gper/Gnuboard5
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

충돌 수정

Browse Source
This commit is contained in:
thisgun committed 2017-12-27 12:22:20 +09:00
2 parents dd51045f6d b64e3179cd
commit f2a6e758f3
2 files changed
+22 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

bbs/logout.php
+6 -2
View File
@@ -19,8 +19,12 @@ if ($url) {
$url = 'http:' . $url;
$p = @parse_url(urldecode($url));
if ($p['scheme'] || $p['host']) {
alert('url에 도메인을 지정할 수 없습니다.');
/*
// OpenRediect 취약점관련, PHP 5.3 이하버전에서는 parse_url 버그가 있음 ( Safflower 님 제보 ) 아래 url 예제
// http://localhost/bbs/logout.php?url=http://sir.kr%23@/
*/
if (preg_match('/^https?:\/\//i', $url) || $p['scheme'] || $p['host']) {
alert('url에 도메인을 지정할 수 없습니다.', G5_URL);
}
$link = $url;
plugin/htmlpurifier/extend.video.php
+16 -3
View File
@@ -21,11 +21,24 @@ if( !class_exists('HTMLPurifier_Filter_Iframevideo') ){
*/
public function preFilter($html, $config, $context)
{
$html = preg_replace('#<iframe#i', '<img class="Iframevideo"', $html);
$html = preg_replace('#</iframe>#i', '</img>', $html);
if (strstr($html, '<iframe')) {
$html = preg_replace_callback('/<iframe.*?src="https?:\/\/www\.youtube\.com\/embed\/([^"]*)[^>]*>(.*?)?\/iframe>/si', array($this, 'trust_url_match'), $html);
$html = preg_replace_callback('/<iframe.*?src="https?:\/\/player\.vimeo.com\/video\/([^"]*)[^>]*>(.*?)?\/iframe>/si', array($this, 'trust_url_match'), $html);
//$html = preg_replace('#<iframe#i', '<img class="Iframevideo"', $html);
//$html = preg_replace('#</iframe>#i', '</img>', $html);
}
return $html;
}
public function trust_url_match($matches)
{
$str = $matches[0];
if( $matches[1] ){
$str = preg_replace('#<iframe#i', '<img class="Iframevideo"', $str);
$str = preg_replace('#</iframe>#i', '</img>', $str);
}
return $str;
}
/**
*
* @param string $html
@@ -48,7 +61,7 @@ if( !class_exists('HTMLPurifier_Filter_Iframevideo') ){
{
// Domain Whitelist
$youTubeMatch = preg_match('#src="https?://www.youtube(-nocookie)?.com/#i', $matches[1]);
$vimeoMatch = preg_match('#src="http://player.vimeo.com/#i', $matches[1]);
$vimeoMatch = preg_match('#src="https?://player.vimeo.com/#i', $matches[1]);
if ($youTubeMatch || $vimeoMatch) {
$extra = ' frameborder="0"';
if ($youTubeMatch) {