OSDN -- Open-Source-Software-Entwicklung und Downloads
Übersetzungsstatus von Deutsch translation status for de
  • R/O
  • HTTP
  • SSH
  • HTTPS
Fork

nucleus-jp-ancient: Commit

Nucleus CMS日本語版SVNをgit-svnしたもの。リポジトリの変換作業用


Commit MetaInfo

Revision5b0be6799b4fcdb1d38eafda173e572cbf702ff1 (tree)
Zeit2008-09-26 13:32:31
Autorkimitake <kimitake@1ca2...>
Commiterkimitake

Log Message

fixed XSS issue

git-svn-id: https://svn.sourceforge.jp/svnroot/nucleus-jp/nucleus-jp/tags/release-3-31-sp2@709 1ca29b6e-896d-4ea0-84a5-967f57386b96

Ändern Zusammenfassung

Diff

--- a/euc/nucleus/libs/globalfunctions.php
+++ b/euc/nucleus/libs/globalfunctions.php
@@ -307,6 +307,13 @@ if (!headers_sent() ) {
307307 $language = getLanguageName();
308308 include($DIR_LANG . ereg_replace( '[\\|/]', '', $language) . '.php');
309309
310+// check if valid charset
311+if (!encoding_check(false,false,_CHARSET)) {
312+ foreach(array($_REQUEST, $_SERVER) as $input) {
313+ array_walk($input, 'encoding_check');
314+ }
315+}
316+
310317 /*
311318 Backed out for now: See http://forum.nucleuscms.org/viewtopic.php?t=3684 for details
312319
@@ -551,6 +558,13 @@ function sendContentType($contenttype, $pagetype = '', $charset = _CHARSET) {
551558 } else {
552559 header('Content-Type: ' . $contenttype);
553560 }
561+
562+ // check if valid charset
563+ if (!encoding_check(false,false,$charset)) {
564+ foreach(array($_REQUEST, $_SERVER) as $input) {
565+ array_walk($input, 'encoding_check');
566+ }
567+ }
554568 }
555569 }
556570
@@ -558,9 +572,11 @@ function sendContentType($contenttype, $pagetype = '', $charset = _CHARSET) {
558572 * Errors before the database connection has been made
559573 */
560574 function startUpError($msg, $title) {
575+ if (!defined('_CHARSET')) define('_CHARSET','iso-8859-1');
576+ header('Content-Type: text/html; charset=' . _CHARSET);
561577 ?>
562578 <html xmlns="http://www.w3.org/1999/xhtml">
563- <head><meta http-equiv="Content-Type" content="text/html; charset=EUC-JP" />
579+ <head><meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET?>" />
564580 <title><?php echo htmlspecialchars($title)?></title></head>
565581 <body>
566582 <h1><?php echo htmlspecialchars($title)?></h1>
@@ -1495,6 +1511,69 @@ function formatDate($format, $timestamp, $defaultFormat, &$blog) {
14951511 }
14961512 }
14971513
1514+function encoding_check($val, $key, $encoding=false, $exclude=false) {
1515+ /*
1516+ When 3rd argument is set, return if checked already.
1517+ When 4th argument is set, set the excluded key(s).
1518+ */
1519+ static $search=false, $checked=array(), $excludes=array();
1520+ if ($exclude!==false) {
1521+ if (is_array($exclude)) {
1522+ foreach($exclude as $v) $excludes[$v]=true;
1523+ } else $excludes[$excludes]=true;
1524+ return;
1525+ }
1526+ if ($encoding!==false) {
1527+ switch($encoding=strtolower($encoding)){
1528+ case 'utf-8':
1529+ $search='/^([\x00-\x7F]+'.
1530+ '|[\xC2-\xDF][\x80-\xBF]'.
1531+ '|[\xE0-\xEF][\x80-\xBF][\x80-\xBF]'.
1532+ '|[\xF0-\xF7][\x80-\xBF][\x80-\xBF][\x80-\xBF]'.
1533+ '|[\xF8-\xFB][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF]'.
1534+ '|[\xFC-\xFD][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF])*/';
1535+ break;
1536+ case 'euc-jp':
1537+ $search='/^([\x00-\x7F]+'.
1538+ '|[\x8E][\xA0-\xDF]'.
1539+ '|[\x8F]?[\xA1-\xFE][\xA1-\xFE])*/';
1540+ break;
1541+ case 'gb2312':
1542+ $search='/^([\x00-\x7F]+'.
1543+ '|[\xA1-\xF7][\xA1-\xFE])*/';
1544+ break;
1545+ default:
1546+ $search=false;
1547+ if (preg_match('/^iso\-8859\-[0-9]{1,2}$/',$encoding)) break;
1548+ if (preg_match('/^windows\-125[0-8]$/',$encoding)) break;
1549+ startUpError('<p>Unknown or non-supported encoding.</p>', 'Encoding Error');
1550+ exit;
1551+ }
1552+ if (isset($checked[$encoding])) return true; // Already checked.
1553+ $checked[$encoding]=true;
1554+ }
1555+ if ($key===false) return false; // Not yet checked.
1556+ if ($search===false) return true; // non-multibyte encoding
1557+ if (isset($excludes[$key])) return true; // This key isn't checked.
1558+ if (is_array($val)) {
1559+ array_walk($val, 'encoding_check');
1560+ } else {
1561+ preg_match($search,$val,$m);
1562+ $val2 = (string)$m[0];
1563+ if (!($val2 === (string)$val)) {
1564+ startUpError('<p>Invalid input.</p>', 'Input Error');
1565+ exit;
1566+ }
1567+ }
1568+ preg_match($search,$key,$m);
1569+ $key2 = (string)$m[0];
1570+ if (!($key2 === (string)$key)) {
1571+ startUpError('<p>Invalid input.</p>', 'Input Error');
1572+ exit;
1573+ }
1574+ return true;
1575+}
1576+
14981577 function checkVars($aVars) {
14991578 global $HTTP_GET_VARS, $HTTP_POST_VARS, $HTTP_COOKIE_VARS, $HTTP_ENV_VARS, $HTTP_POST_FILES, $HTTP_SESSION_VARS;
15001579
--- a/utf8/nucleus/documentation/history.html
+++ b/utf8/nucleus/documentation/history.html
@@ -1,10 +1,23 @@
1+<?xml version="1.0" encoding="UTF-8"?>
12 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
23 <html xmlns="http://www.w3.org/1999/xhtml" lang="ja-JP" xml:lang="ja-JP">
34 <head>
45 <!-- $Id: history.html,v 1.13 2007-05-01 06:00:28 kimitake Exp $ -->
56 <!-- $NucleusJP: history.html,v 1.12 2007/03/12 05:34:46 kimitake Exp $ -->
7+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
8+ <meta http-equiv="Content-Style-Type" content="text/css" />
9+ <meta http-equiv="Content-Script-Type" content="text/javascript" />
10+ <link rel="index" href="./index.html" />
611 <title>Nucleus - History</title>
712 <link rel="stylesheet" type="text/css" href="styles/manual.css" />
13+ <style type="text/css">
14+ strong {
15+ font-weight: bold;
16+ }
17+ em {
18+ font-style: italic;
19+ }
20+ </style>
821 </head>
922 <body>
1023
@@ -16,9 +29,45 @@
1629
1730 <ul>
1831 <li>
19- <b>Nucleus v3.3 &quot;Lithium&quot; (Beta - March 11, 2007)</b>
32+ <strong>Nucleus v3.31 SP2 (EUC-JP only) (September 26, 2008)</strong>
2033 <ul>
21- <li>FIXED: allow + in email address, see <a href="http://forum.nucleuscms.org/viewtopic.php?t=14207">here</a> (wgroleau)</li>
34+ <li>FIXED: An XSS issue</li>
35+ </ul>
36+ </li>
37+ <li>
38+ <strong>Nucleus v3.31 SP1 (February 5, 2008)</strong>
39+ <ul>
40+ <li>FIXED: An XSS issue</li>
41+ <li>CHANGED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=83">#83(JP)</a>): ブックマークレットの高さを50ピクセル追加. (kmorimatsu)</li>
42+ <li>CHANGED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=84">#84(JP)</a>): To avoid showing ticket in the URL, redirect to pluginlist, instead. (kmorimatsu)</li>
43+ <li>ADDED: add <code>createaccount.html</code> with a redirect to <code>createaccount.php</code> for backward compatibility with the old location of the form</li>
44+ <li>CHANGED: protect the 'create account form' against abuse: show the form only if needed and add FormExtra (e.g. Captcha) and ValidateForm (to validate input) events (ftruscot and kaigreve)</li>
45+ <li>FIXED: bug in upgrade script (admun)</li>
46+ <li>CHANGED: update xmlrpc client to version 2.2, this version supports PHP 5.2.x (kimitake)</li>
47+ <li>CHANGED: use require instead of include for the file inclusion (kimitake)</li>
48+ <li>CHANGED: rollback benchmark default skin (admun)</li>
49+ <li>FIXED: possible security problem in NP_Ping (admun)</li>
50+ <li>ADDED: NP_Ping sends ping for future post via JustPosted event (admun)</li>
51+ <li>ADDED: JustPosted event (admun)</li>
52+ <li>ADDED: move weblogs.com ping function into plugin (admun)</li>
53+ </ul>
54+ </li>
55+ <li>
56+ <strong>Nucleus v3.3 (May 1, 2007)</strong>
57+ <ul>
58+ <li>ADDED: add description of charset skin variable to documentation.(JP) (shizuki)</li>
59+ <li>FIXED: fix description of if/else/endif skin variables to documentation, inlcuding ifnot, elseif, and elseifnot (JP) (shizuki)</li>
60+ <li>ADDED: add description of the doIf function to the plugin documentation (JP) (shizuki)</li>
61+ <li>ADDED: NP_Ping sends ping for future post via JustPosted event (admun)</li>
62+ <li>ADDED: JustPosted event (admun)</li>
63+ <li>ADDED: move weblogs.com ping function into plugin (admun)</li>
64+ <li>ADDED: Serveral changes and fixes from Nucleus Japan (details in the log files of the <a href="http://sourceforge.net/svn/?group_id=66479">Nucleus repository</a> at sourceforge.net)</li>
65+ <li>ADDED: Sanitize parameters such as $_GET and $_SERVER['REQUEST_URI'] etc. to avoid XSS (from Nucleus Japan)</li>
66+ <li>ADDED: (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=45">#45</a> from the Japanese Tracker): include code from NP_0TicketForPlugin in the core (Changes from Nucleus Japan)</li>
67+ <li>ADDED: new events for Media upload: PreMediaUpload and PostMediaUpload (kaigreve)</li>
68+ <li>ADDED: new skinvar bloglist (kaigreve)</li>
69+ <li>ADDED: new method for URL rewriting with the global variable virtualpath, new .htaccess file can be found in the folder extra/fancyurl-2, more information <a href="http://forum.nucleuscms.org/viewtopic.php?t=12241">forum(Another approach to Fancy URLs)</a> (kaigreve and Legolas)</li>
70+ <li>FIXED: allow + in email address, see <a href="http://forum.nucleuscms.org/viewtopic.php?t=14207">forum(Minor bug fix in globalfunctions.php)</a> (wgroleau)</li>
2271 <li>FIXED: XHTML compliance in default skin (admun)</li>
2372 <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?id=80&amp;do=details">#80</a>): Atom 1.0 support (rakaz)</li>
2473 <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?id=129&amp;do=details">#129</a>): Plugin API: SpamCheck event called from core. (rakaz)</li>
@@ -44,36 +93,36 @@
4493 <li>ADDED: (bug 817364): delete member enhancement (admun)</li>
4594 <li>ADDED: Auto save draft (Legolas)</li>
4695 <li>ADDED: Custom skin parts (tutorio)</li>
47- <li>CHANGED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=39">#39(JP)</a>): reverted content type for admin area (Kimitake)</li>
48- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=40">#40(JP)</a>): fixed PostAddCategory event (Kimitake)</li>
49- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=41">#41(JP)</a>): fixed dropped info during backing up (Katsumi)</li>
50- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=42">#42(JP)</a>): atom feed template specifies xml:lang but it is en-us, it should be ja, in install.sql (Kimitake)</li>
51- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=45">#45(JP)</a>: added NP_0TicketForPlugin security patch (Katsumi)</li>
52- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=46">#46(JP)</a>: fixed date format for draft entry (Kimitake)</li>
53- <li>CHANGED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=48">#48(JP)</a>: Super-admin always can login to admin page (Kimitake)</li>
54- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=49">#49(JP)</a>: PLUGIN::getAllItemOptions does not work correctly. (NKJG)</li>
55- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=56">#56(JP)</a>: When creating db backup, the key length drops (Katsumi)</li>
56- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=57">#57(JP)</a>: SQL error happens when updating plugin option. (Katsumi)</li>
57- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=60">#60(JP)</a>: Item link in notification email is wrong. (Shizuki)</li>
58- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=62">#62(JP)</a>: email address is not referred in &lt;%usermail%&gt;. (Shizuki)</li>
59- <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=66">#66(JP)</a>: Even if calling PostPluginOptionsUpdate, getOption does not returns correct value. (Katsumi)</li>
60- <li>ADDED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&id=68">#68(JP)</a>: Encrypted cookie key. (Katsumi)</li>
96+ <li>CHANGED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=39">#39(JP)</a>): reverted content type for admin area (Kimitake)</li>
97+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=40">#40(JP)</a>): fixed PostAddCategory event (Kimitake)</li>
98+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=41">#41(JP)</a>): fixed dropped info during backing up (Katsumi)</li>
99+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=42">#42(JP)</a>): atom feed template specifies xml:lang but it is en-us, it should be ja, in install.sql (Kimitake)</li>
100+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=45">#45(JP)</a>: added NP_0TicketForPlugin security patch (Katsumi)</li>
101+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=46">#46(JP)</a>: fixed date format for draft entry (Kimitake)</li>
102+ <li>CHANGED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=48">#48(JP)</a>: Super-admin always can login to admin page (Kimitake)</li>
103+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=49">#49(JP)</a>: PLUGIN::getAllItemOptions does not work correctly. (NKJG)</li>
104+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=56">#56(JP)</a>: When creating db backup, the key length drops (Katsumi)</li>
105+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=57">#57(JP)</a>: SQL error happens when updating plugin option. (Katsumi)</li>
106+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=60">#60(JP)</a>: Item link in notification email is wrong. (Shizuki)</li>
107+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=62">#62(JP)</a>: email address is not referred in &lt;%usermail%&gt;. (Shizuki)</li>
108+ <li>FIXED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=66">#66(JP)</a>: Even if calling PostPluginOptionsUpdate, getOption does not returns correct value. (Katsumi)</li>
109+ <li>ADDED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=68">#68(JP)</a>: Encrypted cookie key. (Katsumi)</li>
61110 </ul>
62111 </li>
63112 <li>
64- <b>Nucleus v3.24 (November 11, 2006)</b>
113+ <strong>Nucleus v3.24 (November 11, 2006)</strong>
65114 <ul>
66115 <li>FIXED: XSS issue (reported by <a href="http://www.jpcert.or.jp/">JPCERT/CC</a>).</li>
67116 </ul>
68117 </li>
69118 <li>
70- <b>Nucleus v3.23 (May 23, 2006)</b>
119+ <strong>Nucleus v3.23 (May 23, 2006)</strong>
71120 <ul>
72121 <li>FIXED: Remote code execution vulnerability (reported by rgod).</li>
73122 </ul>
74123 </li>
75124 <li>
76- <b>Nucleus v3.22 (August 21, 2005)</b>
125+ <strong>Nucleus v3.22 (August 21, 2005)</strong>
77126 <ul>
78127 <li>FIXED: Major security vulnerability in the phpxmlrpc library.</li>
79128 <li>FIXED: New NP_SkinFiles version, fixing a minor security issue. (rakaz)</li>
@@ -85,7 +134,7 @@
85134 <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?do=details&amp;id=49">#49</a>): 'name clashes' warning on skin import no longer displayed when no clashes detected (karma)</li>
86135 <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?do=details&amp;id=67">#67</a>): Add resilency to upgrade scripts (Frankenstein)</li>
87136 <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?do=details&amp;id=88">#88</a>): PHP5.1: "Fatal error: Only variables can be passed by reference" (karma)</li>
88- <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?do=details&amp;id=87">#87</a>): Translate &amp; -> &amp;amp; when links added via toolbar (karma)</li>
137+ <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?do=details&amp;id=87">#87</a>): Translate &amp; -&gt; &amp;amp; when links added via toolbar (karma)</li>
89138 <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?do=details&amp;id=42">#42</a>): <code>formatDate</code> didn't always use the correct timezone (karma)</li>
90139 <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?do=details&amp;id=43">#43</a>): Only load user language file when logged in (karma).</li>
91140 <li>FIXED (<a href="http://dev.nucleuscms.org/tracker/index.php?do=details&amp;id=76">#76</a>): Disabling site blocked admin menu access (karma).</li>
@@ -106,13 +155,13 @@
106155 </ul>
107156 </li>
108157 <li>
109- <b>Nucleus v3.21 (June 30, 2005)</b>
158+ <strong>Nucleus v3.21 (June 30, 2005)</strong>
110159 <ul>
111160 <li>FIXED: <a href="http://secunia.com/advisories/15852/">XML-RPC for PHP Unspecified PHP Code Execution Vulnerability</a></li>
112161 </ul>
113162 </li>
114163 <li>
115- <b>Nucleus v3.2 (March 7, 2005)</b>
164+ <strong>Nucleus v3.2 (March 7, 2005)</strong>
116165 <ul>
117166 <li>ADDED: <a href="http://wiki.gednet.com/NPSkinFiles">NP_SkinFiles</a> plugin installed on full install</li>
118167 <li>FIXED: Installing plugins through install.php failed (karma)</li>
@@ -148,7 +197,7 @@
148197 </ul>
149198 </li>
150199 <li>
151- <b>Nucleus v3.15 (November 14, 2004)</b>
200+ <strong>Nucleus v3.15 (November 14, 2004)</strong>
152201 <ul>
153202 <li>FIXED: Some XSS issues, as reported by Alexander Antipov</li>
154203 <li>FIXED: Validate data that is sent as HTTP headers (redirects etc) (karma)</li>
@@ -175,7 +224,7 @@
175224 </ul>
176225 </li>
177226 <li>
178- <b>Nucleus v3.1 (July 28, 2004)</b>
227+ <strong>Nucleus v3.1 (July 28, 2004)</strong>
179228 <ul>
180229 <li>FIXED: Nucleus v3.01 was missing a fix in <code>backup.php</code>, which could cause fulltext key info not to be backed up correctly</li>
181230 <li>ADDED: support for patch levels, so plugin API enhancements can be distributed to power users earlier (<a href="http://forum.nucleuscms.org/viewtopic.php?t=4142" title="More info...">suggested</a> by TeRanEX)</li>
@@ -197,7 +246,7 @@
197246 </ul>
198247 </li>
199248 <li>
200- <b>Nucleus v3.01 (July 13, 2004)</b>
249+ <strong>Nucleus v3.01 (July 13, 2004)</strong>
201250 <ul>
202251 <li>FIXED: PHP5: Links to plugin admin area broken (radekradek)</li>
203252 <li>FIXED: bug 966011, skins created with v2.0 could not be imported (karma)</li>
@@ -205,7 +254,7 @@
205254 </ul>
206255 </li>
207256 <li>
208- <b>Nucleus v3.0 (May 30, 2004)</b>
257+ <strong>Nucleus v3.0 (May 30, 2004)</strong>
209258 <ul>
210259 <li>FIXED: When adding a weblog, select globally defined default skin by default (TeRanEX)</li>
211260 <li>FIXED: CSS conflict in default skin (moraes)</li>
@@ -235,7 +284,7 @@
235284 </ul>
236285 </li>
237286 <li>
238- <b>Nucleus v3.0 RC (April 27, 2004)</b>
287+ <strong>Nucleus v3.0 RC (April 27, 2004)</strong>
239288 <ul>
240289 <li>CHANGED: Labeled it v3.0, since users started believing "2.5 beta == 25 final"</li>
241290 <li>FIXED: XML-RPC: <code>metaWeblog.editPost</code> assigned the default category again when no categories were passed along (karma).</li>
@@ -281,7 +330,7 @@
281330 </ul>
282331 </li>
283332 <li>
284- <b>Nucleus v2.5 beta (October 11, 2003)</b>
333+ <strong>Nucleus v2.5 beta (October 11, 2003)</strong>
285334 <ul>
286335 <li>ADDED: <code>if(previtem)</code>, <code>if(nextitem)</code> and <code>if(skintype,<em>typename</em>)</code> skinvars.</li>
287336 <li>FIXED: RSS conditional GET wasn't working correctly (Visa Kopu)</li>
@@ -330,7 +379,7 @@
330379 </ul>
331380 </li>
332381 <li>
333- <b>Nucleus v2.0 Final (April 3, 2003)</b>
382+ <strong>Nucleus v2.0 Final (April 3, 2003)</strong>
334383 <ul>
335384 <li>FIXED: renamed the <code>xmlrpc_encode</code> and <code>xmlrpc_decode</code> methods in <code>xmlrpc.inc.php</code>, avoiding naming conflicts on some PHP configurations that are compiled with XMLRPC support</li>
336385 <li>FIXED: restore did not work on some PHP configurations, and did not correctly recognize <code>application/x-gzip</code> encoding type</li>
@@ -360,7 +409,7 @@
360409 </ul>
361410 </li>
362411 <li>
363- <b>Nucleus v2.0 beta (January 18, 2003)</b>
412+ <strong>Nucleus v2.0 beta (January 18, 2003)</strong>
364413 <ul>
365414 <li>FIXED: Highlighted text no longer has &lt;!--h--&gt; in it</li>
366415 <li>ADDED; Plugin hook: PostAuthentication</li>
@@ -429,7 +478,7 @@
429478 </ul>
430479 </li>
431480 <li>
432- <b>Nucleus v1.55 (August 26, 2002)</b>
481+ <strong>Nucleus v1.55 (August 26, 2002)</strong>
433482 <ul>
434483 <li>ADDED: &lt;%archivedaylist%&gt; and &lt;%otherarchivedaylist%&gt; skinvars (to show archives by day instead of by month)</li>
435484 <li>FIXED: PHP error on createAccount through action.php</li>
@@ -460,11 +509,11 @@
460509 </ul>
461510 </li>
462511 <li>
463- <b>Nucleus v1.5 (August 13, 2002)</b>
512+ <strong>Nucleus v1.5 (August 13, 2002)</strong>
464513 <ul>
465514 <li>ADDED: Introducing plugins (define your own skinvars and templatevars, add event listeners, ...)</li>
466515 <li>CHANGED: simpler and more accessible default templates/skins</li>
467- <li>FIXED: GreyMatter convert now works when the <tt>asp_tags</tt> option in PHP is enabled</li>
516+ <li>FIXED: GreyMatter convert now works when the <code>asp_tags</code> option in PHP is enabled</li>
468517 <li>ADDED: title and authorName fields in Blogger API getRecentItems call</li>
469518 <li>ADDED: HTML label tags for radio buttons and checkboxes (this way you can click anywhere on the text instead of only on the radio button/checkbox itself)</li>
470519 <li>FIXED: deleting a comment you made in a blog that's not your own resulted in a 'disallowed action' error (thanks moraes)</li>
@@ -486,7 +535,7 @@
486535 <li>ADDED: PHP and MySQL versions are listed during the installation proces, with warnings when those version numbers are lower than what Nucleus requires</li>
487536 <li>CHANGED: item parsing method changed, so it's more easily extensible. plugin, parsedinclude, include and phpinclude are now also allowed in some templates. Inside items, there are also 3 allowed variables: 'image', 'media' and 'popup'</li>
488537 <li>FIXED: image popups didn't work with register_globals disabled</li>
489- <li>CHANGED: renamed method: getBlogidFromName -> getBlogIDFromName (consistency)</li>
538+ <li>CHANGED: renamed method: getBlogidFromName -&gt; getBlogIDFromName (consistency)</li>
490539 <li>ADDED: method selectCategory($name)</li>
491540 <li>FIXED: Nucleus now handles data correctly when magic_quotes_gpc is disabled (solves some problems with template editing)</li>
492541 <li>CHANGED: categories in selection box are now sorted by name (tip from katatonik)</li>
@@ -505,7 +554,7 @@
505554 <li>ADDED: left and right box buttons on JS toolbar</li>
506555 <li>FIXED: truncated entry when login is requested after adding (data didn't get passed on correctly)</li>
507556 <li>ADDED: &lt;%authorlink%&gt; to template vars for item templates (this one can take catid into account)</li>
508- <li>ADDED: $CONF['Self'] => $CONF['ItemURL'], $CONF['IndexURL'], ... to optionally allow people to use different files for items/archives/...</li>
557+ <li>ADDED: $CONF['Self'] =&gt; $CONF['ItemURL'], $CONF['IndexURL'], ... to optionally allow people to use different files for items/archives/...</li>
509558 <li>CHANGED: Now using mysql_fetch_assoc instead of mysql_fetch_array (efficiency)</li>
510559 <li>CHANGED: The &lt;%searchresults%&gt; and &lt;%othersearchresults%&gt; skintags got an extra parameter to limit the number of results (defaults to 50)</li>
511560 <li>FIXED: doError did not take into account chosen skin</li>
@@ -525,7 +574,7 @@
525574 </ul>
526575 </li>
527576 <li>
528- <b>Nucleus v1.1 (April 30, 2002)</b>
577+ <strong>Nucleus v1.1 (April 30, 2002)</strong>
529578 <ul>
530579 <li>Started assuming that at least PHP 4.0.5 is available. (for older PHP versions, some small code-changes should do the trick)</li>
531580 <li>Added bookmarklets for Mac/IE5 users and Mozilla. Also, made the title of the page also show up in the title field of the new item. Makes more sense. <small>(thanks to <a href="http://www.35mm.org">Ricardo Lamego</a>)</small></li>
@@ -616,7 +665,7 @@
616665 </ul>
617666 </li>
618667 <li>
619- <b>Nucleus v1.0 (March 6, 2002)</b>
668+ <strong>Nucleus v1.0 (March 6, 2002)</strong>
620669 <ul>
621670 <li>Fixed: width &amp; height of &lt;%image()%&gt; construct</li>
622671 <li>Changed: windows in popup windows don't have a white border anymore <small>(<a href="http://www.nucleuscms.org/forum/viewtopic.php?t=3">see forum</a>)</small>
@@ -654,7 +703,7 @@
654703 </ul>
655704 </li>
656705 <li>
657- <b>Nucleus v0.96 (December 13, 2001)</b>
706+ <strong>Nucleus v0.96 (December 13, 2001)</strong>
658707 <ul>
659708 <li>Added: add-item-preview now also in admin area</li>
660709 <li>Added: action log</li>
@@ -681,7 +730,7 @@
681730 </ul>
682731 </li>
683732 <li>
684- <b>Nucleus v0.95 (October 10, 2001)</b>
733+ <strong>Nucleus v0.95 (October 10, 2001)</strong>
685734 <ul>
686735 <li>Added: per-blog setting to enable/disable line break conversion</li>
687736 <li>Added: per-blog setting to send a ping to Userland (weblogs.com) when you update your blog. This way, you'll be able to end up in the weblogs.com update-list</li>
@@ -692,10 +741,10 @@
692741 </ul>
693742 </li>
694743 <li>
695- <b>Nucleus v0.94 (September 27, 2001)</b>
744+ <strong>Nucleus v0.94 (September 27, 2001)</strong>
696745 <ul>
697746 <li>Changed: 'Add Item' in admin-area now redirects to blog url (if available)</li>
698- <li>Changed: <i>headlines.php</i> and <i>xml-rss.php</i> adapted to behave better in disabled-site situations</li>
747+ <li>Changed: <em>headlines.php</em> and <em>xml-rss.php</em> adapted to behave better in disabled-site situations</li>
699748 <li>Changed: &lt;%userlink%&gt; got smarter in recognizing e-mail addresses</li>
700749 <li>Added: tabindices in forms to make traversal with the TAB-button more natural</li>
701750 <li>Fixed: bookmarklet login did not pass data correctly</li>
@@ -709,7 +758,7 @@
709758 </ul>
710759 </li>
711760 <li>
712- <b>Nucleus v0.93 (September 19, 2001)</b>
761+ <strong>Nucleus v0.93 (September 19, 2001)</strong>
713762 <ul>
714763 <li>Added: friendly error message on error with nucleusdir definition in config.php</li>
715764 <li>Changed: call_user_func instead of eval</li>
@@ -724,7 +773,7 @@
724773 </ul>
725774 </li>
726775 <li>
727- <b>Nucleus v0.92 (September 18, 2001)</b>
776+ <strong>Nucleus v0.92 (September 18, 2001)</strong>
728777 <ul>
729778 <li>GM conversion: {{linkmo and {{emailmo conversion now also works with PHP versions &lt; 4.0.4</li>
730779 <li>GM conversion: Fixed occasional JavaScript errors with {{linkmo and {{emailmo</li>
@@ -741,13 +790,13 @@
741790 </ul>
742791 </li>
743792 <li>
744- <b>Nucleus v0.91 (September 15, 2001)</b>
793+ <strong>Nucleus v0.91 (September 15, 2001)</strong>
745794 <ul>
746795 <li>Improved conversion for GreyMatter blogs. Special markup commands are now recognized. (thanks to <a href="http://www.elrado.nl/">Raoul</a> for pointing this out)</li>
747796 </ul>
748797 </li>
749798 <li>
750- <b>Nucleus v0.90 [beta 2 release] (September 14, 2001)</b>
799+ <strong>Nucleus v0.90 [beta 2 release] (September 14, 2001)</strong>
751800 <ul>
752801 <li>an install-script is now available, no more messing around in shells</li>
753802 <li>created default skins/templates for a release version</li>
@@ -770,7 +819,7 @@
770819 </ul>
771820 </li>
772821 <li>
773- <b>Nucleus v0.80 [beta 1 release] (September 2, 2001)</b>
822+ <strong>Nucleus v0.80 [beta 1 release] (September 2, 2001)</strong>
774823 <ul>
775824 <li>XML-RPC Interface implementing the blogger methods</li>
776825 <li>fixes and code-reorganisation</li>
@@ -780,7 +829,7 @@
780829 </ul>
781830 </li>
782831 <li>
783- <b>Nucleus v0.70 [not released] (August 20, 2001)</b>
832+ <strong>Nucleus v0.70 [not released] (August 20, 2001)</strong>
784833 <ul>
785834 <li>mySQL instead of XML</li>
786835 <li>extensive admin area</li>
@@ -793,7 +842,7 @@
793842 </ul>
794843 </li>
795844 <li>
796- <b>Nucleus v0.60 and earlier (since February 2001)</b>
845+ <strong>Nucleus v0.60 and earlier (since February 2001)</strong>
797846 <br />
798847 no history (XML versions with limited functions)
799848 </li>
--- a/utf8/nucleus/libs/globalfunctions.php
+++ b/utf8/nucleus/libs/globalfunctions.php
@@ -307,6 +307,13 @@ if (!headers_sent() ) {
307307 $language = getLanguageName();
308308 include($DIR_LANG . ereg_replace( '[\\|/]', '', $language) . '.php');
309309
310+// check if valid charset
311+if (!encoding_check(false,false,_CHARSET)) {
312+ foreach(array($_REQUEST, $_SERVER) as $input) {
313+ array_walk($input, 'encoding_check');
314+ }
315+}
316+
310317 /*
311318 Backed out for now: See http://forum.nucleuscms.org/viewtopic.php?t=3684 for details
312319
@@ -551,6 +558,13 @@ function sendContentType($contenttype, $pagetype = '', $charset = _CHARSET) {
551558 } else {
552559 header('Content-Type: ' . $contenttype);
553560 }
561+
562+ // check if valid charset
563+ if (!encoding_check(false,false,$charset)) {
564+ foreach(array($_REQUEST, $_SERVER) as $input) {
565+ array_walk($input, 'encoding_check');
566+ }
567+ }
554568 }
555569 }
556570
@@ -558,9 +572,11 @@ function sendContentType($contenttype, $pagetype = '', $charset = _CHARSET) {
558572 * Errors before the database connection has been made
559573 */
560574 function startUpError($msg, $title) {
575+ if (!defined('_CHARSET')) define('_CHARSET','iso-8859-1');
576+ header('Content-Type: text/html; charset=' . _CHARSET);
561577 ?>
562578 <html xmlns="http://www.w3.org/1999/xhtml">
563- <head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
579+ <head><meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET?>" />
564580 <title><?php echo htmlspecialchars($title)?></title></head>
565581 <body>
566582 <h1><?php echo htmlspecialchars($title)?></h1>
@@ -1495,6 +1511,69 @@ function formatDate($format, $timestamp, $defaultFormat, &$blog) {
14951511 }
14961512 }
14971513
1514+function encoding_check($val, $key, $encoding=false, $exclude=false) {
1515+ /*
1516+ When 3rd argument is set, return if checked already.
1517+ When 4th argument is set, set the excluded key(s).
1518+ */
1519+ static $search=false, $checked=array(), $excludes=array();
1520+ if ($exclude!==false) {
1521+ if (is_array($exclude)) {
1522+ foreach($exclude as $v) $excludes[$v]=true;
1523+ } else $excludes[$excludes]=true;
1524+ return;
1525+ }
1526+ if ($encoding!==false) {
1527+ switch($encoding=strtolower($encoding)){
1528+ case 'utf-8':
1529+ $search='/^([\x00-\x7F]+'.
1530+ '|[\xC2-\xDF][\x80-\xBF]'.
1531+ '|[\xE0-\xEF][\x80-\xBF][\x80-\xBF]'.
1532+ '|[\xF0-\xF7][\x80-\xBF][\x80-\xBF][\x80-\xBF]'.
1533+ '|[\xF8-\xFB][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF]'.
1534+ '|[\xFC-\xFD][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF])*/';
1535+ break;
1536+ case 'euc-jp':
1537+ $search='/^([\x00-\x7F]+'.
1538+ '|[\x8E][\xA0-\xDF]'.
1539+ '|[\x8F]?[\xA1-\xFE][\xA1-\xFE])*/';
1540+ break;
1541+ case 'gb2312':
1542+ $search='/^([\x00-\x7F]+'.
1543+ '|[\xA1-\xF7][\xA1-\xFE])*/';
1544+ break;
1545+ default:
1546+ $search=false;
1547+ if (preg_match('/^iso\-8859\-[0-9]{1,2}$/',$encoding)) break;
1548+ if (preg_match('/^windows\-125[0-8]$/',$encoding)) break;
1549+ startUpError('<p>Unknown or non-supported encoding.</p>', 'Encoding Error');
1550+ exit;
1551+ }
1552+ if (isset($checked[$encoding])) return true; // Already checked.
1553+ $checked[$encoding]=true;
1554+ }
1555+ if ($key===false) return false; // Not yet checked.
1556+ if ($search===false) return true; // non-multibyte encoding
1557+ if (isset($excludes[$key])) return true; // This key isn't checked.
1558+ if (is_array($val)) {
1559+ array_walk($val, 'encoding_check');
1560+ } else {
1561+ preg_match($search,$val,$m);
1562+ $val2 = (string)$m[0];
1563+ if (!($val2 === (string)$val)) {
1564+ startUpError('<p>Invalid input.</p>', 'Input Error');
1565+ exit;
1566+ }
1567+ }
1568+ preg_match($search,$key,$m);
1569+ $key2 = (string)$m[0];
1570+ if (!($key2 === (string)$key)) {
1571+ startUpError('<p>Invalid input.</p>', 'Input Error');
1572+ exit;
1573+ }
1574+ return true;
1575+}
1576+
14981577 function checkVars($aVars) {
14991578 global $HTTP_GET_VARS, $HTTP_POST_VARS, $HTTP_COOKIE_VARS, $HTTP_ENV_VARS, $HTTP_POST_FILES, $HTTP_SESSION_VARS;
15001579
Show on old repository browser