mbirth/LuckyCoinkydink
1
0
Fork 0
Code Issues Pull Requests Activity

Sync changes

Browse Source
This commit is contained in:
Garvin Hicking 2016-11-28 15:34:10 +01:00
parent dc3eb1e735
commit e2a665e13b
4 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
docs/NEWS
View File

@ -1,9 +1,12 @@
Version 2.1 () Version 2.1 (November 28th, 2016)
------------------------------------------------------------------------ ------------------------------------------------------------------------
* [Security] Enhanced media upload check to also check redirects * [Security] Enhanced media upload check to also check redirects
for local files, thanks to Xu Yue (again!) for local files, thanks to Xu Yue (again!)
* [Security] Prevent XSS in adding category and directory names,
thanks to Edric Teo @smarterbitbybit.
Version 2.1-beta2 (September 26th, 2016) Version 2.1-beta2 (September 26th, 2016)
------------------------------------------------------------------------ ------------------------------------------------------------------------
* Improved backend accessibility by hiding iconfont icons for * Improved backend accessibility by hiding iconfont icons for

2
include/admin/images.inc.php
View File

@ -550,7 +550,7 @@ switch ($serendipity['GET']['adminAction']) {
/* TODO: check if directory already exist */ /* TODO: check if directory already exist */
if (is_dir($nd) || @mkdir($nd)) { if (is_dir($nd) || @mkdir($nd)) {
$data['print_DIRECTORY_CREATED'] = sprintf(DIRECTORY_CREATED, $serendipity['POST']['name']); $data['print_DIRECTORY_CREATED'] = sprintf(DIRECTORY_CREATED, $new_dir);
@umask(0000); @umask(0000);
@chmod($serendipity['serendipityPath'] . $serendipity['uploadPath'] . $new_dir, 0777); @chmod($serendipity['serendipityPath'] . $serendipity['uploadPath'] . $new_dir, 0777);

2
serendipity_config.inc.php
View File

@ -47,7 +47,7 @@ if (defined('USE_MEMSNAP')) {
} }
// The version string // The version string
$serendipity['version'] = '2.1-beta2'; $serendipity['version'] = '2.1-beta3';
// Setting this to 'false' will enable debugging output. All alpha/beta/cvs snapshot versions will emit debug information by default. To increase the debug level (to enable Smarty debugging), set this flag to 'debug'. // Setting this to 'false' will enable debugging output. All alpha/beta/cvs snapshot versions will emit debug information by default. To increase the debug level (to enable Smarty debugging), set this flag to 'debug'.

4
templates/2k11/admin/category.inc.tpl
View File

@ -54,7 +54,7 @@
<div id="category_basics" class="clearfix"> <div id="category_basics" class="clearfix">
<div class="form_field"> <div class="form_field">
<label for="category_name">{$CONST.NAME}</label> <label for="category_name">{$CONST.NAME}</label>
<input id="category_name" pattern="{if $new}^(?!({foreach $categories as $cat}{$cat.category_name}|{/foreach})$).*{else}^(?!({foreach $categories as $cat}{if $this_cat.category_name != $cat.category_name}{$cat.category_name}{/if}|{/foreach})$).*{/if}" name="serendipity[cat][name]" type="text" value="{$this_cat.category_name|default:""|escape}" title="Categoryname"> <input id="category_name" pattern="{if $new}^(?!({foreach $categories as $cat}{$cat.category_name|escape}|{/foreach})$).*{else}^(?!({foreach $categories as $cat}{if $this_cat.category_name != $cat.category_name}{$cat.category_name|escape}{/if}|{/foreach})$).*{/if}" name="serendipity[cat][name]" type="text" value="{$this_cat.category_name|default:""|escape}" title="{$CONST.CATEGORY}">
</div> </div>
<div class="form_field"> <div class="form_field">
@ -74,7 +74,7 @@
<option value="0"{if $cid == 0} selected{/if}>{$CONST.NO_CATEGORY}</option> <option value="0"{if $cid == 0} selected{/if}>{$CONST.NO_CATEGORY}</option>
{foreach $categories as $cat} {foreach $categories as $cat}
{if $cat.categoryid == $cid}{continue}{/if} {if $cat.categoryid == $cid}{continue}{/if}
<option value="{$cat.categoryid}"{if $this_cat.parentid == $cat.categoryid} selected{/if}>{for $i=1 to $cat.depth}&nbsp{/for} {$cat.category_name}</option> <option value="{$cat.categoryid}"{if $this_cat.parentid == $cat.categoryid} selected{/if}>{for $i=1 to $cat.depth}&nbsp{/for} {$cat.category_name|escape}</option>
{/foreach} {/foreach}
</select> </select>
</div> </div>