diff --git a/admin/javascript/lang/de.js b/admin/javascript/lang/de.js index d43b2335a..65eb96fb2 100644 --- a/admin/javascript/lang/de.js +++ b/admin/javascript/lang/de.js @@ -9,7 +9,7 @@ if(typeof(ss) == 'undefined' || typeof(ss.i18n) == 'undefined') { "CMSMAIN.BATCH_PUBLISH_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\n\nWollen Sie diese wirklich veröffentlichen?", "CMSMAIN.BATCH_DELETE_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\n\nWollen Sie diese wirklich löschen?", "CMSMAIN.BATCH_ARCHIVE_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\n\nWollen Sie diese wirklich archivieren?\n\nDiese Seiten und alle Unterseiten davon werden von der veröffentlichen Seite gelöscht und in das Archiv verschoben.", - "CMSMAIN.BATCH_RESTORE_PROMPT": "You have {num} page(s) selected.\n\nDo you really want to restore to stage?\n\nChildren of archived pages will be restored to the root level, unless those pages are also being restored.", + "CMSMAIN.BATCH_RESTORE_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\\n\\nWollen Sie diese wirklich wiederherstellen?\\n\\nUnterseiten von archivierten Seiten werden auf der Root-Ebene wiederhergestellt, es sei denn, diese Seiten werden ebenfalls wiederhergestellt.", "CMSMAIN.BATCH_DELETELIVE_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\n\nWollen Sie diese wirklich von der veröfffentlichten Seite löschen?", "LeftAndMain.CONFIRMUNSAVED": "Sind Sie sicher, dass Sie die Seite verlassen möchten?\n\nWARNUNG: Ihre Änderungen werden nicht gespeichert.\n\nDrücken Sie \"OK\" um fortzufahren, oder \"Abbrechen\" um auf dieser Seite zu bleiben.", "LeftAndMain.CONFIRMUNSAVEDSHORT": "WARNUNG: Ihre Änderungen wurden nicht gespeichert.", diff --git a/admin/javascript/lang/ro.js b/admin/javascript/lang/ro.js index c5895f4ab..733561e71 100644 --- a/admin/javascript/lang/ro.js +++ b/admin/javascript/lang/ro.js @@ -4,8 +4,8 @@ if(typeof(ss) == 'undefined' || typeof(ss.i18n) == 'undefined') { if(typeof(console) != 'undefined') console.error('Class ss.i18n not defined'); } else { ss.i18n.addDictionary('ro', { - "CMSMAIN.SELECTONEPAGE": "Please select at least one page", - "CMSMAIN.BATCH_UNPUBLISH_PROMPT": "You have {num} page(s) selected.\n\nDo you really want to unpublish", + "CMSMAIN.SELECTONEPAGE": "Vă rugăm să selectaţi cel puțin o pagină.", + "CMSMAIN.BATCH_UNPUBLISH_PROMPT": "Aveti {num} pagina(i) selectate.\n\nDoriti sa le nenublicati", "CMSMAIN.BATCH_PUBLISH_PROMPT": "You have {num} page(s) selected.\n\nDo you really want to publish?", "CMSMAIN.BATCH_DELETE_PROMPT": "You have {num} page(s) selected.\n\nDo you really want to delete?", "CMSMAIN.BATCH_ARCHIVE_PROMPT": "You have {num} page(s) selected.\n\nAre you sure you want to archive these pages?\n\nThese pages and all of their children pages will be unpublished and sent to the archive.", diff --git a/admin/javascript/lang/src/de.js b/admin/javascript/lang/src/de.js index 9f10852dd..5599a84af 100644 --- a/admin/javascript/lang/src/de.js +++ b/admin/javascript/lang/src/de.js @@ -4,7 +4,7 @@ "CMSMAIN.BATCH_PUBLISH_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\n\nWollen Sie diese wirklich veröffentlichen?", "CMSMAIN.BATCH_DELETE_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\n\nWollen Sie diese wirklich löschen?", "CMSMAIN.BATCH_ARCHIVE_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\n\nWollen Sie diese wirklich archivieren?\n\nDiese Seiten und alle Unterseiten davon werden von der veröffentlichen Seite gelöscht und in das Archiv verschoben.", - "CMSMAIN.BATCH_RESTORE_PROMPT": "You have {num} page(s) selected.\n\nDo you really want to restore to stage?\n\nChildren of archived pages will be restored to the root level, unless those pages are also being restored.", + "CMSMAIN.BATCH_RESTORE_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\\n\\nWollen Sie diese wirklich wiederherstellen?\\n\\nUnterseiten von archivierten Seiten werden auf der Root-Ebene wiederhergestellt, es sei denn, diese Seiten werden ebenfalls wiederhergestellt.", "CMSMAIN.BATCH_DELETELIVE_PROMPT": "Sie haben {num} Seite(n) ausgewählt.\n\nWollen Sie diese wirklich von der veröfffentlichten Seite löschen?", "LeftAndMain.CONFIRMUNSAVED": "Sind Sie sicher, dass Sie die Seite verlassen möchten?\n\nWARNUNG: Ihre Änderungen werden nicht gespeichert.\n\nDrücken Sie \"OK\" um fortzufahren, oder \"Abbrechen\" um auf dieser Seite zu bleiben.", "LeftAndMain.CONFIRMUNSAVEDSHORT": "WARNUNG: Ihre Änderungen wurden nicht gespeichert.", diff --git a/admin/javascript/lang/src/ro.js b/admin/javascript/lang/src/ro.js index 43d6cba2c..2488400ea 100644 --- a/admin/javascript/lang/src/ro.js +++ b/admin/javascript/lang/src/ro.js @@ -1,6 +1,6 @@ { - "CMSMAIN.SELECTONEPAGE": "Please select at least one page", - "CMSMAIN.BATCH_UNPUBLISH_PROMPT": "You have {num} page(s) selected.\n\nDo you really want to unpublish", + "CMSMAIN.SELECTONEPAGE": "Vă rugăm să selectaţi cel puțin o pagină.", + "CMSMAIN.BATCH_UNPUBLISH_PROMPT": "Aveti {num} pagina(i) selectate.\n\nDoriti sa le nenublicati", "CMSMAIN.BATCH_PUBLISH_PROMPT": "You have {num} page(s) selected.\n\nDo you really want to publish?", "CMSMAIN.BATCH_DELETE_PROMPT": "You have {num} page(s) selected.\n\nDo you really want to delete?", "CMSMAIN.BATCH_ARCHIVE_PROMPT": "You have {num} page(s) selected.\n\nAre you sure you want to archive these pages?\n\nThese pages and all of their children pages will be unpublished and sent to the archive.", diff --git a/api/RSSFeed.php b/api/RSSFeed.php index 12174d9c9..22d6d704e 100644 --- a/api/RSSFeed.php +++ b/api/RSSFeed.php @@ -16,6 +16,7 @@ class RSSFeed extends ViewableData { private static $casting = array( "Title" => "Varchar", "Description" => "Varchar", + "Link" => "Varchar", ); /** diff --git a/control/RequestHandler.php b/control/RequestHandler.php index 41f5eba60..17ffe4ab8 100644 --- a/control/RequestHandler.php +++ b/control/RequestHandler.php @@ -188,14 +188,14 @@ class RequestHandler extends ViewableData { user_error("Non-string method name: " . var_export($action, true), E_USER_ERROR); } - $className = get_class($this); + $classMessage = Director::isLive() ? 'on this handler' : 'on class '.get_class($this); try { if(!$this->hasAction($action)) { - return $this->httpError(404, "Action '$action' isn't available on class $className."); + return $this->httpError(404, "Action '$action' isn't available $classMessage."); } if(!$this->checkAccessAction($action) || in_array(strtolower($action), array('run', 'init'))) { - return $this->httpError(403, "Action '$action' isn't allowed on class $className."); + return $this->httpError(403, "Action '$action' isn't allowed $classMessage."); } $result = $this->handleAction($request, $action); } @@ -232,7 +232,7 @@ class RequestHandler extends ViewableData { // But if we have more content on the URL and we don't know what to do with it, return an error. } else { - return $this->httpError(404, "I can't handle sub-URLs of a $this->class object."); + return $this->httpError(404, "I can't handle sub-URLs $classMessage."); } return $this; @@ -276,10 +276,10 @@ class RequestHandler extends ViewableData { * @return SS_HTTPResponse */ protected function handleAction($request, $action) { - $className = get_class($this); + $classMessage = Director::isLive() ? 'on this handler' : 'on class '.get_class($this); if(!$this->hasMethod($action)) { - return new SS_HTTPResponse("Action '$action' isn't available on class $className.", 404); + return new SS_HTTPResponse("Action '$action' isn't available $classMessage.", 404); } $res = $this->extend('beforeCallActionHandler', $request, $action); diff --git a/docs/en/02_Developer_Guides/03_Forms/Field_types/03_HTMLEditorField.md b/docs/en/02_Developer_Guides/03_Forms/Field_types/03_HTMLEditorField.md index 13b276dde..b18938ca5 100644 --- a/docs/en/02_Developer_Guides/03_Forms/Field_types/03_HTMLEditorField.md +++ b/docs/en/02_Developer_Guides/03_Forms/Field_types/03_HTMLEditorField.md @@ -218,6 +218,18 @@ To refresh a oEmbed cache, append `?flush=1` to a URL. To disable oEmbed usage, set the `Oembed.enabled` configuration property to "false". +## Limiting oembed URLs + +HtmlEditorField can have whitelists set on both the scheme (default http & https) and domains allowed when +inserting files for use with oembed. + +This is performed through the config variables `HtmlEditorField_Toolbar::$fileurl_scheme_whitelist` and +`HtmlEditorField_Toolbar::$fileurl_domain_whitelist`. + +Setting these configuration variables to empty arrays will disable the whitelist. Setting them to an array of +lower case strings will require the scheme or domain respectively to exactly match one of those strings (no +wildcards are currently supported). + ### Doctypes Since TinyMCE generates markup, it needs to know which doctype your documents will be rendered in. You can set this diff --git a/docs/en/04_Changelogs/3.2.1.md b/docs/en/04_Changelogs/3.2.1.md new file mode 100644 index 000000000..542610874 --- /dev/null +++ b/docs/en/04_Changelogs/3.2.1.md @@ -0,0 +1,56 @@ +# 3.2.1 + +## Upgrading + +FormField validation messages generated by the `Validator` class will now be automatically XML +encoded before being rendered alongside an invalid field. + +If a validation message in a custom `Validator` instance should be rendered as literal HTML, +then the $message parameter for `Validator::validationError` should be passed as an instance +of `HTMLText` + +For example: + + + :::php + class MyCustomValidator extends Validator { + public function php($data) { + $this->validationError( + 'EmailAddress', + DBField::create_field('HTMLText', "Invalid email. Please sign up at this page") + ); + } + } + + + + +## Change Log + +### Security + + * 2015-11-12 [b61d6dc](https://github.com/silverstripe/silverstripe-framework/commit/b61d6dcd57577b0345af7a69e51da409305e1957) HtmlEditorField_Toolbar#viewfile not whitelisting URLs (Hamish Friedlander) - See [ss-2015-027](http://www.silverstripe.org/download/security-releases/ss-2015-027) + * 2015-11-11 [bc1b289](https://github.com/silverstripe/silverstripe-framework/commit/bc1b2893accba6401c03f9ea3b0cbc4621c7a02c) Fix FormField error messages not being encoded safely (Damian Mooyman) - See [ss-2015-026](http://www.silverstripe.org/download/security-releases/ss-2015-026) + * 2015-11-09 [f290d86](https://github.com/silverstripe/silverstripe-framework/commit/f290d869e01e0087286b4f2bc92e95d15c229c45) Dont expose class on error (Hamish Friedlander) - See [ss-2015-025](http://www.silverstripe.org/download/security-releases/ss-2015-025) + * 2015-11-01 [4f55b6a](https://github.com/silverstripe/silverstripe-framework/commit/4f55b6a115ce0de8c5c258fb44eca52b8b112caf) XML escape RSSFeed $link parameter (Ingo Schommer) - See [ss-2015-022](http://www.silverstripe.org/download/security-releases/ss-2015-022) + * 2015-10-28 [132e9b3](https://github.com/silverstripe/silverstripe-framework/commit/132e9b3e2fad361ebb4b502b6a37d34d013bfba3) Fix rewrite hash links XSS (Damian Mooyman) - See [ss-2015-021](http://www.silverstripe.org/download/security-releases/ss-2015-021) + +### Bugfixes + + * 2015-11-10 [732e705](https://github.com/silverstripe/silverstripe-framework/commit/732e705bbf548024b123d5160863395f2f74e7d9) Correct behaviour for empty filter array (as per 3.1) (Damian Mooyman) + * 2015-11-09 [414ea3d](https://github.com/silverstripe/silverstripe-framework/commit/414ea3de9e87812c5ac96cc15062307c608e0963) prevent UploadField edit form generation for Folders (Damian Mooyman) + * 2015-11-05 [c6c650f](https://github.com/silverstripe/silverstripe-cms/commit/c6c650f1366348327d973ca6cc5a5ed33a467786) Ensure CMSMainTest uses correct siteconfig (Damian Mooyman) + * 2015-11-02 [0272e44](https://github.com/silverstripe/silverstripe-framework/commit/0272e443f44ebca55b05c14f2a112260ff0df284) Prevent dev/build continually regenerating Number field type (Damian Mooyman) + * 2015-10-30 [2813f94](https://github.com/silverstripe/silverstripe-framework/commit/2813f94124c2ba14f1e4a51001e3898b0e0c32aa) Ensure that filters on any fixed field are scoped to the base data table (Damian Mooyman) + * 2015-10-30 [38ca963](https://github.com/silverstripe/silverstripe-framework/commit/38ca9632c4e9df0a74eae70cec98fdce242da529) Add missing CMSSecurity route (Damian Mooyman) + * 2015-10-29 [daa86d3](https://github.com/silverstripe/silverstripe-framework/commit/daa86d3a4ce75bf8637134726864ae14fbbdf586) Fix regression from #4396 in test fixtures (Damian Mooyman) + * 2015-10-28 [db16248](https://github.com/silverstripe/silverstripe-framework/commit/db16248b9ab7677cc4b4e25857a6b6d36f8c35f0) Fix broken InlineFormAction (Damian Mooyman) + * 2015-10-27 [293d847](https://github.com/silverstripe/silverstripe-framework/commit/293d84721efafedf3dd3fe69dd1d013a8c07d3ff) for #4712: Dropping in some PHP documentation on return types for dynamically generated image methods. (Patrick Nelson) + * 2015-10-20 [b857bdf](https://github.com/silverstripe/silverstripe-framework/commit/b857bdf209d79fc623724e68f6a660354cbd5f93) Fix duplicate files being included in case of flush (Damian Mooyman) + * 2015-10-19 [c364158](https://github.com/silverstripe/silverstripe-framework/commit/c3641587a5d5977af4fa053e5813846ce990d86c) only use sethasemptydefault if exists. (Cam Findlay) + * 2015-10-08 [ff6c0a3](https://github.com/silverstripe/silverstripe-cms/commit/ff6c0a3160c5eb3ca624efea6585efb44399dc1c) (v3.1) for #1294 to workaround ErrorPage fatal errors (and undefined var) when publishing. (Patrick Nelson) + * 2015-10-08 [785f850](https://github.com/silverstripe/silverstripe-cms/commit/785f85047f64b76011c34542362c7f09dbf59021) for #1294 to workaround ErrorPage fatal errors (and undefined var) when publishing. (Patrick Nelson) + * 2015-10-01 [75dc391](https://github.com/silverstripe/silverstripe-cms/commit/75dc391df9b396756a6f02c5fca08eafcb53ba31) for #586 and possible fix for #736 and relates to #2449: Don't perform validation upon deletion, since it isn't necessary. Cleaned up type hint. (Patrick Nelson) + * 2015-09-17 [e64d73c](https://github.com/silverstripe/silverstripe-framework/commit/e64d73c1f741399412b6015f6602ed707b2e9778) Fix ClassInfo::table_for_object_field (Damian Mooyman) + * 2015-08-05 [2901664](https://github.com/silverstripe/silverstripe-framework/commit/29016645e5e759b1ecf49876fa79c357a68c5794) . FulltextFilter requires table identifiers in match query (Elvinas L.) + * 2015-07-12 [f192a6e](https://github.com/silverstripe/silverstripe-framework/commit/f192a6ecaf70446ec60f6c7ef2a555395f83ea16) #4392: Ensure headers are checked first before being clobbered by globally maintained state. Also ensuring tests utilize separate responses for isolation. (Patrick Nelson) diff --git a/docs/en/04_Changelogs/rc/3.2.1-rc1.md b/docs/en/04_Changelogs/rc/3.2.1-rc1.md new file mode 100644 index 000000000..05f1b2a18 --- /dev/null +++ b/docs/en/04_Changelogs/rc/3.2.1-rc1.md @@ -0,0 +1,34 @@ +# 3.2.1-rc1 + +See [3.2.1](/changelogs/3.2.1) changelog for more information on what is new in 3.2.1 + + + +## Change Log + +### Security + + * 2015-11-11 [bc1b289](https://github.com/silverstripe/silverstripe-framework/commit/bc1b2893accba6401c03f9ea3b0cbc4621c7a02c) Fix FormField error messages not being encoded safely (Damian Mooyman) - See [ss-2015-026](http://www.silverstripe.org/download/security-releases/ss-2015-026) + * 2015-11-09 [f290d86](https://github.com/silverstripe/silverstripe-framework/commit/f290d869e01e0087286b4f2bc92e95d15c229c45) Dont expose class on error (Hamish Friedlander) - See [ss-2015-025](http://www.silverstripe.org/download/security-releases/ss-2015-025) + * 2015-11-01 [4f55b6a](https://github.com/silverstripe/silverstripe-framework/commit/4f55b6a115ce0de8c5c258fb44eca52b8b112caf) XML escape RSSFeed $link parameter (Ingo Schommer) - See [ss-2015-022](http://www.silverstripe.org/download/security-releases/ss-2015-022) + * 2015-10-28 [132e9b3](https://github.com/silverstripe/silverstripe-framework/commit/132e9b3e2fad361ebb4b502b6a37d34d013bfba3) Fix rewrite hash links XSS (Damian Mooyman) - See [ss-2015-021](http://www.silverstripe.org/download/security-releases/ss-2015-021) + +### Bugfixes + + * 2015-11-10 [732e705](https://github.com/silverstripe/silverstripe-framework/commit/732e705bbf548024b123d5160863395f2f74e7d9) Correct behaviour for empty filter array (as per 3.1) (Damian Mooyman) + * 2015-11-09 [414ea3d](https://github.com/silverstripe/silverstripe-framework/commit/414ea3de9e87812c5ac96cc15062307c608e0963) prevent UploadField edit form generation for Folders (Damian Mooyman) + * 2015-11-05 [c6c650f](https://github.com/silverstripe/silverstripe-cms/commit/c6c650f1366348327d973ca6cc5a5ed33a467786) Ensure CMSMainTest uses correct siteconfig (Damian Mooyman) + * 2015-11-02 [0272e44](https://github.com/silverstripe/silverstripe-framework/commit/0272e443f44ebca55b05c14f2a112260ff0df284) Prevent dev/build continually regenerating Number field type (Damian Mooyman) + * 2015-10-30 [2813f94](https://github.com/silverstripe/silverstripe-framework/commit/2813f94124c2ba14f1e4a51001e3898b0e0c32aa) Ensure that filters on any fixed field are scoped to the base data table (Damian Mooyman) + * 2015-10-30 [38ca963](https://github.com/silverstripe/silverstripe-framework/commit/38ca9632c4e9df0a74eae70cec98fdce242da529) Add missing CMSSecurity route (Damian Mooyman) + * 2015-10-29 [daa86d3](https://github.com/silverstripe/silverstripe-framework/commit/daa86d3a4ce75bf8637134726864ae14fbbdf586) Fix regression from #4396 in test fixtures (Damian Mooyman) + * 2015-10-28 [db16248](https://github.com/silverstripe/silverstripe-framework/commit/db16248b9ab7677cc4b4e25857a6b6d36f8c35f0) Fix broken InlineFormAction (Damian Mooyman) + * 2015-10-27 [293d847](https://github.com/silverstripe/silverstripe-framework/commit/293d84721efafedf3dd3fe69dd1d013a8c07d3ff) for #4712: Dropping in some PHP documentation on return types for dynamically generated image methods. (Patrick Nelson) + * 2015-10-20 [b857bdf](https://github.com/silverstripe/silverstripe-framework/commit/b857bdf209d79fc623724e68f6a660354cbd5f93) Fix duplicate files being included in case of flush (Damian Mooyman) + * 2015-10-19 [c364158](https://github.com/silverstripe/silverstripe-framework/commit/c3641587a5d5977af4fa053e5813846ce990d86c) only use sethasemptydefault if exists. (Cam Findlay) + * 2015-10-08 [ff6c0a3](https://github.com/silverstripe/silverstripe-cms/commit/ff6c0a3160c5eb3ca624efea6585efb44399dc1c) (v3.1) for #1294 to workaround ErrorPage fatal errors (and undefined var) when publishing. (Patrick Nelson) + * 2015-10-08 [785f850](https://github.com/silverstripe/silverstripe-cms/commit/785f85047f64b76011c34542362c7f09dbf59021) for #1294 to workaround ErrorPage fatal errors (and undefined var) when publishing. (Patrick Nelson) + * 2015-10-01 [75dc391](https://github.com/silverstripe/silverstripe-cms/commit/75dc391df9b396756a6f02c5fca08eafcb53ba31) for #586 and possible fix for #736 and relates to #2449: Don't perform validation upon deletion, since it isn't necessary. Cleaned up type hint. (Patrick Nelson) + * 2015-09-17 [e64d73c](https://github.com/silverstripe/silverstripe-framework/commit/e64d73c1f741399412b6015f6602ed707b2e9778) Fix ClassInfo::table_for_object_field (Damian Mooyman) + * 2015-08-05 [2901664](https://github.com/silverstripe/silverstripe-framework/commit/29016645e5e759b1ecf49876fa79c357a68c5794) . FulltextFilter requires table identifiers in match query (Elvinas L.) + * 2015-07-12 [f192a6e](https://github.com/silverstripe/silverstripe-framework/commit/f192a6ecaf70446ec60f6c7ef2a555395f83ea16) #4392: Ensure headers are checked first before being clobbered by globally maintained state. Also ensuring tests utilize separate responses for isolation. (Patrick Nelson) diff --git a/docs/en/04_Changelogs/rc/3.2.1-rc2.md b/docs/en/04_Changelogs/rc/3.2.1-rc2.md new file mode 100644 index 000000000..dd7690a64 --- /dev/null +++ b/docs/en/04_Changelogs/rc/3.2.1-rc2.md @@ -0,0 +1,11 @@ +# 3.2.1-rc2 + +See [3.2.1](/changelogs/3.2.1) changelog for more information on what is new in 3.2.1 + + + +## Change Log + +### Security + + * 2015-11-12 [b61d6dc](https://github.com/silverstripe/silverstripe-framework/commit/b61d6dcd57577b0345af7a69e51da409305e1957) HtmlEditorField_Toolbar#viewfile not whitelisting URLs (Hamish Friedlander) - See [ss-2015-027](http://www.silverstripe.org/download/security-releases/ss-2015-027) diff --git a/forms/Form.php b/forms/Form.php index 5b24754ac..0714aceef 100644 --- a/forms/Form.php +++ b/forms/Form.php @@ -1303,6 +1303,18 @@ class Form extends RequestHandler { // Load errors into session and post back $data = $this->getData(); + // Encode validation messages as XML before saving into session state + // As per Form::addErrorMessage() + $errors = array_map(function($error) { + // Encode message as XML by default + if($error['message'] instanceof DBField) { + $error['message'] = $error['message']->forTemplate();; + } else { + $error['message'] = Convert::raw2xml($error['message']); + } + return $error; + }, $errors); + Session::set("FormInfo.{$this->FormName()}.errors", $errors); Session::set("FormInfo.{$this->FormName()}.data", $data); diff --git a/forms/HtmlEditorField.php b/forms/HtmlEditorField.php index 03c1a1c65..f9f58e747 100644 --- a/forms/HtmlEditorField.php +++ b/forms/HtmlEditorField.php @@ -449,40 +449,98 @@ class HtmlEditorField_Toolbar extends RequestHandler { return $form; } + /** + * @config + * @var array - list of allowed schemes (no wildcard, all lower case) or empty to allow all schemes + */ + private static $fileurl_scheme_whitelist = array('http', 'https'); + + /** + * @config + * @var array - list of allowed domains (no wildcard, all lower case) or empty to allow all domains + */ + private static $fileurl_domain_whitelist = array(); + + protected function viewfile_getLocalFileByID($id) { + $file = DataObject::get_by_id('File', $id); + + if ($file && $file->canView()) return array($file, $file->RelativeLink()); + return array(null, null); + } + + protected function viewfile_getLocalFileByURL($fileUrl) { + $filteredUrl = Director::makeRelative($fileUrl); + $filteredUrl = preg_replace('/_resampled\/[^-]+-/', '', $filteredUrl); + + $file = File::get()->filter('Filename', $filteredUrl)->first(); + + if ($file && $file->canView()) return array($file, $filteredUrl); + return array(null, null); + } + + protected function viewfile_getRemoteFileByURL($fileUrl) { + $scheme = strtolower(parse_url($fileUrl, PHP_URL_SCHEME)); + $allowed_schemes = self::config()->fileurl_scheme_whitelist; + + if (!$scheme || ($allowed_schemes && !in_array($scheme, $allowed_schemes))) { + $exception = new SS_HTTPResponse_Exception("This file scheme is not included in the whitelist", 400); + $exception->getResponse()->addHeader('X-Status', $exception->getMessage()); + throw $exception; + } + + $domain = strtolower(parse_url($fileUrl, PHP_URL_HOST)); + $allowed_domains = self::config()->fileurl_domain_whitelist; + + if (!$domain || ($allowed_domains && !in_array($domain, $allowed_domains))) { + $exception = new SS_HTTPResponse_Exception("This file hostname is not included in the whitelist", 400); + $exception->getResponse()->addHeader('X-Status', $exception->getMessage()); + throw $exception; + } + + return array( + new File(array( + 'Title' => basename($fileUrl), + 'Filename' => $fileUrl + )), + $fileUrl + ); + } + /** * View of a single file, either on the filesystem or on the web. */ public function viewfile($request) { + $file = null; + $url = null; // TODO Would be cleaner to consistently pass URL for both local and remote files, // but GridField doesn't allow for this kind of metadata customization at the moment. - if($url = $request->getVar('FileURL')) { - if(Director::is_absolute_url($url) && !Director::is_site_url($url)) { - $url = $url; - $file = new File(array( - 'Title' => basename($url), - 'Filename' => $url - )); - } else { - $url = Director::makeRelative($request->getVar('FileURL')); - $url = preg_replace('/_resampled\/[^-]+-/', '', $url); - $file = File::get()->filter('Filename', $url)->first(); - if(!$file) $file = new File(array( - 'Title' => basename($url), - 'Filename' => $url - )); + if($fileUrl = $request->getVar('FileURL')) { + // If this isn't an absolute URL, or is, but is to this site, try and get the File object + // that is associated with it + if(!Director::is_absolute_url($fileUrl) || Director::is_site_url($fileUrl)) { + list($file, $url) = $this->viewfile_getLocalFileByURL($fileUrl); } - } elseif($id = $request->getVar('ID')) { - $file = DataObject::get_by_id('File', $id); - $url = $file->RelativeLink(); - } else { - throw new LogicException('Need either "ID" or "FileURL" parameter to identify the file'); + // If this is an absolute URL, but not to this site, use as an oembed source (after whitelisting URL) + else { + list($file, $url) = $this->viewfile_getRemoteFileByURL($fileUrl); + } + } + // Or we could have been passed an ID directly + elseif($id = $request->getVar('ID')) { + list($file, $url) = $this->viewfile_getLocalFileByID($id); + } + // Or we could have been passed nothing, in which case panic + else { + throw new SS_HTTPResponse_Exception('Need either "ID" or "FileURL" parameter to identify the file', 400); } // Instanciate file wrapper and get fields based on its type // Check if appCategory is an image and exists on the local system, otherwise use oEmbed to refference a // remote image - if($file && $file->appCategory() == 'image' && Director::is_site_url($url)) { + if (!$file || !$url) { + throw new SS_HTTPResponse_Exception('Unable to find file to view', 404); + } elseif($file->appCategory() == 'image' && Director::is_site_url($url)) { $fileWrapper = new HtmlEditorField_Image($url, $file); } elseif(!Director::is_site_url($url)) { $fileWrapper = new HtmlEditorField_Embed($url, $file); diff --git a/lang/cs.yml b/lang/cs.yml index 710dff459..a96f65879 100644 --- a/lang/cs.yml +++ b/lang/cs.yml @@ -292,8 +292,6 @@ cs: FROMWEB: 'Z webu' FindInFolder: 'Hledat ve složce' IMAGEALT: 'Alternativní text (alt)' - IMAGEALTTEXT: 'Alternativní text (alt) - ukáže se, když obrázek nemúže být zobrazen' - IMAGEALTTEXTDESC: 'Zobrazeno na obrazovce, anebo když obrázek nemůže být zobrazen' IMAGEDIMENSIONS: Rozměry IMAGEHEIGHTPX: Výška IMAGETITLE: 'Titul text (tooltip) - další informace o obrázku' @@ -328,11 +326,9 @@ cs: DELETED: Smazáno. DropdownBatchActionsDefault: Akcie HELP: Nápověda - PAGETYPE: 'Typ stránky:' PERMAGAIN: 'Byli jste odhlášeni z CMS. Pokud se chcete znovu přihlásit, zadejte níže své uživatelské jméno a heslo.' PERMALREADY: 'Omlouvám se, ale nemůžete vstoupit do této části CMS. Pokud se chcete přihlásit jako někdo jiný, udělejte tak níže.' PERMDEFAULT: 'Musíte být přihlášen/a k přístup do oblasti administrace, zadejte vaše přihlošovací údaje dole, prosím.' - PLEASESAVE: 'Uložte stránku, prosím. Tato stránka nemůže být aktualizována, protože ještě nebyla uložena.' PreviewButton: Náhled REORGANISATIONSUCCESSFUL: 'Strom webu reorganizován úspěšně.' SAVEDUP: Uloženo. diff --git a/lang/de.yml b/lang/de.yml index 15f637333..de6f1f233 100644 --- a/lang/de.yml +++ b/lang/de.yml @@ -260,6 +260,7 @@ de: many_many_Members: Mitglieder GroupImportForm: Help1: '
Eine oder mehrere Gruppen im CSV-Format (kommaseparierte Werte) importieren. Erweiterte Nutzung
' + Help2: 'Mitglieder im CSV-Format (kommaseparierte Werte) importieren. Erweiterte Nutzung
' + Help2: 'Usuario inválido. Por favor, vuelva a autenticar aquí para continuar.
' LoginMessage: 'Si Ud tiene cualquier trabajo sin guardar puede volver donde lo dejó, iniciando sesión más abajo.
' + SUCCESS: Exito SUCCESSCONTENT: 'Inicio de sesión exitoso. Si Ud no es automáticamente redireccionado, haga clic aquí
' TimedOutTitleAnonymous: 'Expiró su sesión.' TimedOutTitleMember: 'Eh {name}!Importar uno o más grupos en formato CSV (valores separados por coma). Mostrar uso avanzado
' + Help2: 'Importar usuarios en formato CSV (valores separados por coma). Mostrar uso avanzado
' + Help2: '