Bharat Mediratta
752c857116
Rename ORM_MPTT::is_descendant() to ORM_MPTT::contains() to make the
...
API a little clearer. Write a test for it, too.
2009-09-10 10:28:43 -07:00
Bharat Mediratta
6e65a8208f
Fix a thinko-- of course we want urls to be the path to the file itself.
2009-09-08 21:52:15 -07:00
Bharat Mediratta
0709f7526d
Change $this->_photo to just $photo
2009-09-08 21:33:45 -07:00
Bharat Mediratta
5d76a73596
Fix test to support new slug code.
2009-09-08 21:32:21 -07:00
Bharat Mediratta
48becbe017
Update item::convert_filename_to_slug() to eliminate leading and
...
trailing hyphens.
2009-09-08 20:03:55 -07:00
Bharat Mediratta
2f666f4c52
Add item::validate_url_safe() with a test.
2009-09-07 20:07:37 -07:00
Bharat Mediratta
991bb0c063
Update golden file.
2009-09-07 16:21:58 -07:00
Bharat Mediratta
3f997562de
Add support for a per-item "slug" which will be the user-visible url
...
component for that given item. Album hierarchies are represented by
nested slugs. By default, we convert the filename to a slug when you
create an album, photo or movie.
2009-09-07 15:42:08 -07:00
Andy Staudacher
b3d0cb5a4c
Bugfixes for locales::locale_from_http_request(), and adding tests.
...
(And the tests should illustrate that kohana 2.4's API doesn't quite fit our purpose of simply getting the best match between the accepted (client) and the installed (g3) locales.)
2009-09-05 18:55:44 -07:00
Andy Staudacher
b01596c0f0
Update XSS test golden data file.
2009-09-05 18:19:13 -07:00
Andy Staudacher
f63766556a
XSS test golden data file update
2009-09-04 11:20:02 -07:00
Andy Staudacher
c453c0ef82
Simplifying SafeString a bit: From a XSS HTML security point of view, treat clean() and purify() the same.
...
No longer run a safe HTML string through the HTML purifier (since it's already marked as safe).
This also addresses the issue of calling purify() when no purifier is installed. In that case, we'd run clean() on a clean string (double HTML encoding).
If this approach doesn't work out, we can still modify the fallback code of purify() to check if the string is already clean before calling clean() instead of purify().
2009-09-04 10:11:42 -07:00
Bharat Mediratta
1ffb5b24df
Checkpoint.
2009-09-03 11:34:02 -07:00
Bharat Mediratta
1405e8ed9e
Fix tests for new purifier API.
2009-09-03 11:29:57 -07:00
Bharat Mediratta
1dca0b9d6b
Fix test for new purifier API.
2009-09-03 11:28:42 -07:00
Andy Staudacher
8f6a120b52
Ensure that purify isn't applied twice for an already purified SafeString
2009-09-03 08:39:44 -07:00
Tim Almdal
c4b449add1
Merge branch 'master' into talmdal
2009-09-03 01:11:52 -07:00
Tim Almdal
dcdd44109b
fix the expected return value of photos controller
2009-09-03 01:11:28 -07:00
Tim Almdal
41e3773417
fix the expected return value of album controller
2009-09-03 01:07:02 -07:00
Tim Almdal
33bcf11e27
Change the Html_Helper and SafeString tests to change the expeced results based on whether HtmlPurifier module is installed or not
2009-09-03 01:05:03 -07:00
Bharat Mediratta
b842a9d9ca
Fix formatting, and use a properly named file in
...
change_photo_no_csrf_fails_test() so that GD doesn't bomb.
2009-09-02 11:58:04 -07:00
Andy Staudacher
fe37483aca
Update XSS scanner golden file
2009-09-01 01:29:42 -07:00
Andy Staudacher
d2cea7905e
Remove debugging code
2009-09-01 00:53:17 -07:00
Andy Staudacher
c0d4937e43
Fix bug in XSS scanner for <script> block @ position 0 of inline_html
2009-09-01 00:52:21 -07:00
Andy Staudacher
285e2b9cbe
Update XSS test golden file
2009-08-31 21:57:15 -07:00
Andy Staudacher
50c8b96405
Add XSS check for HTML attributes
2009-08-31 21:17:35 -07:00
Andy Staudacher
48050aca41
Add XSS check to ensure that html::js_string() is not preceded by a quote.
2009-08-31 19:53:53 -07:00
Andy Staudacher
26f6d8192f
Adding XSS test for href="javascript: and onclick="..."
2009-08-31 01:11:50 -07:00
Andy Staudacher
ddb84c84e1
Rename mark_safe() to mark_clean()
2009-08-31 00:42:18 -07:00
Andy Staudacher
afb0111fe6
Updating golden XSS-test data file
2009-08-30 21:36:14 -07:00
Andy Staudacher
0a0c7a78e6
Check for href="<?= $foo ?>" (malicious "javascript:..." string)
2009-08-30 21:25:21 -07:00
Andy Staudacher
3aef420d48
Updating XSS golden file
2009-08-30 18:37:01 -07:00
Andy Staudacher
df38a890a6
Tabs to spaces cleanup
2009-08-30 18:07:13 -07:00
Andy Staudacher
beb711d6a0
Rename clean_js to js_string and have it return a complete JS string (with delimiters) instead of just the string contents.
...
Benefits: Using json_encode(), which is very robust. And as a user, it's clearer how to use this API compared to what it was before.
2009-08-30 15:21:02 -07:00
Andy Staudacher
b5813f92c7
Improve no_tabs test to print out a complete list of files + line numbers + line snippet.
2009-08-30 07:42:37 -07:00
Andy Staudacher
22aa0b3092
Add $theme-> methods to Xss whitelist for HTML safety.
...
Updating XSS golden file.
2009-08-30 07:25:49 -07:00
Andy Staudacher
b9bd1681a3
Update all code to use helper method html::clean(), html::purify(), ... instead of SafeString directly.
2009-08-29 22:54:20 -07:00
Andy Staudacher
952c885609
Adding html::clean(), ::purify(), etc.
2009-08-29 22:31:23 -07:00
Andy Staudacher
b4b638be44
Undo url helper changes - url methods no longer return a SafeString.
...
Adding SafeString::of_safe_html() calls where urls are passed as parameters to t() and t2().
2009-08-29 16:28:30 -07:00
Andy Staudacher
a5dfc81a8f
Merge commit 'upstream/master'
...
Conflicts:
modules/akismet/views/admin_akismet.html.php
modules/comment/helpers/comment_rss.php
modules/gallery/helpers/gallery_rss.php
modules/gallery/libraries/I18n.php
modules/gallery/views/permissions_browse.html.php
modules/gallery/views/simple_uploader.html.php
modules/info/views/info_block.html.php
modules/organize/controllers/organize.php
modules/organize/views/organize.html.php
modules/organize/views/organize_album.html.php
themes/default/views/album.html.php
themes/default/views/movie.html.php
themes/default/views/photo.html.php
2009-08-29 14:17:48 -07:00
Andy Staudacher
d5660d2d3e
Fixing all detected XSS vectors in PHP->JS code.
...
Xss: Rename UNKNOWN back to DIRTY, JS_XSS to DIRTY_JS.
(using a different flag value to highlight potential XSS vectors in JS)
2009-08-29 13:41:18 -07:00
Andy Staudacher
a10063ff68
Add more factory methods for convenience:
...
SafeString::purify() and SafeString::of_safe_html().
Removing SafeString::mark_html_safe() since it's no longer needed.
2009-08-29 12:34:09 -07:00
Bharat Mediratta
0d16cc1c10
Clean up the test and get it working.
2009-08-29 12:12:53 -07:00
Andy Staudacher
7adb9ea2e3
Adding SafeString::for_html_attr()
2009-08-29 11:48:55 -07:00
Tim Almdal
38b2efc44c
Fix for 641... extend viewable functionality to comments. Viewable unit test is not working.
2009-08-29 11:43:10 -07:00
Andy Staudacher
1d633457c4
Have url::site() and other methods return a SafeString, just as t() and t2().
...
Benefits:
- url::site() is often used in views and we can ensure in the url class that returned strings are indeed safe for use in HTML. Makes the list of vars of unknown safety status shorter.
- url::site() is often used as message parameter to t() and t2(). The parameter would be HTML-escaped if it wasn't marked as safe HTML already. Makes the usage simpler / shorter.
2009-08-29 11:31:00 -07:00
Tim Almdal
27b81257fa
Standardize the access to the create_random_item method
2009-08-29 11:24:12 -07:00
Andy Staudacher
020281d932
Adding SafeString which is going to replace p::clean() and p::purify().
...
Refactoring of Xss_Security_Test.
t() and t2() return a SafeString instance.
TODO:
- Update all code to use SafeString where appropriate.
- Update golden fole of Xss_Security_Test
- Stop reporting CLEAN vars in Xss_Security_Test
2009-08-29 10:45:47 -07:00
Bharat Mediratta
e8c57290a2
Change the children and descendants APIs to be more consistent and to
...
remove Gallery3 concepts from ORM_MPTT.
The following API methods:
ORM_MPTT::children
ORM_MPTT::children_count
ORM_MPTT::descendants
ORM_MPTT::descendants_count
All now take a $where clause that allow you to pass through additional
field parameters.
old API:
$album->children(10, 0, "photos")
$album->children_count("photos")
new API:
$album->children(10, 0, array("type" => "photos"))
$album->children_count(array("type" => "photos"))
This gives us a more flexible API and simplifies the code. While I
was in there, I changed the way we deal with default orderby values so
that we just assign the default value in the function definition,
which allows us to get rid of all conditionals in the implementation
which results in simpler code.
2009-08-05 10:38:53 -07:00
Tim Almdal
9f396178ce
Revert "Allow a theme to override the page refresh mechanism. Create a new"
...
This reverts commit 1f014aae6c
2009-08-05 09:24:27 -07:00
Bharat Mediratta
Andy Staudacher
Tim Almdal