Scrollreveal+cat+datenews

2019-01-07 11:43:39 +01:00
parent e4cac3d01e
commit 762a1ad170
3158 changed files with 140699 additions and 73915 deletions
@@ -14,6 +14,7 @@ use Grav\Common\Page\Medium\Medium;
 use Grav\Common\Page\Page;
 use Grav\Common\Page\Pages;
 use Grav\Common\Page\Collection;
+use Grav\Common\Security;
 use Grav\Common\User\User;
 use Grav\Common\Utils;
 use Grav\Common\Backup\ZipBackup;
@@ -465,7 +466,7 @@ class AdminController extends AdminBaseController
    /**
     * Handles updating Grav
     *
-     * @return bool True if the action was performed
+     * @return bool False if user has no permissions.
     */
    public function taskUpdategrav()
    {
@@ -478,14 +479,14 @@ class AdminController extends AdminBaseController
        $result  = Gpm::selfupgrade();

        if ($result) {
-            $this->admin->json_response = [
+            $json_response = [
                'status'  => 'success',
                'type'    => 'updategrav',
                'version' => $version,
                'message' => $this->admin->translate('PLUGIN_ADMIN.GRAV_WAS_SUCCESSFULLY_UPDATED_TO') . ' ' . $version
            ];
        } else {
-            $this->admin->json_response = [
+            $json_response = [
                'status'  => 'error',
                'type'    => 'updategrav',
                'version' => GRAV_VERSION,
@@ -493,7 +494,7 @@ class AdminController extends AdminBaseController
            ];
        }

-        return true;
+        return $this->sendJsonResponse($json_response);
    }

    /**
@@ -611,6 +612,8 @@ class AdminController extends AdminBaseController
        $reorder = true;
        $data    = (array)$this->data;

+        $this->grav['twig']->twig_vars['current_form_data'] = $data;
+
        // Special handler for user data.
        if ($this->view === 'user') {
            if (!$this->grav['user']->exists()) {
@@ -645,13 +648,25 @@ class AdminController extends AdminBaseController
            // Ensure route is prefixed with a forward slash.
            $route = '/' . ltrim($route, '/');

+            // Check for valid frontmatter
            if (isset($data['frontmatter']) && !$this->checkValidFrontmatter($data['frontmatter'])) {
                $this->admin->setMessage($this->admin->translate('PLUGIN_ADMIN.INVALID_FRONTMATTER_COULD_NOT_SAVE'),
                    'error');
-
                return false;
            }

+            // XSS Checks for page content
+            $xss_whitelist = $this->grav['config']->get('security.xss_whitelist', 'admin.super');
+            if (!$this->admin->authorize($xss_whitelist)) {
+                $check_what = ['header' => isset($data['header']) ? $data['header'] : '', 'frontmatter' => isset($data['frontmatter']) ? $data['frontmatter'] : '', 'content' => isset($data['content']) ? $data['content'] : ''];
+                $results = Security::detectXssFromArray($check_what);
+                if (!empty($results)) {
+                    $this->admin->setMessage('<i class="fa fa-ban"></i> ' . $this->admin->translate('PLUGIN_ADMIN.XSS_ONSAVE_ISSUE'),
+                        'error');
+                    return false;
+                }
+            }
+

            $parent = $route && $route !== '/' && $route !== '.' && $route !== '/.' ? $pages->dispatch($route, true) : $pages->root();
            $original_order = (int)trim($obj->order(), '.');
@@ -908,11 +923,13 @@ class AdminController extends AdminBaseController
            } catch (\Exception $e) {
                $this->admin->json_response = ['status' => 'error', 'message' => $e->getMessage()];

-                return;
+                return false;
            }
        }

        $this->admin->json_response = ['status' => 'success', 'feed_data' => $feed_data];
+
+        return true;
    }

    /**
@@ -956,12 +973,17 @@ class AdminController extends AdminBaseController
                ];
            } else {
                $this->admin->json_response = ['status' => 'error', 'message' => 'Cannot connect to the GPM'];
+
+                return false;
            }

        } catch (\Exception $e) {
            $this->admin->json_response = ['status' => 'error', 'message' => $e->getMessage()];
+
+            return false;
        }

+        return true;
    }

    /**
@@ -979,7 +1001,7 @@ class AdminController extends AdminBaseController
            //No notifications cache (first time)
            $this->admin->json_response = ['status' => 'success', 'notifications' => [], 'need_update' => true];

-            return;
+            return true;
        }

        $need_update = false;
@@ -996,7 +1018,7 @@ class AdminController extends AdminBaseController
        } catch (\Exception $e) {
            $this->admin->json_response = ['status' => 'error', 'message' => $e->getMessage()];

-            return;
+            return false;
        }

        $this->admin->json_response = [
@@ -1004,6 +1026,8 @@ class AdminController extends AdminBaseController
            'notifications' => $notifications,
            'need_update'   => $need_update
        ];
+
+        return true;
    }

    /**
@@ -1166,8 +1190,8 @@ class AdminController extends AdminBaseController
                'status'  => 'error',
                'message' => $this->admin->translate('PLUGIN_ADMIN.INSUFFICIENT_PERMISSIONS_FOR_TASK')
            ];
-            echo json_encode($json_response);
-            exit;
+
+            return $this->sendJsonResponse($json_response, 403);
        }

        //check if there are packages that have this as a dependency. Abort and show which ones
@@ -1182,8 +1206,8 @@ class AdminController extends AdminBaseController
            }

            $json_response = ['status' => 'error', 'message' => $message];
-            echo json_encode($json_response);
-            exit;
+
+            return $this->sendJsonResponse($json_response, 200);
        }

        try {
@@ -1191,8 +1215,8 @@ class AdminController extends AdminBaseController
            $result       = Gpm::uninstall($package, []);
        } catch (\Exception $e) {
            $json_response = ['status' => 'error', 'message' => $e->getMessage()];
-            echo json_encode($json_response);
-            exit;
+
+            return $this->sendJsonResponse($json_response, 200);
        }

        if ($result) {
@@ -1201,16 +1225,16 @@ class AdminController extends AdminBaseController
                'dependencies' => $dependencies,
                'message'      => $this->admin->translate(is_string($result) ? $result : 'PLUGIN_ADMIN.UNINSTALL_SUCCESSFUL')
            ];
-            echo json_encode($json_response);
-            exit;
+
+            return $this->sendJsonResponse($json_response, 200);
        }

        $json_response = [
            'status'  => 'error',
            'message' => $this->admin->translate('PLUGIN_ADMIN.UNINSTALL_FAILED')
        ];
-        echo json_encode($json_response);
-        exit;
+
+        return $this->sendJsonResponse($json_response, 200);
    }

    /**
@@ -1230,8 +1254,8 @@ class AdminController extends AdminBaseController
                'status'  => 'error',
                'message' => $this->admin->translate('PLUGIN_ADMIN.INSUFFICIENT_PERMISSIONS_FOR_TASK')
            ];
-            echo json_encode($json_response);
-            exit;
+
+            $this->sendJsonResponse($json_response, 403);
        }

        $url = "https://getgrav.org/download/{$type}s/$slug/$current_version";
@@ -1363,7 +1387,7 @@ class AdminController extends AdminBaseController
        }

        $download = urlencode(base64_encode($backup));
-        $url      = rtrim($this->grav['uri']->rootUrl(true), '/') . '/' . trim($this->admin->base,
+        $url      = rtrim($this->grav['uri']->rootUrl(false), '/') . '/' . trim($this->admin->base,
                '/') . '/task' . $param_sep . 'backup/download' . $param_sep . $download . '/admin-nonce' . $param_sep . Utils::getNonce('admin-form');

        $log->content([
@@ -1670,6 +1694,19 @@ class AdminController extends AdminBaseController
                return false;
        }

+        $filename = $_FILES['file']['name'];
+
+        // Handle bad filenames.
+        if (!Utils::checkFilename($filename)) {
+            $this->admin->json_response = [
+                'status'  => 'error',
+                'message' => sprintf($this->admin->translate('PLUGIN_ADMIN.FILEUPLOAD_UNABLE_TO_UPLOAD'),
+                    $filename, 'Bad filename')
+            ];
+
+            return false;
+        }
+
        $grav_limit = $config->get('system.media.upload_limit', 0);
        // You should also check filesize here.
        if ($grav_limit > 0 && $_FILES['file']['size'] > $grav_limit) {
@@ -1683,18 +1720,13 @@ class AdminController extends AdminBaseController


        // Check extension
-        $fileParts = pathinfo($_FILES['file']['name']);
-
-        $fileExt = '';
-        if (isset($fileParts['extension'])) {
-            $fileExt = strtolower($fileParts['extension']);
-        }
+        $extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION));

        // If not a supported type, return
-        if (!$fileExt || !$config->get("media.types.{$fileExt}")) {
+        if (!$extension || !$config->get("media.types.{$extension}")) {
            $this->admin->json_response = [
                'status'  => 'error',
-                'message' => $this->admin->translate('PLUGIN_ADMIN.UNSUPPORTED_FILE_TYPE') . ': ' . $fileExt
+                'message' => $this->admin->translate('PLUGIN_ADMIN.UNSUPPORTED_FILE_TYPE') . ': ' . $extension
            ];

            return false;
@@ -1720,7 +1752,7 @@ class AdminController extends AdminBaseController

        // Upload it
        if (!move_uploaded_file($_FILES['file']['tmp_name'],
-            sprintf('%s/%s', $path, $_FILES['file']['name']))
+            sprintf('%s/%s', $path, $filename))
        ) {
            $this->admin->json_response = [
                'status'  => 'error',
@@ -1732,13 +1764,12 @@ class AdminController extends AdminBaseController

        // Add metadata if needed
        $include_metadata = Grav::instance()['config']->get('system.media.auto_metadata_exif', false);
-        $filename = $fileParts['basename'];
-        $filename = str_replace(['@3x', '@2x'], '', $filename);
+        $basename = str_replace(['@3x', '@2x'], '', pathinfo($filename, PATHINFO_BASENAME));

        $metadata = [];

-        if ($include_metadata && isset($media[$filename])) {
-            $img_metadata = $media[$filename]->metadata();
+        if ($include_metadata && isset($media[$basename])) {
+            $img_metadata = $media[$basename]->metadata();
            if ($img_metadata) {
                $metadata = $img_metadata;
            }
@@ -1781,6 +1812,11 @@ class AdminController extends AdminBaseController

        $filename = !empty($this->post['filename']) ? $this->post['filename'] : null;

+        // Handle bad filenames.
+        if (!Utils::checkFilename($filename)) {
+            $filename = null;
+        }
+
        if (!$filename) {
            $this->admin->json_response = [
                'status'  => 'error',
@@ -1869,7 +1905,7 @@ class AdminController extends AdminBaseController
    protected function taskProcessMarkdown()
    {
        if (!$this->authorizeTask('process markdown', ['admin.pages', 'admin.super'])) {
-            return;
+            return false;
        }

        try {
@@ -2224,6 +2260,8 @@ class AdminController extends AdminBaseController

        $admin_route = $this->admin->base;
        $this->setRedirect('/' . $language . $admin_route . '/' . $redirect);
+
+        return true;
    }

    /**
@@ -2259,6 +2297,16 @@ class AdminController extends AdminBaseController
            }

            $file_path = $_FILES['uploaded_file']['tmp_name'];
+
+            // Handle bad filenames.
+            if (!Utils::checkFilename(basename($file_path))) {
+                $this->admin->json_response = [
+                    'status'  => 'error',
+                    'message' => $this->admin->translate('PLUGIN_ADMIN.UNKNOWN_ERRORS')
+                ];
+
+                return false;
+            }
        }


@@ -2313,9 +2361,10 @@ class AdminController extends AdminBaseController
            $aPage->template($obj->template());
            $aPage->validate();
            $aPage->filter();
-            $aPage->save();

-            $this->grav->fireEvent('onAdminAfterSave', new Event(['page' => $obj]));
+            $this->grav->fireEvent('onAdminSave', new Event(['page' => &$aPage]));
+            $aPage->save();
+            $this->grav->fireEvent('onAdminAfterSave', new Event(['page' => $aPage]));
        }

        $this->admin->setMessage($this->admin->translate('PLUGIN_ADMIN.SUCCESSFULLY_SWITCHED_LANGUAGE'), 'info');