diff --git a/.htaccess b/.htaccess index 28ac3dd802..6cb3a07494 100755 --- a/.htaccess +++ b/.htaccess @@ -5,9 +5,6 @@ AddType audio/ogg .oga Deny from all - -Deny from all - RewriteEngine on diff --git a/boot.php b/boot.php index 910de6f82d..04e16e64dc 100755 --- a/boot.php +++ b/boot.php @@ -11,7 +11,7 @@ require_once('include/cache.php'); define ( 'FRIENDICA_PLATFORM', 'Friendica'); define ( 'FRIENDICA_VERSION', '2.3.1288' ); define ( 'DFRN_PROTOCOL_VERSION', '2.23' ); -define ( 'DB_UPDATE_VERSION', 1132 ); +define ( 'DB_UPDATE_VERSION', 1133 ); define ( 'EOL', "
\r\n" ); define ( 'ATOM_TIME', 'Y-m-d\TH:i:s\Z' ); diff --git a/database.sql b/database.sql index f058bc59ef..327b482c06 100755 --- a/database.sql +++ b/database.sql @@ -861,3 +861,9 @@ INDEX ( `term` ) ) ENGINE = MyISAM DEFAULT CHARSET=utf8; +CREATE TABLE IF NOT EXISTS `userd` ( +`id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY , +`username` CHAR( 255 ) NOT NULL, +INDEX ( `username` ) +) ENGINE = MyISAM DEFAULT CHARSET=utf8; + diff --git a/include/Contact.php b/include/Contact.php index baccea3055..d9949b1ef8 100755 --- a/include/Contact.php +++ b/include/Contact.php @@ -15,6 +15,12 @@ function user_remove($uid) { call_hooks('remove_user',$r[0]); + // save username (actually the nickname as it is guaranteed + // unique), so it cannot be re-registered in the future. + + q("insert into userd ( username ) values ( '%s' )", + $r[0]['nickname'] + ); q("DELETE FROM `contact` WHERE `uid` = %d", intval($uid)); q("DELETE FROM `group` WHERE `uid` = %d", intval($uid)); diff --git a/mod/delegate.php b/mod/delegate.php index c19df0681d..8c50318590 100644 --- a/mod/delegate.php +++ b/mod/delegate.php @@ -86,7 +86,7 @@ function delegate_content(&$a) { $r = q("select nurl from contact where substring_index(contact.nurl,'/',3) = '%s' and contact.uid = %d and contact.self = 0 and network = '%s' ", - dbesc($a->get_baseurl()), + dbesc(normalise_link($a->get_baseurl())), intval(local_user()), dbesc(NETWORK_DFRN) ); diff --git a/mod/register.php b/mod/register.php index 388b3e2507..6d0e2700bc 100755 --- a/mod/register.php +++ b/mod/register.php @@ -150,6 +150,16 @@ function register_post(&$a) { if(count($r)) $err .= t('Nickname is already registered. Please choose another.') . EOL; + // Check deleted accounts that had this nickname. Doesn't matter to us, + // but could be a security issue for federated platforms. + + $r = q("SELECT * FROM `userd` + WHERE `username` = '%s' LIMIT 1", + dbesc($nickname) + ); + if(count($r)) + $err .= t('Nickname was once registered here and may not be re-used. Please choose another.') . EOL; + if(strlen($err)) { notice( $err ); return; diff --git a/mod/regmod.php b/mod/regmod.php index 17e728ba2d..21f41eb01c 100755 --- a/mod/regmod.php +++ b/mod/regmod.php @@ -64,6 +64,11 @@ function user_allow($hash) { } + +// This does not have to go through user_remove() and save the nickname +// permanently against re-registration, as the person was not yet +// allowed to have friends on this system + function user_deny($hash) { $register = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1", diff --git a/tests/template_test.php b/tests/template_test.php new file mode 100755 index 0000000000..1f9f805313 --- /dev/null +++ b/tests/template_test.php @@ -0,0 +1,224 @@ +assertTrue(is_null($second)); + } + + public function testSimpleVariableString() { + $tpl='Hello $name!'; + + $text=replace_macros($tpl, array('$name'=>'Anna')); + + $this->assertEquals('Hello Anna!', $text); + } + + public function testSimpleVariableInt() { + $tpl='There are $num new messages!'; + + $text=replace_macros($tpl, array('$num'=>172)); + + $this->assertEquals('There are 172 new messages!', $text); + } + + public function testConditionalElse() { + $tpl='There{{ if $num!=1 }} are $num new messages{{ else }} is 1 new message{{ endif }}!'; + + $text1=replace_macros($tpl, array('$num'=>1)); + $text22=replace_macros($tpl, array('$num'=>22)); + + $this->assertEquals('There is 1 new message!', $text1); + $this->assertEquals('There are 22 new messages!', $text22); + } + + public function testConditionalNoElse() { + $tpl='{{ if $num!=0 }}There are $num new messages!{{ endif }}'; + + $text0=replace_macros($tpl, array('$num'=>0)); + $text22=replace_macros($tpl, array('$num'=>22)); + + $this->assertEquals('', $text0); + $this->assertEquals('There are 22 new messages!', $text22); + } + + public function testConditionalFail() { + $tpl='There {{ if $num!=1 }} are $num new messages{{ else }} is 1 new message{{ endif }}!'; + + $text1=replace_macros($tpl, array()); + + //$this->assertEquals('There is 1 new message!', $text1); + } + + public function testSimpleFor() { + $tpl='{{ for $messages as $message }} $message {{ endfor }}'; + + $text=replace_macros($tpl, array('$messages'=>array('message 1', 'message 2'))); + + $this->assertEquals(' message 1 message 2 ', $text); + } + + public function testFor() { + $tpl='{{ for $messages as $message }} from: $message.from to $message.to {{ endfor }}'; + + $text=replace_macros($tpl, array('$messages'=>array(array('from'=>'Mike', 'to'=>'Alex'), array('from'=>'Alex', 'to'=>'Mike')))); + + $this->assertEquals(' from: Mike to Alex from: Alex to Mike ', $text); + } + + public function testKeyedFor() { + $tpl='{{ for $messages as $from=>$to }} from: $from to $to {{ endfor }}'; + + $text=replace_macros($tpl, array('$messages'=>array('Mike'=>'Alex', 'Sven'=>'Mike'))); + + $this->assertEquals(' from: Mike to Alex from: Sven to Mike ', $text); + } + + public function testForEmpty() { + $tpl='messages: {{for $messages as $message}} from: $message.from to $message.to {{ endfor }}'; + + $text=replace_macros($tpl, array('$messages'=>array())); + + $this->assertEquals('messages: ', $text); + } + + public function testForWrongType() { + $tpl='messages: {{for $messages as $message}} from: $message.from to $message.to {{ endfor }}'; + + $text=replace_macros($tpl, array('$messages'=>11)); + + $this->assertEquals('messages: ', $text); + } + + public function testForConditional() { + $tpl='new messages: {{for $messages as $message}}{{ if $message.new }} $message.text{{endif}}{{ endfor }}'; + + $text=replace_macros($tpl, array('$messages'=>array( + array('new'=>true, 'text'=>'new message'), + array('new'=>false, 'text'=>'old message')))); + + $this->assertEquals('new messages: new message', $text); + } + + public function testConditionalFor() { + $tpl='{{ if $enabled }}new messages:{{for $messages as $message}} $message.text{{ endfor }}{{endif}}'; + + $text=replace_macros($tpl, array('$enabled'=>true, + '$messages'=>array( + array('new'=>true, 'text'=>'new message'), + array('new'=>false, 'text'=>'old message')))); + + $this->assertEquals('new messages: new message old message', $text); + } + + public function testFantasy() { + $tpl='Fantasy: {{fantasy $messages}}'; + + $text=replace_macros($tpl, array('$messages'=>'no no')); + + $this->assertEquals('Fantasy: {{fantasy no no}}', $text); + } + + public function testInc() { + $tpl='{{inc field_input.tpl with $field=$myvar}}{{ endinc }}'; + + $text=replace_macros($tpl, array('$myvar'=>array('myfield', 'label', 'value', 'help'))); + + $this->assertEquals(" \n" + ."
\n" + ." \n" + ." \n" + ." help\n" + ."
\n", $text); + } + + public function testIncNoVar() { + $tpl='{{inc field_input.tpl }}{{ endinc }}'; + + $text=replace_macros($tpl, array('$field'=>array('myfield', 'label', 'value', 'help'))); + + $this->assertEquals(" \n
\n \n" + ." \n" + ." help\n" + ."
\n", $text); + } + + public function testDoubleUse() { + $tpl='Hello $name! {{ if $enabled }} I love you! {{ endif }}'; + + $text=replace_macros($tpl, array('$name'=>'Anna', '$enabled'=>false)); + + $this->assertEquals('Hello Anna! ', $text); + + $tpl='Hey $name! {{ if $enabled }} I hate you! {{ endif }}'; + + $text=replace_macros($tpl, array('$name'=>'Max', '$enabled'=>true)); + + $this->assertEquals('Hey Max! I hate you! ', $text); + } + + public function testIncDouble() { + $tpl='{{inc field_input.tpl with $field=$var1}}{{ endinc }}' + .'{{inc field_input.tpl with $field=$var2}}{{ endinc }}'; + + $text=replace_macros($tpl, array('$var1'=>array('myfield', 'label', 'value', 'help'), + '$var2'=>array('myfield2', 'label2', 'value2', 'help2'))); + + $this->assertEquals(" \n" + ."
\n" + ." \n" + ." \n" + ." help\n" + ."
\n" + ." \n" + ."
\n" + ." \n" + ." \n" + ." help2\n" + ."
\n", $text); + } +} \ No newline at end of file diff --git a/tests/xss_filter_test.php b/tests/xss_filter_test.php index d7dcf0472b..3fb6ac3109 100644 --- a/tests/xss_filter_test.php +++ b/tests/xss_filter_test.php @@ -27,11 +27,32 @@ class AntiXSSTest extends PHPUnit_Framework_TestCase { */ public function testXmlify() { $text="I want to break\n this!11!"; - $xml=xmlify($text); //test whether it actually may be part of a xml document + $xml=xmlify($text); $retext=unxmlify($text); $this->assertEquals($text, $retext); } + + /** + * xmlify and put in a document + */ + public function testXmlifyDocument() { + $tag="I want to break"; + $xml=xmlify($tag); + $text=''.$xml.''; + + $xml_parser=xml_parser_create(); + //should be possible to parse it + $values=array(); $index=array(); + $this->assertEquals(1, xml_parse_into_struct($xml_parser, $text, $values, $index)); + + $this->assertEquals(array('TEXT'=>array(0)), + $index); + $this->assertEquals(array(array('tag'=>'TEXT', 'type'=>'complete', 'level'=>1, 'value'=>$tag)), + $values); + + xml_parser_free($xml_parser); + } /** * test hex2bin and reverse diff --git a/update.php b/update.php index 6a685a6ff0..a69742a949 100755 --- a/update.php +++ b/update.php @@ -1,6 +1,6 @@ {{ endif }} {{ if $item.filer }} - + {{ endif }}
{{ if $item.drop.dropping }}{{ endif }} diff --git a/view/theme/comix-plain/wallwall_item.tpl b/view/theme/comix-plain/wallwall_item.tpl index 11decf9c45..abd5967b2a 100755 --- a/view/theme/comix-plain/wallwall_item.tpl +++ b/view/theme/comix-plain/wallwall_item.tpl @@ -62,7 +62,7 @@ {{ endif }} {{ if $item.filer }} - + {{ endif }}
diff --git a/view/theme/comix/wall_item.tpl b/view/theme/comix/wall_item.tpl index dae16a1c74..dfcd8ca960 100755 --- a/view/theme/comix/wall_item.tpl +++ b/view/theme/comix/wall_item.tpl @@ -58,7 +58,7 @@ {{ endif }} {{ if $item.filer }} - + {{ endif }}
{{ if $item.drop.dropping }}{{ endif }} diff --git a/view/theme/comix/wallwall_item.tpl b/view/theme/comix/wallwall_item.tpl index 11decf9c45..abd5967b2a 100755 --- a/view/theme/comix/wallwall_item.tpl +++ b/view/theme/comix/wallwall_item.tpl @@ -62,7 +62,7 @@ {{ endif }} {{ if $item.filer }} - + {{ endif }}
diff --git a/view/theme/duepuntozero/wall_item.tpl b/view/theme/duepuntozero/wall_item.tpl index e2db70a14a..9d1dd7d70e 100755 --- a/view/theme/duepuntozero/wall_item.tpl +++ b/view/theme/duepuntozero/wall_item.tpl @@ -58,7 +58,7 @@ {{ endif }} {{ if $item.filer }} - + {{ endif }}
{{ if $item.drop.dropping }}{{ endif }} diff --git a/view/theme/duepuntozero/wallwall_item.tpl b/view/theme/duepuntozero/wallwall_item.tpl index 420c0e08b9..bad5680c7a 100755 --- a/view/theme/duepuntozero/wallwall_item.tpl +++ b/view/theme/duepuntozero/wallwall_item.tpl @@ -62,7 +62,7 @@ {{ endif }} {{ if $item.filer }} - + {{ endif }}
diff --git a/view/theme/quattro-green/colors.less b/view/theme/quattro-green/colors.less index 57fd2ef60b..9eee19f4cd 100755 --- a/view/theme/quattro-green/colors.less +++ b/view/theme/quattro-green/colors.less @@ -72,6 +72,8 @@ @NoticeColor: @Grey1; @NoticeBackgroundColor: #511919; +@FieldHelpColor: @Grey3; + @ThreadBackgroundColor: #f6f7f8; @ShinyBorderColor: @Green4; diff --git a/view/theme/quattro-green/style.css b/view/theme/quattro-green/style.css index 301477679a..2f463c96c7 100755 --- a/view/theme/quattro-green/style.css +++ b/view/theme/quattro-green/style.css @@ -615,7 +615,7 @@ aside #profiles-menu { } #contact-block .contact-block-content { clear: both; - overflow: idden; + overflow: hidden; height: auto; } #contact-block .contact-block-link { @@ -623,7 +623,7 @@ aside #profiles-menu { margin: 0px 2px 2px 0px; } #contact-block .contact-block-link img { - widht: 48px; + width: 48px; height: 48px; } /* mail view */ @@ -787,7 +787,7 @@ section { } .wall-item-decor { position: absolute; - left: 790px; + left: 97%; top: -10px; width: 16px; } @@ -968,6 +968,10 @@ section { background: url("../../../images/tag.png") no-repeat center right; color: #ffffff; } +.filesavetags { + padding: 3px 0px 3px 0px; + opacity: 0.5; +} .wwto { position: absolute !important; width: 25px; @@ -1304,6 +1308,37 @@ ul.tabs li { ul.tabs li .active { border-bottom: 1px solid #009100; } +/** group editor **/ +#group-edit-desc { + margin-top: 1em; + color: #999999; +} +#group-update-wrapper { + height: auto; + overflow: auto; +} +#group-update-wrapper #group { + width: 300px; + float: left; + margin-right: 20px; +} +#group-update-wrapper #contacts { + width: 300px; + float: left; +} +#group-update-wrapper #group-separator { + display: none; +} +#group-update-wrapper .contact_list { + height: 300px; + border: 1px solid #364e59; + overflow: auto; +} +#group-update-wrapper .contact_list .contact-block-div { + width: 50px; + height: 50px; + float: left; +} /** * Form fields */ @@ -1326,7 +1361,7 @@ ul.tabs li .active { .field .field_help { display: block; margin-left: 200px; - color: #666666; + color: #999999; } .field .onoff { float: left; diff --git a/view/theme/quattro/quattro.less b/view/theme/quattro/quattro.less index 27c48f1952..fca65c9076 100755 --- a/view/theme/quattro/quattro.less +++ b/view/theme/quattro/quattro.less @@ -113,7 +113,7 @@ header { #banner { overflow: hidden; - text-align: center; + text-align: center; width: 100%; a, a:active, a:visited, a:link, a:hover { color: @Grey1; text-decoration: none; outline: none; vertical-align: bottom; } #logo-img { height: 22px; margin-top:5px;} @@ -448,7 +448,7 @@ section { margin-bottom: 20px; width: 780px; } -.wall-item-decor { position: absolute; left: 790px; top: -10px; width: 16px;} +.wall-item-decor { position: absolute; left: 97%; top: -10px; width: 16px;} .unstarred { display: none; } .wall-item-container { @@ -570,6 +570,10 @@ section { color: @TagColor; } } +.filesavetags { + padding: 3px 0px 3px 0px; + opacity: 0.5; +} .wwto { position: absolute !important; diff --git a/view/theme/quattro/style.css b/view/theme/quattro/style.css index 6087e4cd17..8f0abe86df 100755 --- a/view/theme/quattro/style.css +++ b/view/theme/quattro/style.css @@ -787,7 +787,7 @@ section { } .wall-item-decor { position: absolute; - left: 790px; + left: 97%; top: -10px; width: 16px; } @@ -968,6 +968,10 @@ section { background: url("../../../images/tag.png") no-repeat center right; color: #ffffff; } +.filesavetags { + padding: 3px 0px 3px 0px; + opacity: 0.5; +} .wwto { position: absolute !important; width: 25px; diff --git a/view/wall_item.tpl b/view/wall_item.tpl index c990775106..e771db0682 100755 --- a/view/wall_item.tpl +++ b/view/wall_item.tpl @@ -51,6 +51,9 @@ $item.star.undo $item.star.tagger {{ endif }} + {{ if $item.filer }} + $item.filer + {{ endif }} {{ if $item.vote }} $item.vote.like.1 diff --git a/view/wallwall_item.tpl b/view/wallwall_item.tpl index be942f2619..693ebaba6f 100755 --- a/view/wallwall_item.tpl +++ b/view/wallwall_item.tpl @@ -58,6 +58,9 @@ $item.star.tagger {{ endif }} + {{ if $item.filer }} + $item.filer + {{ endif }} {{ if $item.vote }} $item.vote.like.1