Merge branch '3.3.x'

Author: marc1706

.github/workflows/ci.yml

@@ -0,0 +1,103 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - 3.3.x
+      - master
+      - 4.0.x
+  pull_request:
+
+jobs:
+  lint:
+    name: "Lint (PHP ${{ matrix.php }})"
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['7.4', '8.1', '8.2', '8.3']
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+
+      - name: Syntax check
+        run: |
+          find . -name '*.php' \
+            -not -path './vendor/*' \
+            -not -path './includes/library/*' \
+            -not -path './composer_packages/*' \
+            -print0 | xargs -0 -n1 -P4 php -l > /dev/null
+
+  coding-standards:
+    name: Coding standards (changed files)
+    runs-on: ubuntu-22.04
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          coverage: none
+          tools: cs2pr
+
+      - name: Fetch the phpBB coding standard
+        run: |
+          git clone --depth 1 --branch 3.3.x --filter=blob:none --sparse \
+            https://github.com/phpbb/phpbb.git "$RUNNER_TEMP/phpbb"
+          git -C "$RUNNER_TEMP/phpbb" sparse-checkout set build/code_sniffer
+
+      - name: Install PHP_CodeSniffer and phpcs-changed
+        run: |
+          composer --working-dir="$RUNNER_TEMP" require --no-interaction \
+            squizlabs/php_codesniffer:^3.7 \
+            sirbrillig/phpcs-changed:^2.11
+
+      - name: Check lines changed by this pull request
+        run: |
+          git fetch --no-tags origin "$GITHUB_BASE_REF"
+          mapfile -t files < <(git diff --name-only --diff-filter=ACMR "origin/$GITHUB_BASE_REF"...HEAD -- '*.php' \
+            | grep -vE '^(vendor|includes/library|composer_packages)/' || true)
+
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "No PHP files changed."
+            exit 0
+          fi
+
+          printf '%s\n' "${files[@]}"
+          # Only report violations this pull request introduces. Running the ruleset
+          # over whole files would fail on the 175 pre-existing errors any time a
+          # legacy file is touched, which would make the check useless.
+          "$RUNNER_TEMP/vendor/bin/phpcs-changed" \
+            --git --git-base "origin/$GITHUB_BASE_REF" \
+            --phpcs-path "$RUNNER_TEMP/vendor/bin/phpcs" \
+            --standard "$RUNNER_TEMP/phpbb/build/code_sniffer/ruleset-php-extensions.xml" \
+            --report checkstyle "${files[@]}" | tee phpcs.xml
+          exit "${PIPESTATUS[0]}"
+
+      - name: Annotate the pull request
+        if: ${{ failure() }}
+        run: cs2pr phpcs.xml
+
+  composer:
+    name: Validate composer.json
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '7.4'
+          coverage: none
+
+      - name: Validate
+        run: composer validate --no-check-all --no-check-publish

.gitmodules

@@ -67,6 +67,23 @@
 			$contribList = $('.contrib-list-container'),
 			$search = $('#category-search');
 
+		// The address is about to change directory depth, which would make the
+		// browser re-resolve every relative URL on the page against the new
+		// path. Pin them to the URL the document was rendered against first.
+		var resolver = document.createElement('a');
+		$('a[href], form[action]').each(function() {
+			var name = (this.nodeName === 'FORM') ? 'action' : 'href',
+				value = this.getAttribute(name);
+
+			// Skip absolute URLs, protocol-relative URLs, root-relative URLs, and in-page anchors.
+			if (!value || value[0] === '#' || value[0] === '/' || value.indexOf('//') === 0 || /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(value)) {
+				return;
+			}
+
+			resolver.href = value;
+			this.setAttribute(name, resolver.href);
+		});
+
 		phpbb.history.replaceUrl($this.attr('href'));
 
 		var getParents = function($self) {

.travis.yml

@@ -95,7 +95,7 @@ protected function configure_properties()
 			'physical_filename'		=> array('default' => '',	'max' => 255),
 			'attachment_directory'	=> array('default' => '',	'max' => 255),
 			'real_filename'			=> array('default' => '',	'max' => 255),
-			'attachment_comment'	=> array('default' => ''),
+			'attachment_comment'	=> array('default' => '',	'encode_ucr' => true),
 
 			'download_count'		=> array('default' => 0),
 
@@ -202,6 +202,14 @@ public function submit($data = null)
 
 		if (!empty($data))
 		{
+			foreach ($data as $name => $value)
+			{
+				if (isset($this->object_config[$name]))
+				{
+					$data[$name] = $this->validate_property($value, $this->object_config[$name]);
+				}
+			}
+
 			$sql = 'UPDATE ' . $this->sql_table . '
 				SET ' . $this->db->sql_build_array('UPDATE', $data) . '
 				WHERE attachment_id = ' . $this->get_id();

assets/javascript/ajax.js

@@ -16,6 +16,7 @@
 use phpbb\files\upload;
 use phpbb\request\request_interface;
 use phpbb\titania\access;
+use phpbb\titania\unicode;
 use phpbb\titania\ext;
 
 class uploader
@@ -260,6 +261,16 @@ public function upload_file()
 			return false;
 		}
 
+		if (unicode::contains_unsupported($file->get('uploadname')))
+		{
+			$file->error[] = $this->user->lang('INVALID_FILENAME', $file->get('uploadname'));
+			$file->remove();
+			$this->filedata['error'] = array_merge($this->filedata['error'], $file->error);
+			$this->filedata['post_attach'] = false;
+
+			return false;
+		}
+
 		// Set max file size for anyone but team members.
 		if (!$this->access->is_team())
 		{

attachment/attachment.php

@@ -180,16 +180,17 @@ public function dump_include($name, array $packages, $subdir = '')
 	/**
 	 * Get include files.
 	 *
+	 * @param string $subdir Optional subdirectory
 	 * @return Finder
 	 */
-	protected function get_include_files()
+	protected function get_include_files($subdir = '')
 	{
 		$finder = new Finder;
 		$finder
 			->files()
 			->depth('== 0')
 			->name('/^packages\-[a-z]+\-\d+\.json$/')
-			->in($this->build_dir)
+			->in($this->build_dir . $subdir)
 		;
 
 		return $finder;
@@ -215,7 +216,7 @@ protected function build_parents()
 	 */
 	protected function build_parent_structure($subdir = '')
 	{
-		$includes = $this->get_include_files();
+		$includes = $this->get_include_files($subdir);
 		$parent = $types = array();
 		$target_dir = $this->build_dir . $subdir;
 

attachment/uploader.php

@@ -184,7 +184,7 @@ public function set_default_config()
 				'30'	=> array('latest_revision' => '14', 'name' => 'phpBB 3.0.x', 'allow_uploads' => false),
 				'31'	=> array('latest_revision' => '12', 'name' => 'phpBB 3.1.x', 'allow_uploads' => false),
 				'32'	=> array('latest_revision' => '11', 'name' => 'phpBB 3.2.x', 'allow_uploads' => false),
-				'33'	=> array('latest_revision' => '17', 'name' => 'phpBB 3.3.x', 'allow_uploads' => true),
+				'33'	=> array('latest_revision' => '18', 'name' => 'phpBB 3.3.x', 'allow_uploads' => true),
 			)),
 
 			// MPV server(s)

composer/repository.php

@@ -77,9 +77,9 @@ protected function configure()
 				'explain'	=> 'REVISION_BBCODE_USE_EXPLAIN',
 			),
 			'revision_bbc_help_line' => array(
-				'type'		=> 'input',
+				'type'		=> 'textarea',
 				'name'		=> 'REVISION_HELP_LINE',
-				'explain'	=> '',
+				'explain'	=> 'REVISION_HELP_LINE_EXPLAIN',
 			),
 			'revision_bbc_demo' => array(
 				'type'		=> 'textarea',

config/config.php

@@ -18,6 +18,7 @@
 use phpbb\titania\attachment\attachment;
 use phpbb\titania\config\config as ext_config;
 use phpbb\titania\contribution\type\base;
+use phpbb\titania\unicode;
 use phpbb\titania\entity\package;
 use phpbb\user;
 
@@ -216,7 +217,7 @@ public function epv_test(\titania_contribution $contrib, \titania_revision $revi
 	public function validate_ext_name($name)
 	{
 		return (bool) preg_match(
-			'#^[a-zA-Z0-9\x7f-\xff]{2,}/[a-zA-Z0-9\x7f-\xff]{2,}$#',
+			'#^[a-zA-Z0-9\x{007F}-\x{FFFF}]{2,}/[a-zA-Z0-9\x{007F}-\x{FFFF}]{2,}$#u',
 			$name
 		);
 	}
@@ -283,10 +284,10 @@ protected function repack(package $package, \titania_contribution $contrib, \tit
 		$data = $this->update_phpbb_requirement($data, $revision);
 		$data = $this->set_version_check($data, $contrib);
 
-		$data = json_encode(
+		$data = unicode::escape_json(json_encode(
 			$data,
 			JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE
-		);
+		));
 
 		file_put_contents($composer_file, $data);
 		$package->restore_root($ext_base_path, $ext_name);