Skip to content

Commit d4e6fb5

Browse files
oliveratgithuboliveratgithub
authored
zorg Code v4.8.1-hotfix
Merge pull request #72 from zorgch/develop
2 parents 9b011a5 + 3ebee5b commit d4e6fb5

18 files changed

Lines changed: 196 additions & 209 deletions

‎www/actions/comment_edit.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454
header('Location: '.changeURL(base64url_decode($_POST['url']), $url_querystring)); // Redirect user back to where he came from
5555
exit;
5656
} else {
57-
$commentText = escape_text($_POST['text']);
57+
$commentText = htmlspecialchars_decode($_POST['text'], ENT_COMPAT | ENT_SUBSTITUTE);
5858
$_POST['text'] = $commentText; // required for passing to Comment::update() later...
5959
}
6060
if (DEVELOPMENT) error_log(sprintf('[DEBUG] <%s:%d> $_POST[text]: OK', __FILE__, __LINE__));

‎www/actions/comment_new.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
user_error('keine leeren Posts erlaubt.', E_USER_WARNING);
2626
die();
2727
} else {
28-
$commentText = escape_text($_POST['text']);
28+
$commentText = htmlspecialchars_decode($_POST['text'], ENT_COMPAT | ENT_SUBSTITUTE);
2929
}
3030

3131
if(!is_numeric($_POST['parent_id']) || $_POST['parent_id'] == '')

‎www/actions/events.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
if ( !empty($_POST['location'])) $eventLocation = sanitize_userinput($_POST['location']);
2828
if ( !empty($_POST['link'])) $eventLink = escape_text((filter_var($_POST['link'], FILTER_VALIDATE_URL)===false?(filter_var(SITE_PROTOCOL.$_POST['link'], FILTER_VALIDATE_URL)!==false?SITE_PROTOCOL.$_POST['link']:$error='Ungültiger Event-Link'):$_POST['link']));
2929
if ( !empty($_POST['review_url'])) $eventReviewlink = escape_text((filter_var($_POST['review_url'], FILTER_VALIDATE_URL)===false?(filter_var(SITE_PROTOCOL.$_POST['review_url'], FILTER_VALIDATE_URL)!==false?SITE_PROTOCOL.$_POST['review_url']:$error='Ungültige Review-URL'):$_POST['review_url']));
30-
if ( !empty($_POST['description'])) $eventDescription = sanitize_userinput($_POST['description']);
30+
if ( !empty($_POST['description'])) $eventDescription = htmlspecialchars_decode($_POST['description'], ENT_COMPAT | ENT_SUBSTITUTE);
3131
if ( isset($_POST['gallery_id']) && is_numeric($_POST['gallery_id']) && $_POST['gallery_id'] >= 0) $eventGallery = $_POST['gallery_id'];
3232
if ( isset($_GET['join']) && is_numeric($_GET['join']) && $_GET['join'] >= 0) $eventJoinId = $_GET['join'];
3333
if ( isset($_GET['unjoin']) && is_numeric($_GET['unjoin']) && $_GET['unjoin'] >= 0) $eventUnjoinId = $_GET['unjoin'];

‎www/includes/activities.inc.php‎

Lines changed: 94 additions & 116 deletions
Large diffs are not rendered by default.

‎www/includes/config.inc.php‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -354,8 +354,11 @@
354354
if (!defined('ERRORLOG_FILETYPE')) define('ERRORLOG_FILETYPE', (isset($_ENV['ERRORLOG_FILETYPE']) ? $_ENV['ERRORLOG_FILETYPE'] : '.log'));
355355
if (!defined('ERRORLOG_DIR')) define('ERRORLOG_DIR', (isset($_ENV['ERRORLOG_DIR']) ? $_ENV['ERRORLOG_DIR'] : null));
356356
if (!defined('ERRORLOG_FILE')) define('ERRORLOG_FILE', ERRORLOG_DIR.date('Y-m-d').ERRORLOG_FILETYPE);
357-
if (!defined('ERRORLOG_LEVELS')) define('ERRORLOG_LEVELS', (isset($_ENV['ERROR_REPORTING_LEVELS']) ? $_ENV['ERROR_REPORTING_LEVELS'] : null));
358-
if (!defined('ERRORLOG_DEBUG_SCOPE')) define('ERRORLOG_DEBUG_SCOPE', (isset($_ENV['DEBUG_SCOPE']) ? $_ENV['DEBUG_SCOPE'] : null));
357+
if (!defined('ERRORLOG_LEVELS')) define('ERRORLOG_LEVELS', (isset($_ENV['ERROR_REPORTING_LEVELS']) ? $_ENV['ERROR_REPORTING_LEVELS'] : E_ERROR));
358+
if (!defined('ERRORLOG_DEBUG_SCOPE')) {
359+
define('ERRORLOG_DEBUG_SCOPE', isset($_ENV['DEBUG_SCOPE']) ? explode(',', $_ENV['DEBUG_SCOPE']) : []);
360+
}
361+
error_reporting(ERRORLOG_LEVELS);
359362
require_once INCLUDES_DIR.'errlog.inc.php';
360363
//set_error_handler('zorgErrorHandler');
361364

‎www/includes/errlog.inc.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@
2020
if (!defined('ERROR')) define('ERROR', E_USER_WARNING);
2121
if (!defined('WARNING')) define('WARNING', E_USER_NOTICE);
2222

23-
error_reporting(ERRORLOG_LEVELS);
2423
//error_reporting(FATAL | ERROR | WARNING);
2524
//set_error_handler('zorgErrorHandler');
2625

@@ -94,6 +93,8 @@ class zorgDebugger
9493
public function __construct()
9594
{
9695
$this->isDevelopmentEnvironment = defined('DEVELOPMENT') && DEVELOPMENT;
96+
$this->debug('%s', [$this->isDevelopmentEnvironment ? 'Development Environment' : 'Non-Dev Environment']);
97+
$this->debug('SITE_HOSTNAME: %s', [SITE_HOSTNAME]);
9798
}
9899

99100
/**
@@ -129,8 +130,8 @@ public function debug($message, $params = [], $customLoglevel='DEBUG')
129130
$origin = $this->getOrigin();
130131

131132
if (is_null(ERRORLOG_DEBUG_SCOPE) ||
132-
ERRORLOG_DEBUG_SCOPE === $origin['function'] ||
133-
ERRORLOG_DEBUG_SCOPE === basename($origin['file']))
133+
in_array($origin['function'], ERRORLOG_DEBUG_SCOPE) ||
134+
in_array(basename($origin['file']), ERRORLOG_DEBUG_SCOPE))
134135
{
135136
$this->log($customLoglevel, $message, $params, $origin);
136137
}

‎www/includes/forum.inc.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -699,7 +699,8 @@ static function post($parent_id, $board, $user_id, $text, $msg_users=NULL)
699699
if (Thread::hasRights($board, $thread_id, $user_id))
700700
{
701701
/** Böse Sachen aus dem Text entfernen */
702-
$text = sanitize_userinput($text);
702+
//$text = sanitize_userinput($text);
703+
$text = htmlspecialchars_decode($text, ENT_COMPAT | ENT_SUBSTITUTE);
703704

704705
/** Comment in die DB abspeichern */
705706
$comment_error = (isset($comment_error) ? $comment_error : '');

‎www/includes/geo2ip.inc.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,8 @@ public function __construct()
7979
*/
8080
$this->storeUserIPToSession($this->UserIPaddress);
8181
$this->setMaxmindIPDetails();
82-
} elseif (DEVELOPMENT === true) {
83-
error_log(sprintf('[DEBUG] <%s:%d> getDataFromSession(%s): SESSION CACHE HIT!', __METHOD__, __LINE__, $this->UserIPaddress));
82+
} else {
83+
\zorgDebugger::me()->debug('getDataFromSession(%s): SESSION CACHE HIT!', [$this->UserIPaddress]);
8484
}
8585
}
8686

@@ -120,7 +120,7 @@ private function getRealIPaddress()
120120
foreach(explode(',', $_SERVER[$ServerVar]) as $ip_address)
121121
{
122122
/** Validate IP-Address from $_SERVER var */
123-
if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> %s => %s', __METHOD__, __LINE__, $ServerVar, $ip_address));
123+
\zorgDebugger::me()->debug('%s => %s', [$ServerVar, $ip_address]);
124124
$checked_IPaddress = $this->validateIPaddress((string)$ip_address);
125125

126126
if (!empty($checked_IPaddress) && false !== $checked_IPaddress)
@@ -129,7 +129,7 @@ private function getRealIPaddress()
129129
return $checked_IPaddress;
130130
}
131131
}
132-
if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> %s => %s', __METHOD__, __LINE__, $ip_address, (empty($checked_IPaddress) ? 'empty' : ($checked_IPaddress === false ? 'false' : $checked_IPaddress))));
132+
\zorgDebugger::me()->debug('%s => %s', [$ip_address, (empty($checked_IPaddress) ? 'empty' : ($checked_IPaddress === false ? 'false' : $checked_IPaddress))]);
133133
}
134134
}
135135

‎www/includes/mysql.inc.php‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ function query($sql, $file='', $line=0, $funktion='', $params=[]) {
111111
if (empty($params)) {
112112
$result = mysqli_query($this->conn, $sql);
113113
/* Log SQL-Queries not upgraded to Prepared Statements */
114-
if (DEVELOPMENT) error_log(sprintf('[DEPRECATED] <%s> Required SQL-Query update for mysqli_prepare(): %s:%d', $funktion, $file, $line));
114+
zorgDebugger::me()->debug('<%s> is no SQL prepared statement, in %s:%d', [$funktion, $file, $line]);
115115
} else {
116116
$stmt = mysqli_prepare($this->conn, $sql);
117117
if ($stmt === false) throw new mysqli_sql_exception(mysqli_error($this->conn));
@@ -187,7 +187,7 @@ function query($sql, $file='', $line=0, $funktion='', $params=[]) {
187187
}
188188
}
189189
} catch (mysqli_sql_exception $e) {
190-
if (DEVELOPMENT === true) var_dump([$file, $funktion, $line, $sql, $params]);
190+
zorgDebugger::me()->debug('%s', [$e->getMessage()]);
191191
die($e->getMessage());
192192
}
193193
}
@@ -310,7 +310,7 @@ function numfields($result) {
310310
* @return array
311311
*/
312312
function tables() {
313-
$query = "SHOW TABLES FROM " . $_ENV['MYSQL_DATABASE'];
313+
$query = 'SHOW TABLES FROM '.$_ENV['MYSQL_DATABASE'];
314314
$result = mysqli_query($this->conn, $query);
315315
$tables = array();
316316
while ($row = mysqli_fetch_row($result)) {
@@ -348,7 +348,7 @@ function insert($table, $values, $file='', $line=0, $funktion=null)
348348
$insertKeys = '(`'.implode('`,`', array_keys($values)).'`)';
349349
$insertValues = implode(',', array_fill(0, count($values), '?'));
350350
$sql = sprintf('INSERT INTO `%s` %s VALUES (%s)', $table, $insertKeys, $insertValues);
351-
if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> $db->insert() query: %s%s', __METHOD__, __LINE__, $sql, print_r($values,true)));
351+
zorgDebugger::me()->debug('$db->insert() SQL: %s%s', [$sql, print_r($values,true)]);
352352
foreach ($values as $key => $val) {
353353
if (strtolower($val) === 'now()') {
354354
$values[$key] = timestamp(true); // Fix "NOW()" => NOW() without quotes
@@ -429,15 +429,14 @@ function update($table, $id, $values, $file='', $line='', $funktion='')
429429
$conditions[$id[$i]] = $id[$i+1]; // map $id[0] => $id[1], $id[2] => $id[3],... to $conditions-Array
430430
$i++;
431431
}
432-
//if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> $db->update() $conditions[ %s ]', __METHOD__, __LINE__, print_r($conditions,true)));
433432
foreach ($conditions as $field => $value) {
434433
$sql .= $field.'=?';//.(is_numeric($value) ? $value : '"'.$value.'"');
435434
$params[] = $value;
436435
end($conditions); // @link https://stackoverflow.com/a/8780881/5750030
437436
if ($field !== key($conditions)) $sql .= ' OR '; // Add Separator if not last Array-Iteration
438437
}
439438
}
440-
if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> $db->update() $sql: %s', __METHOD__, __LINE__, $sql));
439+
zorgDebugger::me()->debug('$db->update() SQL: %s', [$sql]);
441440
return $this->query($sql, $file, $line, $funktion, $params);
442441
//return mysql_affected_rows();
443442
}

‎www/includes/smarty.fnc.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1181,21 +1181,21 @@ function smarty_menuname_exec ($name)
11811181
}*/
11821182
foreach ($nameArray as $it)
11831183
{
1184-
if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> smarty_menuname_exec: "%s" on tpl_id %d', __FUNCTION__, __LINE__, $it, $tpl_id));
1184+
zorgDebugger::me()->debug('«%s» on tpl_id %s', [$it, strval($tpl_id)]);
11851185
if (!empty($it)) {
11861186
/** Check if menu with same name already exists... */
11871187
$menuExists = $db->fetch($db->query('SELECT * FROM menus WHERE name=?',
11881188
__FILE__, __LINE__, __FUNCTION__, [$it]));
11891189
//if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> $menuExists Query: %s', __FUNCTION__, __LINE__, print_r($menuExists,true)));
11901190
if ($menuExists !== false && $menuExists['tpl_id'] === $tpl_id)
11911191
{
1192-
if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> $menuExists: TRUE (tpl_id: %d)', __FUNCTION__, __LINE__, $tpl_id));
1192+
zorgDebugger::me()->debug('$menuExists: TRUE (tpl_id: %d)', [strval($tpl_id)]);
11931193
//return sprintf('Menuname "%s" existiert schon mit der id#%d und wurde deshalb nicht gespeichert!<br>Bitte anderen Namen verwenden.', $it, $tpl_id);
11941194
}
11951195

11961196
/** Menu mit $name gibt es noch nicht, deshlab erstellen wir es neu */
11971197
else {
1198-
if (DEVELOPMENT === true) error_log(sprintf('[DEBUG] <%s:%d> $menuExists: FALSE (adding new)', __FUNCTION__, __LINE__));
1198+
zorgDebugger::me()->debug('$menuExists: FALSE (adding new)');
11991199
$db->query('INSERT INTO menus (tpl_id, name) VALUES (?, ?)',
12001200
__FILE__, __LINE__, __FUNCTION__, [$tpl_id, $it]);
12011201
//$smarty->assign('error', ['type' => 'success', 'dismissable' => 'true', 'title' => sprintf('Neues Menu "%s" erfolgreich gespeichert', $it), 'message' => 'Du kannst es jetzt im Template-Editor einer Page auswählen.']);

0 commit comments

Comments
 (0)