Skip to content

Commit

Permalink
Fixed XSS vulnerability in save.php #342 reported by https://github.c…
Browse files Browse the repository at this point in the history
…om/Hebing123 updated Bootstrap to 5.3.3
  • Loading branch information
givanz committed Mar 11, 2024
1 parent c6422cf commit c0c0545
Show file tree
Hide file tree
Showing 16 changed files with 60 additions and 42 deletions.
2 changes: 1 addition & 1 deletion demo/landing
Submodule landing updated 89 files
+4 −4 about.html
+4 −4 blank.html
+2 −2 blocks/blocks.js
+4 −4 cart/cart.html
+8 −4 checkout/checkout.html
+6 −6 checkout/confirm.html
+4 −4 checkout/order.html
+5 −5 contact.html
+5 −5 content/archive.html
+5 −5 content/category.html
+5 −5 content/index.html
+4 −4 content/page.html
+4 −4 content/post-image-header.html
+4 −4 content/post-image-hero.html
+4 −4 content/post.html
+5 −5 content/tag.html
+5 −5 content/user.html
+18 −31 css/admin-post-editor.css
+18 −32 css/style.bundle.css
+18 −31 css/style.css
+4 −4 download.html
+4 −4 email/order/new.html
+3 −3 email/order/new.txt.html
+2 −2 email/user/reset.html
+2 −2 email/user/reset.txt.html
+5 −5 email/user/signup.html
+5 −5 email/user/signup.txt.html
+4 −4 error404.html
+4 −4 error500.html
+4 −4 index-blog.html
+5 −5 index-excerpts.html
+4 −4 index-no-sidebar.html
+4 −4 index.coming-soon.html
+14 −14 index.html
+4 −4 index.maintenance.html
+4 −4 portfolio.html
+4 −4 pricing.html
+231 −40 product/category.html
+231 −40 product/index.html
+231 −40 product/manufacturer.html
+4 −4 product/product.html
+231 −40 product/vendor.html
+11 −11 scss/bootstrap/_accordion.scss
+9 −0 scss/bootstrap/_buttons.scss
+2 −10 scss/bootstrap/_carousel.scss
+0 −1 scss/bootstrap/_modal.scss
+1 −4 scss/bootstrap/_offcanvas.scss
+1 −1 scss/bootstrap/_tables.scss
+7 −3 scss/bootstrap/_variables.scss
+1 −1 scss/bootstrap/forms/_form-check.scss
+2 −2 scss/bootstrap/mixins/_banner.scss
+12 −2 scss/bootstrap/mixins/_forms.scss
+1 −1 scss/bootstrap/mixins/_grid.scss
+7 −0 scss/bootstrap/tests/mixins/_auto-import-of-variables-dark.test.scss
+1 −1 scss/bootstrap/tests/mixins/_utilities.test.scss
+1 −1 scss/sections/hero/hero-3.scss
+5 −5 search/index.html
+19 −19 sections/sections.js
+4 −4 services.html
+1 −1 src/_includes/sidebar.html
+1 −1 src/_includes/top-menu.html
+2 −0 src/checkout/_payment.html
+2 −0 src/checkout/_shipping.html
+1 −1 src/checkout/confirm.html
+1 −1 src/contact.html
+4 −4 src/email/order/new.html
+3 −3 src/email/order/new.txt.html
+2 −2 src/email/user/reset.html
+2 −2 src/email/user/reset.txt.html
+5 −5 src/email/user/signup.html
+5 −5 src/email/user/signup.txt.html
+2 −2 src/sections/contact-form/contact-form-6.html
+3 −3 src/sections/navigation/navigation-1.html
+3 −3 src/sections/navigation/navigation-3.html
+11 −11 src/sections/showcase/showcase-3.html
+4 −4 user/address.html
+4 −4 user/address/edit.html
+4 −4 user/comments.html
+4 −4 user/downloads.html
+4 −4 user/edit.html
+4 −4 user/index.html
+4 −4 user/login.html
+4 −4 user/order.html
+4 −4 user/orders.html
+4 −4 user/profile.html
+4 −4 user/reset.html
+4 −4 user/reset/reset.html
+4 −4 user/return-form.html
+4 −4 user/signup.html
6 changes: 3 additions & 3 deletions js/bootstrap.min.js

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion save.php
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ function validOembedUrl($url) {
}

if (isset($_GET['action'])) {
$action = $_GET['action'];
$action = htmlspecialchars(strip_tags($_GET['action']));
}

if ($action) {
Expand Down
22 changes: 11 additions & 11 deletions scss/bootstrap/_accordion.scss
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@
--#{$prefix}accordion-btn-icon-transform: #{$accordion-icon-transform};
--#{$prefix}accordion-btn-icon-transition: #{$accordion-icon-transition};
--#{$prefix}accordion-btn-active-icon: #{escape-svg($accordion-button-active-icon)};
--#{$prefix}accordion-btn-focus-border-color: #{$accordion-button-focus-border-color};
--#{$prefix}accordion-btn-focus-box-shadow: #{$accordion-button-focus-box-shadow};
--#{$prefix}accordion-body-padding-x: #{$accordion-body-padding-x};
--#{$prefix}accordion-body-padding-y: #{$accordion-body-padding-y};
Expand Down Expand Up @@ -74,7 +73,6 @@

&:focus {
z-index: 3;
border-color: var(--#{$prefix}accordion-btn-focus-border-color);
outline: 0;
box-shadow: var(--#{$prefix}accordion-btn-focus-box-shadow);
}
Expand All @@ -92,7 +90,7 @@
&:first-of-type {
@include border-top-radius(var(--#{$prefix}accordion-border-radius));

.accordion-button {
> .accordion-header .accordion-button {
@include border-top-radius(var(--#{$prefix}accordion-inner-border-radius));
}
}
Expand All @@ -105,13 +103,13 @@
&:last-of-type {
@include border-bottom-radius(var(--#{$prefix}accordion-border-radius));

.accordion-button {
> .accordion-header .accordion-button {
&.collapsed {
@include border-bottom-radius(var(--#{$prefix}accordion-inner-border-radius));
}
}

.accordion-collapse {
> .accordion-collapse {
@include border-bottom-radius(var(--#{$prefix}accordion-border-radius));
}
}
Expand All @@ -127,24 +125,26 @@
// Remove borders and border-radius to keep accordion items edge-to-edge.

.accordion-flush {
.accordion-collapse {
border-width: 0;
}

.accordion-item {
> .accordion-item {
border-right: 0;
border-left: 0;
@include border-radius(0);

&:first-child { border-top: 0; }
&:last-child { border-bottom: 0; }

.accordion-button {
// stylelint-disable selector-max-class
> .accordion-header .accordion-button {
&,
&.collapsed {
@include border-radius(0);
}
}
// stylelint-enable selector-max-class

> .accordion-collapse {
@include border-radius(0);
}
}
}

Expand Down
9 changes: 9 additions & 0 deletions scss/bootstrap/_buttons.scss
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,15 @@
}
}

.btn-check:checked:focus-visible + & {
// Avoid using mixin so we can pass custom focus shadow properly
@if $enable-shadows {
box-shadow: var(--#{$prefix}btn-active-shadow), var(--#{$prefix}btn-focus-box-shadow);
} @else {
box-shadow: var(--#{$prefix}btn-focus-box-shadow);
}
}

&:disabled,
&.disabled,
fieldset:disabled & {
Expand Down
12 changes: 2 additions & 10 deletions scss/bootstrap/_carousel.scss
Original file line number Diff line number Diff line change
Expand Up @@ -132,19 +132,11 @@
background-size: 100% 100%;
}

/* rtl:options: {
"autoRename": true,
"stringMap":[ {
"name" : "prev-next",
"search" : "prev",
"replace" : "next"
} ]
} */
.carousel-control-prev-icon {
background-image: escape-svg($carousel-control-prev-icon-bg);
background-image: escape-svg($carousel-control-prev-icon-bg) #{"/*rtl:" + escape-svg($carousel-control-next-icon-bg) + "*/"};
}
.carousel-control-next-icon {
background-image: escape-svg($carousel-control-next-icon-bg);
background-image: escape-svg($carousel-control-next-icon-bg) #{"/*rtl:" + escape-svg($carousel-control-prev-icon-bg) + "*/"};
}

// Optional indicator pips/controls
Expand Down
1 change: 0 additions & 1 deletion scss/bootstrap/_modal.scss
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,6 @@
display: flex;
flex-shrink: 0;
align-items: center;
justify-content: space-between; // Put modal header elements (title and dismiss) on opposite ends
padding: var(--#{$prefix}modal-header-padding);
border-bottom: var(--#{$prefix}modal-header-border-width) solid var(--#{$prefix}modal-header-border-color);
@include border-top-radius(var(--#{$prefix}modal-inner-border-radius));
Expand Down
5 changes: 1 addition & 4 deletions scss/bootstrap/_offcanvas.scss
Original file line number Diff line number Diff line change
Expand Up @@ -123,14 +123,11 @@
.offcanvas-header {
display: flex;
align-items: center;
justify-content: space-between;
padding: var(--#{$prefix}offcanvas-padding-y) var(--#{$prefix}offcanvas-padding-x);

.btn-close {
padding: calc(var(--#{$prefix}offcanvas-padding-y) * .5) calc(var(--#{$prefix}offcanvas-padding-x) * .5);
margin-top: calc(-.5 * var(--#{$prefix}offcanvas-padding-y));
margin-right: calc(-.5 * var(--#{$prefix}offcanvas-padding-x));
margin-bottom: calc(-.5 * var(--#{$prefix}offcanvas-padding-y));
margin: calc(-.5 * var(--#{$prefix}offcanvas-padding-y)) calc(-.5 * var(--#{$prefix}offcanvas-padding-x)) calc(-.5 * var(--#{$prefix}offcanvas-padding-y)) auto;
}
}

Expand Down
2 changes: 1 addition & 1 deletion scss/bootstrap/_tables.scss
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@
//
// When borders are added on all sides of the cells, the corners can render odd when
// these borders do not have the same color or if they are semi-transparent.
// Therefor we add top and border bottoms to the `tr`s and left and right borders
// Therefore we add top and border bottoms to the `tr`s and left and right borders
// to the `td`s or `th`s

.table-bordered {
Expand Down
10 changes: 7 additions & 3 deletions scss/bootstrap/_variables.scss
Original file line number Diff line number Diff line change
Expand Up @@ -1383,7 +1383,9 @@ $accordion-transition: $btn-transition, border-radius .15s ea
$accordion-button-active-bg: var(--#{$prefix}primary-bg-subtle) !default;
$accordion-button-active-color: var(--#{$prefix}primary-text-emphasis) !default;

$accordion-button-focus-border-color: $input-focus-border-color !default;
// fusv-disable
$accordion-button-focus-border-color: $input-focus-border-color !default; // Deprecated in v5.3.3
// fusv-enable
$accordion-button-focus-box-shadow: $btn-focus-box-shadow !default;

$accordion-icon-width: 1.25rem !default;
Expand All @@ -1392,8 +1394,8 @@ $accordion-icon-active-color: $primary-text-emphasis !default;
$accordion-icon-transition: transform .2s ease-in-out !default;
$accordion-icon-transform: rotate(-180deg) !default;

$accordion-button-icon: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='#{$accordion-icon-color}'><path fill-rule='evenodd' d='M1.646 4.646a.5.5 0 0 1 .708 0L8 10.293l5.646-5.647a.5.5 0 0 1 .708.708l-6 6a.5.5 0 0 1-.708 0l-6-6a.5.5 0 0 1 0-.708z'/></svg>") !default;
$accordion-button-active-icon: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='#{$accordion-icon-active-color}'><path fill-rule='evenodd' d='M1.646 4.646a.5.5 0 0 1 .708 0L8 10.293l5.646-5.647a.5.5 0 0 1 .708.708l-6 6a.5.5 0 0 1-.708 0l-6-6a.5.5 0 0 1 0-.708z'/></svg>") !default;
$accordion-button-icon: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='none' stroke='#{$accordion-icon-color}' stroke-linecap='round' stroke-linejoin='round'><path d='M2 5L8 11L14 5'/></svg>") !default;
$accordion-button-active-icon: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='none' stroke='#{$accordion-icon-active-color}' stroke-linecap='round' stroke-linejoin='round'><path d='M2 5L8 11L14 5'/></svg>") !default;
// scss-docs-end accordion-variables

// Tooltips
Expand Down Expand Up @@ -1745,3 +1747,5 @@ $kbd-bg: var(--#{$prefix}body-color) !default;
$nested-kbd-font-weight: null !default; // Deprecated in v5.2.0, removing in v6

$pre-color: null !default;

@import "variables-dark"; // TODO: can be removed safely in v6, only here to avoid breaking changes in v5.3
2 changes: 1 addition & 1 deletion scss/bootstrap/forms/_form-check.scss
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@
margin-left: $form-switch-padding-start * -1;
background-image: var(--#{$prefix}form-switch-bg);
background-position: left center;
@include border-radius($form-switch-border-radius);
@include border-radius($form-switch-border-radius, 0);
@include transition($form-switch-transition);

&:focus {
Expand Down
4 changes: 2 additions & 2 deletions scss/bootstrap/mixins/_banner.scss
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
@mixin bsBanner($file) {
/*!
* Bootstrap #{$file} v5.3.2 (https://getbootstrap.com/)
* Copyright 2011-2023 The Bootstrap Authors
* Bootstrap #{$file} v5.3.3 (https://getbootstrap.com/)
* Copyright 2011-2024 The Bootstrap Authors
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
*/
}
14 changes: 12 additions & 2 deletions scss/bootstrap/mixins/_forms.scss
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,12 @@

&:focus {
border-color: $border-color;
box-shadow: $focus-box-shadow;
@if $enable-shadows {
@include box-shadow($input-box-shadow, $focus-box-shadow);
} @else {
// Avoid using mixin so we can pass custom focus shadow properly
box-shadow: $focus-box-shadow;
}
}
}
}
Expand Down Expand Up @@ -100,7 +105,12 @@

&:focus {
border-color: $border-color;
box-shadow: $focus-box-shadow;
@if $enable-shadows {
@include box-shadow($form-select-box-shadow, $focus-box-shadow);
} @else {
// Avoid using mixin so we can pass custom focus shadow properly
box-shadow: $focus-box-shadow;
}
}
}
}
Expand Down
2 changes: 1 addition & 1 deletion scss/bootstrap/mixins/_grid.scss
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@
}
}

// Start with `1` because `0` is and invalid value.
// Start with `1` because `0` is an invalid value.
// Ends with `$columns - 1` because offsetting by the width of an entire row isn't possible.
@for $i from 1 through ($columns - 1) {
.g-start#{$infix}-#{$i} {
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
// TODO: this file can be removed safely in v6 when `@import "variables-dark"` will be removed at the end of _variables.scss

@import "../../functions";
@import "../../variables";
// Voluntarily not importing _variables-dark.scss
@import "../../maps";
@import "../../mixins";
2 changes: 1 addition & 1 deletion scss/bootstrap/tests/mixins/_utilities.test.scss
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,7 @@ $enable-important-utilities: false;
.desaturated-color-blue {
--bs-color-opacity: 1;
// Sass compilation will put a leading zero so we want to keep that one
// stylelint-disable-next-line stylistic/number-leading-zero
// stylelint-disable-next-line @stylistic/number-leading-zero
--bs-color-saturation: 0.25;
color: hsla(192deg, var(--bs-color-saturation), 0, var(--bs-color-opacity));
}
Expand Down

0 comments on commit c0c0545

Please sign in to comment.