CHANGELOG.md

@@ -1,5 +1,13 @@
 # Contao core bundle change log
 
+### 4.4.1 (2017-07-12)
+
+ * Prevent arbitrary PHP file inclusions in the back end (see CVE-2017-10993).
+ * Correctly handle subpalettes in "edit multiple" mode (see #946). 
+ * Correctly show the DCA picker in the site structure (see #906).
+ * Correctly update the style sheets if a format definition is enabled/disabled (see #893).
+ * Always show the "show from" and "show until" fields (see #908).
+
 ### 4.4.0 (2017-06-15)
 
  * Fix the "save and go back" function (see #870).

DEPRECATED.md

@@ -326,7 +326,7 @@ Contao 4.0 and will no longer be supported in Contao 5.0. Add the DCA files
 with your modifications to the `app/Resources/contao/dca` folder instead.
 
 
-#### initconfig.php
+### initconfig.php
 
 Using the `initconfig.php` file to customize the initialization process is
 deprecated in Contao 4.0 and will no longer be supported in Contao 5.0.

UPGRADE.md

@@ -390,3 +390,10 @@ In Contao 3, the user files in the `files/` directory were publicly available
 via HTTP by default and it was possible to protect certain subfolders. Now, due
 to a technical change, the user files are protected by default and subfolders
 have to be published explicitly to be available via HTTP.
+
+
+### Article CSS IDs
+
+In Contao 3, the alias of an article was automatically used as its CSS ID, if
+no custom CSS ID was defined. In Contao 4 the default CSS ID will be generated
+from its numeric ID, e.g. `article-1`.

composer.json

@@ -10,7 +10,7 @@
         }
     ],
     "require": {
-        "php": ">=5.6.0",
+        "php": "^5.6|^7.0",
         "ext-dom": "*",
         "ext-gd": "*",
         "ext-pcre": "*",
@@ -38,7 +38,6 @@
         "patchwork/utf8": "^1.2",
         "phpspec/php-diff": "^1.0",
         "phpunit/php-token-stream": "^1.4",
-        "php-http/guzzle6-adapter": "^1.1",
         "psr/log": "^1.0",
         "simplepie/simplepie": "^1.3",
         "tecnickcom/tcpdf": "^6.0",
@@ -80,6 +79,7 @@
         "lexik/maintenance-bundle": "^2.0",
         "monolog/monolog": "^1.22",
         "phpunit/phpunit": "^5.0",
+        "php-http/guzzle6-adapter": "^1.1",
         "php-http/message-factory": "^1.0.2",
         "satooshi/php-coveralls": "^1.0",
         "symfony/phpunit-bridge": "^3.2"

src/Controller/BackendCsvImportController.php

@@ -190,7 +190,7 @@ private function importFromTemplate(callable $callback, $table, $field, $id, $su
             );
 
             $response = new RedirectResponse($this->getBackUrl($request));
-            $response->headers->setCookie(new Cookie('BE_PAGE_OFFSET', 0, 0));
+            $response->headers->setCookie(new Cookie('BE_PAGE_OFFSET', 0, 0, $request->getBasePath(), null, false, false));
 
             return $response;
         }

src/Cors/WebsiteRootsConfigProvider.php

@@ -11,6 +11,7 @@
 namespace Contao\CoreBundle\Cors;
 
 use Doctrine\DBAL\Connection;
+use Doctrine\DBAL\Exception\ConnectionException;
 use Nelmio\CorsBundle\Options\ProviderInterface;
 use Symfony\Component\HttpFoundation\Request;
 
@@ -41,7 +42,7 @@ public function __construct(Connection $connection)
      */
     public function getOptions(Request $request)
     {
-        if (!$this->hasOrigin($request) || !$this->canRunDbQuery()) {
+        if (!$this->isCorsRequest($request) || !$this->canRunDbQuery()) {
             return [];
         }
 
@@ -67,18 +68,24 @@ public function getOptions(Request $request)
      *
      * @return bool
      */
-    private function hasOrigin(Request $request)
+    private function isCorsRequest(Request $request)
     {
-        return $request->headers->has('Origin') && '' !== $request->headers->get('Origin');
+        return $request->headers->has('Origin')
+            && $request->headers->get('Origin') !== $request->getSchemeAndHttpHost()
+        ;
     }
 
     /**
-     * Checks if the database connection and the table exist.
+     * Checks if a database connection can be established and the table exist.
      *
      * @return bool
      */
     private function canRunDbQuery()
     {
-        return $this->connection->isConnected() && $this->connection->getSchemaManager()->tablesExist(['tl_page']);
+        try {
+            return $this->connection->isConnected() && $this->connection->getSchemaManager()->tablesExist(['tl_page']);
+        } catch (ConnectionException $e) {
+            return false;
+        }
     }
 }

src/EventListener/CommandSchedulerListener.php

@@ -14,6 +14,7 @@
 use Contao\CoreBundle\Framework\ContaoFrameworkInterface;
 use Contao\FrontendCron;
 use Doctrine\DBAL\Connection;
+use Doctrine\DBAL\Exception\ConnectionException;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Event\PostResponseEvent;
 
@@ -77,8 +78,21 @@ private function canRunController(Request $request)
         return $config->isComplete()
             && !$config->get('disableCron')
             && in_array($request->attributes->get('_route'), ['contao_backend', 'contao_frontend'], true)
-            && $this->connection->isConnected()
-            && $this->connection->getSchemaManager()->tablesExist(['tl_cron'])
+            && $this->canRunDbQuery()
         ;
     }
+
+    /**
+     * Checks if a database connection can be established and the table exist.
+     *
+     * @return bool
+     */
+    private function canRunDbQuery()
+    {
+        try {
+            return $this->connection->isConnected() && $this->connection->getSchemaManager()->tablesExist(['tl_cron']);
+        } catch (ConnectionException $e) {
+            return false;
+        }
+    }
 }

src/Resources/contao/classes/Ajax.php

@@ -405,7 +405,7 @@ public function executePostActions(DataContainer $dc)
 
 						if (\Input::post('load'))
 						{
-							echo $dc->editAll($this->strAjaxId, \Input::post('id'));
+							throw new ResponseException($this->convertToResponse($dc->editAll($this->strAjaxId, \Input::post('id'))));
 						}
 					}
 					else

src/Resources/contao/classes/Backend.php

@@ -318,6 +318,12 @@ protected function getBackendModule($module)
 			throw new AccessDeniedException('Back end module "' . $module . '" is not allowed for user "' . $this->User->username . '".');
 		}
 
+		// The module does not exist
+		if (empty($arrModule))
+		{
+			throw new \InvalidArgumentException('Back end module "' . $module . '" is not defined in the BE_MOD array');
+		}
+
 		/** @var SessionInterface $objSession */
 		$objSession = \System::getContainer()->get('session');
 

src/Resources/contao/classes/BackendUser.php

@@ -484,15 +484,7 @@ public function navigation($blnShowAll=false)
 				$arrModules[$strGroupName]['label'] = (($label = is_array($GLOBALS['TL_LANG']['MOD'][$strGroupName]) ? $GLOBALS['TL_LANG']['MOD'][$strGroupName][0] : $GLOBALS['TL_LANG']['MOD'][$strGroupName]) != false) ? $label : $strGroupName;
 				$arrModules[$strGroupName]['href'] = $router->generate('contao_backend', array('do'=>\Input::get('do'), 'mtg'=>$strGroupName, 'ref'=>TL_REFERER_ID));
 				$arrModules[$strGroupName]['ajaxUrl'] = $router->generate('contao_backend');
-				$arrModules[$strGroupName]['isClosed'] = false;
-
-				// Do not show the modules if the group is closed
-				if (!$blnShowAll && isset($session['backend_modules'][$strGroupName]) && $session['backend_modules'][$strGroupName] < 1)
-				{
-					$arrModules[$strGroupName]['class'] = ' node-collapsed';
-					$arrModules[$strGroupName]['title'] = \StringUtil::specialchars($GLOBALS['TL_LANG']['MSC']['expandNode']);
-					$arrModules[$strGroupName]['isClosed'] = true;
-				}
+				$arrModules[$strGroupName]['icon'] = 'modPlus.gif'; // backwards compatibility with e.g. EasyThemes
 
 				foreach ($arrGroupModules as $strModuleName=>$arrModuleConfig)
 				{
@@ -505,13 +497,6 @@ public function navigation($blnShowAll=false)
 						$arrModules[$strGroupName]['modules'][$strModuleName]['class'] = 'navigation ' . $strModuleName;
 						$arrModules[$strGroupName]['modules'][$strModuleName]['href'] = $router->generate('contao_backend', array('do'=>$strModuleName, 'ref'=>TL_REFERER_ID));
 						$arrModules[$strGroupName]['modules'][$strModuleName]['isActive'] = false;
-
-						// Mark the active module and its group
-						if (\Input::get('do') == $strModuleName)
-						{
-							$arrModules[$strGroupName]['class'] .= ' trail';
-							$arrModules[$strGroupName]['modules'][$strModuleName]['isActive'] = true;
-						}
 					}
 				}
 			}
@@ -523,7 +508,33 @@ public function navigation($blnShowAll=false)
 			foreach ($GLOBALS['TL_HOOKS']['getUserNavigation'] as $callback)
 			{
 				$this->import($callback[0]);
-				$arrModules = $this->{$callback[0]}->{$callback[1]}($arrModules, $blnShowAll);
+				$arrModules = $this->{$callback[0]}->{$callback[1]}($arrModules, true);
+			}
+		}
+
+		foreach ($arrModules as $strGroupName => $arrGroupModules)
+		{
+			$arrModules[$strGroupName]['isClosed'] = false;
+
+			// Do not show the modules if the group is closed
+			if (!$blnShowAll && isset($session['backend_modules'][$strGroupName]) && $session['backend_modules'][$strGroupName] < 1)
+			{
+				$arrModules[$strGroupName]['class'] = str_replace('node-expanded', '', $arrModules[$strGroupName]['class']) . ' node-collapsed';
+				$arrModules[$strGroupName]['title'] = \StringUtil::specialchars($GLOBALS['TL_LANG']['MSC']['expandNode']);
+				$arrModules[$strGroupName]['isClosed'] = true;
+			}
+
+			if (isset($arrGroupModules['modules']) && is_array($arrGroupModules['modules']))
+			{
+				foreach ($arrGroupModules['modules'] as $strModuleName => $arrModuleConfig)
+				{
+					// Mark the active module and its group
+					if (\Input::get('do') == $strModuleName)
+					{
+						$arrModules[$strGroupName]['class'] .= ' trail';
+						$arrModules[$strGroupName]['modules'][$strModuleName]['isActive'] = true;
+					}
+				}
 			}
 		}
 

src/Resources/contao/classes/DataContainer.php

@@ -136,6 +136,18 @@ abstract class DataContainer extends \Backend
 	 */
 	protected $arrPickerValue = array();
 
+	/**
+	 * The picker field type
+	 * @var string
+	 */
+	protected $strPickerFieldType;
+
+	/**
+	 * True if a new version has to be created
+	 * @var boolean
+	 */
+	protected $blnCreateNewVersion = false;
+
 
 	/**
 	 * Set an object property
@@ -151,7 +163,11 @@ public function __set($strKey, $varValue)
 				$this->objActiveRecord = $varValue;
 				break;
 
-			default;
+			case 'createNewVersion':
+				$this->blnCreateNewVersion = (bool) $varValue;
+				break;
+
+			default:
 				$this->$strKey = $varValue; // backwards compatibility
 				break;
 		}
@@ -196,6 +212,10 @@ public function __get($strKey)
 			case 'activeRecord':
 				return $this->objActiveRecord;
 				break;
+
+			case 'createNewVersion':
+				return $this->blnCreateNewVersion;
+				break;
 		}
 
 		return parent::__get($strKey);
@@ -886,60 +906,21 @@ protected function initPicker()
 
 		\Controller::loadDataContainer($this->strPickerTable);
 
-		$this->setPickerValue();
-
-		$strDriver = 'DC_' . $GLOBALS['TL_DCA'][$this->strPickerTable]['config']['dataContainer'];
-		$objDca = new $strDriver($this->strPickerTable);
-		$objDca->id = $this->intPickerId;
-		$objDca->field = $this->strPickerField;
-
-		// Set the active record
-		if ($this->intPickerId && $this->Database->tableExists($this->strPickerTable))
-		{
-			/** @var Model $strModel */
-			$strModel = \Model::getClassFromTable($this->strPickerTable);
-
-			if (class_exists($strModel))
-			{
-				$objModel = $strModel::findByPk($this->intPickerId);
-
-				if ($objModel !== null)
-				{
-					$objDca->activeRecord = $objModel;
-				}
-			}
-		}
-
-		// Call the load_callback
-		if (is_array($GLOBALS['TL_DCA'][$this->strPickerTable]['fields'][$this->strPickerField]['load_callback']))
-		{
-			foreach ($GLOBALS['TL_DCA'][$this->strPickerTable]['fields'][$this->strPickerField]['load_callback'] as $callback)
-			{
-				if (is_array($callback))
-				{
-					$this->import($callback[0]);
-					$this->arrPickerValue = $this->{$callback[0]}->{$callback[1]}($this->arrPickerValue, $objDca);
-				}
-				elseif (is_callable($callback))
-				{
-					$this->arrPickerValue = $callback($this->arrPickerValue, $objDca);
-				}
-			}
-		}
-
 		if (!isset($GLOBALS['TL_DCA'][$this->strPickerTable]['fields'][$this->strPickerField]))
 		{
 			throw new InternalServerErrorException('Target field "' . $this->strPickerTable . '.' . $this->strPickerField . '" does not exist.');
 		}
 
+		$this->setPickerValue();
+
 		/** @var Widget $strClass */
 		$strClass = $GLOBALS['BE_FFL'][$GLOBALS['TL_DCA'][$this->strPickerTable]['fields'][$this->strPickerField]['inputType']];
 
-		/** @var Widget $objWidget */
-		$objWidget = new $strClass($strClass::getAttributesFromDca($GLOBALS['TL_DCA'][$this->strPickerTable]['fields'][$this->strPickerField], $this->strPickerField, $this->arrPickerValue, $this->strPickerField, $this->strPickerTable, $objDca));
-
-		if ($objWidget instanceof DcaFilterInterface)
+		if (is_a($strClass, DcaFilterInterface::class, true))
 		{
+			/** @var DcaFilterInterface $objWidget */
+			$objWidget = new $strClass($strClass::getAttributesFromDca($GLOBALS['TL_DCA'][$this->strPickerTable]['fields'][$this->strPickerField], $this->strPickerField, $this->arrPickerValue, $this->strPickerField, $this->strPickerTable));
+
 			$this->setDcaFilter($objWidget->getDcaFilter());
 		}
 
@@ -981,6 +962,11 @@ protected function setDcaFilter($arrFilter)
 		{
 			$GLOBALS['TL_DCA'][$this->strTable]['list']['sorting']['root'] = $arrFilter['root'];
 		}
+
+		if (isset($arrFilter['fieldType']))
+		{
+			$this->strPickerFieldType = $arrFilter['fieldType'];
+		}
 	}
 
 
@@ -1012,7 +998,7 @@ protected function getPickerInputField($value, $attributes='')
 	{
 		$id = is_numeric($value) ? $value : md5($value);
 
-		switch ($GLOBALS['TL_DCA'][$this->strPickerTable]['fields'][$this->strPickerField]['eval']['fieldType'])
+		switch ($this->strPickerFieldType)
 		{
 			case 'checkbox':
 				return ' <input type="checkbox" name="'.$this->strPickerField.'[]" id="'.$this->strPickerField.'_'.$id.'" class="tl_tree_checkbox" value="'.\StringUtil::specialchars($value).'" onfocus="Backend.getScrollOffset()"'.\Widget::optionChecked($value, $this->arrPickerValue).$attributes.'>';
@@ -1032,6 +1018,7 @@ protected function getPickerInputField($value, $attributes='')
 	 */
 	abstract public function getPalette();
 
+
 	/**
 	 * Save the current value
 	 *

src/Resources/contao/classes/PurgeData.php

@@ -44,7 +44,7 @@ public function run()
 		/** @var BackendTemplate|object $objTemplate */
 		$objTemplate = new \BackendTemplate('be_purge_data');
 		$objTemplate->isActive = $this->isActive();
-		$objTemplate->message = \Message::generateUnwrapped();
+		$objTemplate->message = \Message::generateUnwrapped(__CLASS__);
 
 		// Run the jobs
 		if (\Input::post('FORM_SUBMIT') == 'tl_purge')
@@ -64,7 +64,7 @@ public function run()
 				}
 			}
 
-			\Message::addConfirmation($GLOBALS['TL_LANG']['tl_maintenance']['cacheCleared']);
+			\Message::addConfirmation($GLOBALS['TL_LANG']['tl_maintenance']['cacheCleared'], __CLASS__);
 			$this->reload();
 		}