Merge pull request #458 from ECYaz/fix/394-url-permalink

Reject links entered as contribution names or permalinks

Author: iMattPro

controller/contribution/manage.php

@@ -216,7 +216,8 @@ public function manage($contrib_type, $contrib)
 				$authors,
 				$this->settings['custom'],
 				$this->contrib->contrib_name_clean,
-				$this->settings['permalink']
+				$this->settings['permalink'],
+				$old_settings['contrib_name']
 			));
 
 			// Did we succeed or have an error?

includes/objects/contribution.php

@@ -1590,10 +1590,11 @@ public function change_permalink($new_permalink)
 	* @param array $custom_fields			Custom field values.
 	* @param string $old_permalink			Old permalink. Defaults to empty string.
 	* @param string|null $new_permalink		Submitted permalink. Defaults to the value on the entity.
+	* @param string $old_name				Old contribution name. Defaults to empty string.
 	*
 	* @return array Returns array containing any errors found.
 	*/
-	public function validate($contrib_categories, $authors, $custom_fields, $old_permalink = '', $new_permalink = null)
+	public function validate($contrib_categories, $authors, $custom_fields, $old_permalink = '', $new_permalink = null, $old_name = '')
 	{
 		phpbb::$user->add_lang('ucp');
 
@@ -1603,6 +1604,10 @@ public function validate($contrib_categories, $authors, $custom_fields, $old_per
 		{
 			$error[] = phpbb::$user->lang['EMPTY_CONTRIB_NAME'];
 		}
+		else if ($this->contrib_name !== $old_name && $this->is_link($this->contrib_name))
+		{
+			$error[] = phpbb::$user->lang['CONTRIB_NAME_IS_LINK'];
+		}
 
 		$metadata = array(
 			$this->contrib_name,
@@ -1800,6 +1805,17 @@ protected function generate_permalink_slug($value)
 		return preg_replace('/[^\p{L}\p{M}\p{N}_]+/u', '_', url::generate_slug($value));
 	}
 
+	/**
+	 * Check whether a value is shaped like a link rather than a name.
+	 *
+	 * @param string $value
+	 * @return bool
+	 */
+	protected function is_link($value)
+	{
+		return (bool) preg_match('#^(?:[a-z][a-z0-9+.\-]*://|www\.)#i', trim($value));
+	}
+
 	/*
 	 * Validate a contrib permalink
 	 *
@@ -1816,6 +1832,14 @@ public function validate_permalink($permalink, $old_permalink)
 			return false;
 		}
 
+		// Only allow the characters the permalink generator itself produces.
+		// A pasted link fails this outright, so no slugified link is ever
+		// echoed back as a valid permalink example.
+		if (!preg_match('/^[\p{L}\p{M}\p{N}_]*$/u', $permalink))
+		{
+			return phpbb::$user->lang['CONTRIB_PERMALINK_INVALID_CHARACTERS'];
+		}
+
 		$generated_permalink = $this->generate_permalink_slug($permalink);
 		if ($generated_permalink !== $permalink)
 		{

language/en/contributions.php

@@ -79,6 +79,7 @@
 	'CONTRIB_LOCAL_NAME'					=> 'Local name',
 	'CONTRIB_LOCAL_NAME_EXPLAIN'			=> 'The localized name of the language, e.g. <em>Français</em>.',
 	'CONTRIB_NAME'							=> 'Contribution Name',
+	'CONTRIB_NAME_IS_LINK'					=> 'The contribution name cannot be a link. Please enter the name of your contribution.',
 	'CONTRIB_NEW'							=> 'New',
 	'CONTRIB_NONACTIVE_AUTHORS'				=> 'Non-Active Co-Authors (Past Contributors)',
 	'CONTRIB_NONACTIVE_AUTHORS_EXPLAIN'		=> 'Non-Active Co-Authors can not manage anything for the contribution and are only listed as previous authors.',
@@ -87,6 +88,7 @@
 	'CONTRIB_PERMALINK'						=> 'Contribution Permalink',
 	'CONTRIB_PERMALINK_EXISTS'				=> 'That contribution permalink is already in use.',
 	'CONTRIB_PERMALINK_EXPLAIN'				=> 'Cleaned version of the contribution name, used to build the url for the contribution.<br /><strong>Leave blank to have one automatically created based on the contribution name.</strong>',
+	'CONTRIB_PERMALINK_INVALID_CHARACTERS'	=> 'The permalink may only contain letters, numbers and underscores. Leave the field blank to have a valid one created from the contribution name.',
 	'CONTRIB_RELEASE_DATE'					=> 'Release date',
 	'CONTRIB_STATUS'						=> 'Contribution status',
 	'CONTRIB_STATUS_EXPLAIN'				=> 'Change the contribution status',