Changeset 415

Timestamp:

Jul 1, 2013 7:45:33 PM (11 years ago)

Author:

anonymous

Message:

Disabled MX record check for email validation. Updated PEdit to work better with AcceptPathInfo? enabled.

Location:

trunk

Files:

• bin/acl.cli.php (modified) (1 diff)
• lib/PEdit.inc.php (modified) (3 diffs)
• lib/Upload.inc.php (modified) (2 diffs)
• lib/Validator.inc.php (modified) (3 diffs)

trunk/bin/acl.cli.php

@@ -118 +118 @@
         break;
     case 'perms' :
-        default :
+    default :
         listPerms();
         break;

trunk/lib/PEdit.inc.php

@@ -168 +168 @@
         
         // The location of the data file. (i.e.: "COMMON_DIR/html/_pedit_data/news/index.xml")
-        $this->_data_file = sprintf('%s%s.xml', $this->getParam('data_dir'), $_SERVER['PHP_SELF']);
+        $this->_data_file = sprintf('%s%s.xml', $this->getParam('data_dir'), $_SERVER['SCRIPT_NAME']);
+        
+        // Make certain the evaluated path matches the assumed path (realpath will expand /../../); 
+        // if realpath returns FALSE we're not concerned because it means the file doesn't exist (_initializeDataFile() will create it).
+        if (false !== realpath($this->_data_file) && $this->_data_file !== realpath($this->_data_file)) {
+            $app->logMsg(sprintf('PEdit data file not a real path: %s', $this->_data_file), LOG_CRIT, __FILE__, __LINE__);
+            trigger_error(sprintf('PEdit data file not a real path: %s', $this->_data_file), E_USER_ERROR);
+        }
 
         // op is used throughout the script to determine state.
@@ -559 +566 @@
         // Ensure requested filename is within the pedit data dir.
         if (mb_strpos($filename, $this->getParam('data_dir')) === false) {
-            $app->logMsg(sprintf('Failed writing file outside pedit _data_dir: %s', $filename), LOG_ERR, __FILE__, __LINE__);
+            $app->logMsg(sprintf('Failed writing file outside pedit data_dir: %s', $filename), LOG_ERR, __FILE__, __LINE__);
             return false;
         }
@@ -565 +572 @@
         // Recursively create directories.
         $subdirs = preg_split('!/!', str_replace($this->getParam('data_dir'), '', dirname($filename)), -1, PREG_SPLIT_NO_EMPTY);
-        // Start with the pedit _data_dir base.
+        // Start with the pedit data_dir base.
         $curr_path = $this->getParam('data_dir');
         while (!empty($subdirs)) {

trunk/lib/Upload.inc.php

@@ -279 +279 @@
             // Check to be sure the file has a valid file name extension.
             if (!in_array(mb_strtolower($this->getFilenameExtension($file_name)), $this->getParam('valid_file_extensions'))) {
+                /// TODO: Add option to allow any extention to be uploaded.
                 $this->_raiseMsg(sprintf(_("The file %s failed uploading: it is an unrecognized type. Files must have one of the following file name extensions: %s."), $file_name, join(', ', $this->getParam('valid_file_extensions'))), MSG_ERR, __FILE__, __LINE__);
                 $app->logMsg(sprintf('The uploaded file %s has an unrecognized file name extension.', $file_name), LOG_WARNING, __FILE__, __LINE__);
@@ -295 +296 @@
             // If the file name has no extension, use the mime-type to choose one.
             if (!preg_match('/\.[^.]{1,5}$/', $file_name) && function_exists('mime_content_type')) {
+                // TODO: will this run if an extention is filtered by 'valid_file_extensions'?
                 if ($ext = array_search(mime_content_type($files['tmp_name'][$i]), $this->mime_extension_map)) {
                     $file_name .= ".$ext";

trunk/lib/Validator.inc.php

@@ -40 +40 @@
 
 // validateEmail return types.
+define('VALIDATE_EMAIL_SUCCESS', 0);
 define('VALIDATE_EMAIL_REGEX_FAIL', 1);
 define('VALIDATE_EMAIL_LENGTH_FAIL', 2);
 define('VALIDATE_EMAIL_MX_FAIL', 3);
-define('VALIDATE_EMAIL_SUCCESS', 4);
 
 class Validator {
@@ -179 +179 @@
      *
      * @access  public
-     * @param   string  $val  The input data to validate..
-     * @return  bool    Validity of address.
+     * @param   string  $val    The input data to validate..
+     * @return  const           One of the constant values: VALIDATE_EMAIL_SUCCESS|VALIDATE_EMAIL_REGEX_FAIL|VALIDATE_EMAIL_LENGTH_FAIL|VALIDATE_EMAIL_MX_FAIL
      * @author  Quinn Comendant <quinn@strangecode.com>
      */
@@ -209 +209 @@
         // Compare ip2long twice for php4 backwards compat.
         if ((ip2long($domain) == '-1' || ip2long($domain) === false) && function_exists('checkdnsrr') && !checkdnsrr($domain . '.', 'MX') && gethostbyname($domain) == $domain) {
-            return VALIDATE_EMAIL_MX_FAIL;
+            // FIXME: Do we care?
+            // return VALIDATE_EMAIL_MX_FAIL;
         }