Skip to content

Commit dca641f

Browse files
wilsongewilsonge
committed
Prepare 3.4.5 Release
1 parent 6a99b5d commit dca641f

File tree

10 files changed

+231
-82
lines changed

10 files changed

+231
-82
lines changed

‎administrator/components/com_contenthistory/contenthistory.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@
99

1010
defined('_JEXEC') or die;
1111

12+
// Disallow unauthenticated users
13+
if (JFactory::getUser()->guest)
14+
{
15+
return JError::raiseWarning(404, JText::_('JERROR_ALERTNOAUTHOR'));
16+
}
17+
1218
$controller = JControllerLegacy::getInstance('Contenthistory', array('base_path' => JPATH_COMPONENT_ADMINISTRATOR));
1319
$controller->execute(JFactory::getApplication()->input->get('task'));
1420
$controller->redirect();

‎administrator/components/com_contenthistory/models/compare.php‎

Lines changed: 31 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,20 +21,46 @@ class ContenthistoryModelCompare extends JModelItem
2121
/**
2222
* Method to get a version history row.
2323
*
24-
* @return mixed On success, array of populated tables. False on failure.
24+
* @return array|boolean On success, array of populated tables. False on failure.
2525
*
2626
* @since 3.2
2727
*/
2828
public function getItems()
2929
{
30+
$input = JFactory::getApplication()->input;
31+
32+
/** @var JTableContenthistory $table1 */
3033
$table1 = JTable::getInstance('Contenthistory');
34+
35+
/** @var JTableContenthistory $table2 */
3136
$table2 = JTable::getInstance('Contenthistory');
32-
$id1 = JFactory::getApplication()->input->getInt('id1');
33-
$id2 = JFactory::getApplication()->input->getInt('id2');
37+
38+
$id1 = $input->getInt('id1');
39+
$id2 = $input->getInt('id2');
3440
$result = array();
3541

3642
if ($table1->load($id1) && $table2->load($id2))
3743
{
44+
// Get the first history record's content type record so we can check ACL
45+
/** @var JTableContenttype $contentTypeTable */
46+
$contentTypeTable = JTable::getInstance('Contenttype');
47+
$ucmTypeId = $table1->ucm_type_id;
48+
49+
if (!$contentTypeTable->load($ucmTypeId))
50+
{
51+
// Assume a failure to load the content type means broken data, abort mission
52+
return false;
53+
}
54+
55+
// Access check
56+
if (!JFactory::getUser()->authorise('core.edit', $contentTypeTable->type_alias . '.' . (int) $table1->ucm_item_id))
57+
{
58+
$this->setError(JText::_('JERROR_ALERTNOAUTHOR'));
59+
60+
return false;
61+
}
62+
63+
// All's well, process the records
3864
foreach (array($table1, $table2) as $table)
3965
{
4066
$object = new stdClass;
@@ -46,9 +72,7 @@ public function getItems()
4672

4773
return $result;
4874
}
49-
else
50-
{
51-
return false;
52-
}
75+
76+
return false;
5377
}
5478
}

‎administrator/components/com_contenthistory/models/history.php‎

Lines changed: 51 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,20 +43,22 @@ public function __construct($config = array())
4343
* Method to test whether a history record can be deleted. Note that we check whether we have edit permissions
4444
* for the content item row.
4545
*
46-
* @param object $record A JTable object.
46+
* @param JTableContenthistory $record A JTable object.
4747
*
4848
* @return boolean True if allowed to delete the record. Defaults to the permission set in the component.
4949
*
5050
* @since 3.2
5151
*/
5252
protected function canEdit($record)
5353
{
54+
$result = false;
55+
5456
if (!empty($record->ucm_type_id))
5557
{
56-
$result = false;
57-
5858
// Check that the type id matches the type alias
5959
$typeAlias = JFactory::getApplication()->input->get('type_alias');
60+
61+
/** @var JTableContenttype $contentTypeTable */
6062
$contentTypeTable = JTable::getInstance('Contenttype', 'JTable');
6163

6264
if ($contentTypeTable->getTypeId($typeAlias) == $record->ucm_type_id)
@@ -66,7 +68,7 @@ protected function canEdit($record)
6668
* for the content item, not delete permissions for the content history row.
6769
*/
6870
$user = JFactory::getUser();
69-
$result = $user->authorise('core.edit', $typeAlias . (int) $record->version_id);
71+
$result = $user->authorise('core.edit', $typeAlias . '.' . (int) $record->ucm_item_id);
7072
}
7173
}
7274

@@ -135,6 +137,51 @@ public function delete(&$pks)
135137
return true;
136138
}
137139

140+
/**
141+
* Method to get an array of data items.
142+
*
143+
* @return mixed An array of data items on success, false on failure.
144+
*
145+
* @since 3.4.5
146+
*/
147+
public function getItems()
148+
{
149+
$items = parent::getItems();
150+
151+
if ($items === false)
152+
{
153+
return false;
154+
}
155+
156+
// This should be an array with at least one element
157+
if (!is_array($items) || !isset($items[0]))
158+
{
159+
return $items;
160+
}
161+
162+
// Get the content type's record so we can check ACL
163+
/** @var JTableContenttype $contentTypeTable */
164+
$contentTypeTable = JTable::getInstance('Contenttype');
165+
$ucmTypeId = $items[0]->ucm_type_id;
166+
167+
if (!$contentTypeTable->load($ucmTypeId))
168+
{
169+
// Assume a failure to load the content type means broken data, abort mission
170+
return false;
171+
}
172+
173+
// Access check
174+
if (!JFactory::getUser()->authorise('core.edit', $contentTypeTable->type_alias . '.' . (int) $items[0]->ucm_item_id))
175+
{
176+
$this->setError(JText::_('JERROR_ALERTNOAUTHOR'));
177+
178+
return false;
179+
}
180+
181+
// All good, return the items array
182+
return $items;
183+
}
184+
138185
/**
139186
* Method to get a table object, load it if necessary.
140187
*

‎administrator/components/com_contenthistory/models/preview.php‎

Lines changed: 26 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,31 +18,48 @@
1818
*/
1919
class ContenthistoryModelPreview extends JModelItem
2020
{
21-
2221
/**
2322
* Method to get a version history row.
2423
*
25-
* @return mixed On success, standard object with row data. False on failure.
24+
* @return stdClass|boolean On success, standard object with row data. False on failure.
2625
*
2726
* @since 3.2
2827
*/
2928
public function getItem()
3029
{
30+
/** @var JTableContenthistory $table */
3131
$table = JTable::getInstance('Contenthistory');
3232
$versionId = JFactory::getApplication()->input->getInt('version_id');
3333

34-
if ($table->load($versionId))
34+
if (!$table->load($versionId))
35+
{
36+
return false;
37+
}
38+
39+
// Get the content type's record so we can check ACL
40+
/** @var JTableContenttype $contentTypeTable */
41+
$contentTypeTable = JTable::getInstance('Contenttype');
42+
43+
if (!$contentTypeTable->load($table->ucm_type_id))
3544
{
36-
$result = new stdClass;
37-
$result->save_date = $table->save_date;
38-
$result->version_note = $table->version_note;
39-
$result->data = ContenthistoryHelper::prepareData($table);
45+
// Assume a failure to load the content type means broken data, abort mission
46+
return false;
4047
}
41-
else
48+
49+
// Access check
50+
if (!JFactory::getUser()->authorise('core.edit', $contentTypeTable->type_alias . '.' . (int) $table->ucm_item_id))
4251
{
43-
$result = false;
52+
$this->setError(JText::_('JERROR_ALERTNOAUTHOR'));
53+
54+
return false;
4455
}
4556

57+
// Good to go, finish processing the data
58+
$result = new stdClass;
59+
$result->save_date = $table->save_date;
60+
$result->version_note = $table->version_note;
61+
$result->data = ContenthistoryHelper::prepareData($table);
62+
4663
return $result;
4764
}
4865
}

‎administrator/manifests/files/joomla.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
<authorUrl>www.joomla.org</authorUrl>
77
<copyright>(C) 2005 - 2015 Open Source Matters. All rights reserved</copyright>
88
<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
9-
<version>3.4.4</version>
10-
<creationDate>September 2015</creationDate>
9+
<version>3.4.5</version>
10+
<creationDate>October 2015</creationDate>
1111
<description>FILES_JOOMLA_XML_DESCRIPTION</description>
1212

1313
<scriptfile>administrator/components/com_admin/script.php</scriptfile>

‎components/com_content/content.php‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,28 @@
1212
require_once JPATH_COMPONENT . '/helpers/route.php';
1313
require_once JPATH_COMPONENT . '/helpers/query.php';
1414

15+
$input = JFactory::getApplication()->input;
16+
$user = JFactory::getUser();
17+
18+
if ($input->get('view') === 'article' && $input->get('layout') === 'pagebreak')
19+
{
20+
if (!$user->authorise('core.edit', 'com_content'))
21+
{
22+
JFactory::getApplication()->enqueueMessage(JText::_('JERROR_ALERTNOAUTHOR'), 'warning');
23+
24+
return;
25+
}
26+
}
27+
elseif ($input->get('view') === 'articles' && $input->get('layout') === 'modal')
28+
{
29+
if (!$user->authorise('core.edit', 'com_content'))
30+
{
31+
JFactory::getApplication()->enqueueMessage(JText::_('JERROR_ALERTNOAUTHOR'), 'warning');
32+
33+
return;
34+
}
35+
}
36+
1537
$controller = JControllerLegacy::getInstance('Content');
16-
$controller->execute(JFactory::getApplication()->input->get('task'));
38+
$controller->execute($input->get('task'));
1739
$controller->redirect();

‎libraries/cms/version/version.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ final class JVersion
2323
public $RELEASE = '3.4';
2424

2525
/** @var string Maintenance version. */
26-
public $DEV_LEVEL = '4';
26+
public $DEV_LEVEL = '5';
2727

2828
/** @var string Development STATUS. */
2929
public $DEV_STATUS = 'Stable';
@@ -35,7 +35,7 @@ final class JVersion
3535
public $CODENAME = 'Ember';
3636

3737
/** @var string Release date. */
38-
public $RELDATE = '8-September-2015';
38+
public $RELDATE = '22-October-2015';
3939

4040
/** @var string Release time. */
4141
public $RELTIME = '21:30';

‎libraries/joomla/filter/input.php‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -441,7 +441,7 @@ public static function isSafeFile($file, $options = array())
441441
$explodedName = explode('.', $intendedName);
442442
$explodedName = array_reverse($explodedName);
443443
array_pop($explodedName);
444-
array_map('strtolower', $explodedName);
444+
$explodedName = array_map('strtolower', $explodedName);
445445

446446
/*
447447
* DO NOT USE array_intersect HERE! array_intersect expects the two arrays to
@@ -468,10 +468,9 @@ public static function isSafeFile($file, $options = array())
468468

469469
while (!feof($fp))
470470
{
471-
$buffer = @fread($fp, 131072);
472-
$data .= $buffer;
471+
$data .= @fread($fp, 131072);
473472

474-
if ($options['php_tag_in_content'] && strstr($buffer, '<?php'))
473+
if ($options['php_tag_in_content'] && stristr($data, '<?php'))
475474
{
476475
return false;
477476
}
@@ -506,7 +505,7 @@ public static function isSafeFile($file, $options = array())
506505
if ($collide)
507506
{
508507
// These are suspicious text files which may have the short tag (<?) in them
509-
if (strstr($buffer, '<?'))
508+
if (strstr($data, '<?'))
510509
{
511510
return false;
512511
}
@@ -548,7 +547,7 @@ public static function isSafeFile($file, $options = array())
548547
*/
549548
foreach ($options['forbidden_extensions'] as $ext)
550549
{
551-
if (strstr($buffer, '.' . $ext))
550+
if (strstr($data, '.' . $ext))
552551
{
553552
return false;
554553
}
@@ -560,7 +559,7 @@ public static function isSafeFile($file, $options = array())
560559
* This makes sure that we don't accidentally skip a <?php tag if it's across
561560
* a read boundary, even on multibyte strings
562561
*/
563-
$data = substr($data, -8);
562+
$data = substr($data, -10);
564563
}
565564

566565
fclose($fp);

0 commit comments

Comments
 (0)