parse_entry()}
|
|
||||||
* @return bool
|
|
||||||
*
|
|
||||||
* @see bdb_parse_entry()
|
|
||||||
*/
|
|
||||||
function comment_save($id, $comment) {
|
|
||||||
|
|
||||||
comment_clean($comment);
|
|
||||||
|
|
||||||
$comment = array_change_key_case($comment, CASE_UPPER);
|
|
||||||
|
|
||||||
$comment_dir = bdb_idtofile($id,BDB_COMMENT);
|
|
||||||
|
|
||||||
if (!isset($comment['DATE']))
|
|
||||||
$comment['DATE'] = date_time();
|
|
||||||
$id = bdb_idfromtime(BDB_COMMENT, $comment['DATE']);
|
|
||||||
$f = $comment_dir . $id . EXT;
|
|
||||||
$str = utils_kimplode($comment);
|
|
||||||
if (io_write_file($f, $str))
|
|
||||||
return $id;
|
|
||||||
|
|
||||||
|
function comment_parse($entryid, $id) {
|
||||||
|
$f = comment_exists($entryid, $id);
|
||||||
|
|
||||||
|
if (!$f)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
|
$fc = io_load_file($f);
|
||||||
|
$arr = utils_kexplode($fc);
|
||||||
|
|
||||||
}
|
// $arr['EMAIL'] = apply_filters('comment_email', $arr['EMAIL']);
|
||||||
|
// hackish: dash to underscore for ip-address :( todo: clean this up here or somewhere else
|
||||||
|
// $arr['ip_address'] = $arr['ip-address'];
|
||||||
|
return array_change_key_case($arr, CASE_LOWER);
|
||||||
|
}
|
||||||
|
|
||||||
|
function comment_exists($entryid, $id) {
|
||||||
|
if (!preg_match('|^comment[0-9]{6}-[0-9]{6}$|', $id))
|
||||||
|
return false;
|
||||||
|
$f = entry_exists($entryid);
|
||||||
|
if (!$f)
|
||||||
|
return false;
|
||||||
|
|
||||||
|
$f2 = substr($f, 0, -strlen(EXT)) . '/comments/' . $id . EXT;
|
||||||
|
if (!file_exists($f2))
|
||||||
|
return false;
|
||||||
|
|
||||||
|
return $f2;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
function comment_clean(&$arr) {
|
||||||
* function comment_delete
|
$arr ['name'] = apply_filters('pre_comment_author_name', stripslashes($arr ['name']));
|
||||||
*
|
if (isset($arr ['email']))
|
||||||
* <p>Deletes the $id comment</p>
|
$arr ['email'] = apply_filters('pre_comment_author_email', $arr ['email']);
|
||||||
* <p>Returns true on success, or false on failure</p>
|
if (isset($arr ['url']))
|
||||||
*
|
$arr ['url'] = apply_filters('pre_comment_author_url', $arr ['url']);
|
||||||
* @param string $id string formatted like "entryYYMMDD-HHMMSS"
|
$arr ['content'] = apply_filters('pre_comment_content', $arr ['content']);
|
||||||
* @param string $comment_id string representig comment id as in "commentYYMMDD-HHMMSS"
|
return $arr;
|
||||||
* @return bool
|
}
|
||||||
*
|
|
||||||
* @see entry_delete()
|
|
||||||
*/
|
|
||||||
function comment_delete($id, $comment_id) {
|
|
||||||
do_action('comment_delete', $id, $comment_id);
|
|
||||||
$comment_dir = bdb_idtofile($id,BDB_COMMENT);
|
|
||||||
$f = $comment_dir . $comment_id .EXT;
|
|
||||||
return fs_delete($f);
|
|
||||||
}
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* function bdb_save_comment
|
||||||
|
*
|
||||||
|
* <p>Saves the content of the $comment array, associating it to the entry-ID $id.</p>
|
||||||
|
* <p>$comment must be formatted as the one returned by {@link bdb_parse_entry()}.</p>
|
||||||
|
* <p>Returns true on success, or false on failure</p>
|
||||||
|
*
|
||||||
|
* @param string $id
|
||||||
|
* string formatted like "prefixYYMMDD-HHMMSS"
|
||||||
|
* @param array $comment
|
||||||
|
* array formatted as the one returned by {@link bdb_parse_entry()}
|
||||||
|
* @return bool
|
||||||
|
*
|
||||||
|
* @see bdb_parse_entry()
|
||||||
|
*/
|
||||||
|
function comment_save($id, $comment) {
|
||||||
|
comment_clean($comment);
|
||||||
|
|
||||||
function dummy_comment($val) {
|
$comment = array_change_key_case($comment, CASE_UPPER);
|
||||||
return $val;
|
|
||||||
}
|
|
||||||
|
|
||||||
add_filter('comment_validate', 'dummy_comment');
|
$comment_dir = bdb_idtofile($id, BDB_COMMENT);
|
||||||
|
|
||||||
|
if (!isset($comment ['DATE']))
|
||||||
|
$comment ['DATE'] = date_time();
|
||||||
|
$id = bdb_idfromtime(BDB_COMMENT, $comment ['DATE']);
|
||||||
|
$f = $comment_dir . $id . EXT;
|
||||||
|
$str = utils_kimplode($comment);
|
||||||
|
if (io_write_file($f, $str))
|
||||||
|
return $id;
|
||||||
|
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* function comment_delete
|
||||||
|
*
|
||||||
|
* <p>Deletes the $id comment</p>
|
||||||
|
* <p>Returns true on success, or false on failure</p>
|
||||||
|
*
|
||||||
|
* @param string $id
|
||||||
|
* string formatted like "entryYYMMDD-HHMMSS"
|
||||||
|
* @param string $comment_id
|
||||||
|
* string representig comment id as in "commentYYMMDD-HHMMSS"
|
||||||
|
* @return bool
|
||||||
|
*
|
||||||
|
* @see entry_delete()
|
||||||
|
*/
|
||||||
|
function comment_delete($id, $comment_id) {
|
||||||
|
do_action('comment_delete', $id, $comment_id);
|
||||||
|
$comment_dir = bdb_idtofile($id, BDB_COMMENT);
|
||||||
|
$f = $comment_dir . $comment_id . EXT;
|
||||||
|
return fs_delete($f);
|
||||||
|
}
|
||||||
|
|
||||||
|
function dummy_comment($val) {
|
||||||
|
return $val;
|
||||||
|
}
|
||||||
|
|
||||||
|
add_filter('comment_validate', 'dummy_comment');
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user