MDL-64794 tcpdf: Bump to tcpdf 6.2.26

moodle · May 30, 2019 · 57b83a4 · 57b83a4
1 parent 794391b
commit 57b83a4
Show file tree

Hide file tree

Showing 11 changed files with 387 additions and 232 deletions.
diff --git a/lib/tcpdf/CHANGELOG.TXT b/lib/tcpdf/CHANGELOG.TXT
@@ -1,3 +1,18 @@
+6.2.25
+	- Fix support for image URLs.
+
+6.2.24
+	- Support remote urls when checking if file exists.
+
+6.2.23
+	- Simplify file_exists function.
+
+6.2.22
+	- Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data.
+
+6.2.19
+	- Merge various fixes for PHP 7.3 compatibility and security.
+
 6.2.13 (2016-06-10)
 	- IMPORTANT: A new version of this library is under development at https://github.com/tecnickcom/tc-lib-pdf and as a consequence this version will not receive any additional development or support. This version should be considered obsolete, new projects should use the new version as soon it will become stable.
 

diff --git a/lib/tcpdf/README.md b/lib/tcpdf/README.md
@@ -0,0 +1,84 @@
+# TCPDF
+*PHP PDF Library*
+
+[![Donate via PayPal](https://img.shields.io/badge/donate-paypal-87ceeb.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_donations&currency_code=GBP&business=paypal@tecnick.com&item_name=donation%20for%20TCPDF%20project)
+*Please consider supporting this project by making a donation via [PayPal](https://www.paypal.com/cgi-bin/webscr?cmd=_donations&currency_code=GBP&business=paypal@tecnick.com&item_name=donation%20for%20TCPDF%20project)*
+
+* **category**    Library
+* **author**      Nicola Asuni <info@tecnick.com>
+* **copyright**   2002-2018 Nicola Asuni - Tecnick.com LTD
+* **license**     http://www.gnu.org/copyleft/lesser.html GNU-LGPL v3 (see LICENSE.TXT)
+* **link**        http://www.tcpdf.org
+* **source**      https://github.com/tecnickcom/TCPDF
+
+
+## IMPORTANT
+A new version of this library is under development at https://github.com/tecnickcom/tc-lib-pdf and as a consequence this version will not receive any additional development or support.
+This version should be considered obsolete, new projects should use the new version as soon it will become stable.
+
+
+
+## Description
+
+PHP library for generating PDF documents on-the-fly.
+
+### Main Features:
+* no external libraries are required for the basic functions;
+* all standard page formats, custom page formats, custom margins and units of measure;
+* UTF-8 Unicode and Right-To-Left languages;
+* TrueTypeUnicode, OpenTypeUnicode v1, TrueType, OpenType v1, Type1 and CID-0 fonts;
+* font subsetting;
+* methods to publish some XHTML + CSS code, Javascript and Forms;
+* images, graphic (geometric figures) and transformation methods;
+* supports JPEG, PNG and SVG images natively, all images supported by GD (GD, GD2, GD2PART, GIF, JPEG, PNG, BMP, XBM, XPM) and all images supported via ImagMagick (http://www.imagemagick.org/script/formats.php)
+* 1D and 2D barcodes: CODE 39, ANSI MH10.8M-1983, USD-3, 3 of 9, CODE 93, USS-93, Standard 2 of 5, Interleaved 2 of 5, CODE 128 A/B/C, 2 and 5 Digits UPC-Based Extension, EAN 8, EAN 13, UPC-A, UPC-E, MSI, POSTNET, PLANET, RMS4CC (Royal Mail 4-state Customer Code), CBC (Customer Bar Code), KIX (Klant index - Customer index), Intelligent Mail Barcode, Onecode, USPS-B-3200, CODABAR, CODE 11, PHARMACODE, PHARMACODE TWO-TRACKS, Datamatrix, QR-Code, PDF417;
+* JPEG and PNG ICC profiles, Grayscale, RGB, CMYK, Spot Colors and Transparencies;
+* automatic page header and footer management;
+* document encryption up to 256 bit and digital signature certifications;
+* transactions to UNDO commands;
+* PDF annotations, including links, text and file attachments;
+* text rendering modes (fill, stroke and clipping);
+* multiple columns mode;
+* no-write page regions;
+* bookmarks, named destinations and table of content;
+* text hyphenation;
+* text stretching and spacing (tracking);
+* automatic page break, line break and text alignments including justification;
+* automatic page numbering and page groups;
+* move and delete pages;
+* page compression (requires php-zlib extension);
+* XOBject Templates;
+* Layers and object visibility.
+* PDF/A-1b support.
+
+### Third party fonts:
+
+This library may include third party font files released with different licenses.
+
+All the PHP files on the fonts directory are subject to the general TCPDF license (GNU-LGPLv3),
+they do not contain any binary data but just a description of the general properties of a particular font.
+These files can be also generated on the fly using the font utilities and TCPDF methods.
+
+All the original binary TTF font files have been renamed for compatibility with TCPDF and compressed using the gzcompress PHP function that uses the ZLIB data format (.z files).
+
+The binary files (.z) that begins with the prefix "free" have been extracted from the GNU FreeFont collection (GNU-GPLv3).
+The binary files (.z) that begins with the prefix "pdfa" have been derived from the GNU FreeFont, so they are subject to the same license.
+For the details of Copyright, License and other information, please check the files inside the directory fonts/freefont-20120503
+Link : http://www.gnu.org/software/freefont/
+
+The binary files (.z) that begins with the prefix "dejavu" have been extracted from the DejaVu fonts 2.33 (Bitstream) collection.
+For the details of Copyright, License and other information, please check the files inside the directory fonts/dejavu-fonts-ttf-2.33
+Link : http://dejavu-fonts.org
+
+The binary files (.z) that begins with the prefix "ae" have been extracted from the Arabeyes.org collection (GNU-GPLv2).
+Link : http://projects.arabeyes.org/
+
+### ICC profile:
+
+TCPDF includes the sRGB.icc profile from the icc-profiles-free Debian package:
+https://packages.debian.org/source/stable/icc-profiles-free
+
+
+## Developer(s) Contact
+
+* Nicola Asuni <info@tecnick.com>
diff --git a/lib/tcpdf/composer.json b/lib/tcpdf/composer.json
@@ -1,38 +1,46 @@
 {
-	"name": "tecnickcom/tcpdf",
-	"version": "6.2.13",
-	"homepage": "http://www.tcpdf.org/",
-	"type": "library",
-	"description": "TCPDF is a PHP class for generating PDF documents and barcodes.",
-	"keywords": ["PDF","tcpdf","PDFD32000-2008","qrcode","datamatrix","pdf417","barcodes"],
-	"license": "LGPLv3",
-	"authors": [
-	{
-		"name": "Nicola Asuni",
-		"email": "info@tecnick.com",
-		"homepage": "http://nicolaasuni.tecnick.com"
-	}
-	],
-	"require": {
-		"php": ">=5.3.0"
-	},
-	"autoload": {
-		"classmap": [
-		"config",
-		"include",
-		"tcpdf.php",
-		"tcpdf_parser.php",
-		"tcpdf_barcodes_1d.php",
-		"tcpdf_barcodes_2d.php",
-		"include/tcpdf_colors.php",
-		"include/tcpdf_filters.php",
-		"include/tcpdf_font_data.php",
-		"include/tcpdf_fonts.php",
-		"include/tcpdf_images.php",
-		"include/tcpdf_static.php",
-		"include/barcodes/datamatrix.php",
-		"include/barcodes/pdf417.php",
-		"include/barcodes/qrcode.php"
-		]
-	}
+  "name": "tecnickcom/tcpdf",
+  "version": "6.2.26",
+  "homepage": "http://www.tcpdf.org/",
+  "type": "library",
+  "description": "TCPDF is a PHP class for generating PDF documents and barcodes.",
+  "keywords": [
+    "PDF",
+    "tcpdf",
+    "PDFD32000-2008",
+    "qrcode",
+    "datamatrix",
+    "pdf417",
+    "barcodes"
+  ],
+  "license": "LGPL-3.0",
+  "authors": [
+    {
+      "name": "Nicola Asuni",
+      "email": "info@tecnick.com",
+      "role": "lead"
+    }
+  ],
+  "require": {
+    "php": ">=5.3.0"
+  },
+  "autoload": {
+    "classmap": [
+      "config",
+      "include",
+      "tcpdf.php",
+      "tcpdf_parser.php",
+      "tcpdf_barcodes_1d.php",
+      "tcpdf_barcodes_2d.php",
+      "include/tcpdf_colors.php",
+      "include/tcpdf_filters.php",
+      "include/tcpdf_font_data.php",
+      "include/tcpdf_fonts.php",
+      "include/tcpdf_images.php",
+      "include/tcpdf_static.php",
+      "include/barcodes/datamatrix.php",
+      "include/barcodes/pdf417.php",
+      "include/barcodes/qrcode.php"
+    ]
+  }
 }
diff --git a/lib/tcpdf/include/barcodes/pdf417.php b/lib/tcpdf/include/barcodes/pdf417.php
@@ -740,16 +740,6 @@ public function getBarcodeArray() {
 	 * @protected
 	 */
 	protected function getErrorCorrectionLevel($ecl, $numcw) {
-		// get maximum correction level
-		$maxecl = 8; // starting error level
-		$maxerrsize = (928 - $numcw); // available codewords for error
-		while ($maxecl > 0) {
-			$errsize = (2 << $ecl);
-			if ($maxerrsize >= $errsize) {
-				break;
-			}
-			--$maxecl;
-		}
 		// check for automatic levels
 		if (($ecl < 0) OR ($ecl > 8)) {
 			if ($numcw < 41) {
@@ -764,6 +754,16 @@ protected function getErrorCorrectionLevel($ecl, $numcw) {
 				$ecl = $maxecl;
 			}
 		}
+		// get maximum correction level
+		$maxecl = 8; // starting error level
+		$maxerrsize = (928 - $numcw); // available codewords for error
+		while ($maxecl > 0) {
+			$errsize = (2 << $ecl);
+			if ($maxerrsize >= $errsize) {
+				break;
+			}
+			--$maxecl;
+		}
 		if ($ecl > $maxecl) {
 			$ecl = $maxecl;
 		}

diff --git a/lib/tcpdf/include/sRGB.icc b/lib/tcpdf/include/sRGB.icc
diff --git a/lib/tcpdf/include/tcpdf_fonts.php b/lib/tcpdf/include/tcpdf_fonts.php
@@ -70,7 +70,7 @@ class TCPDF_FONTS {
 	 * @public static
 	 */
 	public static function addTTFfont($fontfile, $fonttype='', $enc='', $flags=32, $outpath='', $platid=3, $encid=1, $addcbbox=false, $link=false) {
-		if (!file_exists($fontfile)) {
+		if (!TCPDF_STATIC::file_exists($fontfile)) {
 			// Could not find file
 			return false;
 		}
@@ -95,7 +95,7 @@ public static function addTTFfont($fontfile, $fonttype='', $enc='', $flags=32, $
 			$outpath = self::_getfontpath();
 		}
 		// check if this font already exist
-		if (@file_exists($outpath.$font_name.'.php')) {
+		if (@TCPDF_STATIC::file_exists($outpath.$font_name.'.php')) {
 			// this font already exist (delete it from fonts folder to rebuild it)
 			return $font_name;
 		}
@@ -665,7 +665,7 @@ public static function addTTFfont($fontfile, $fonttype='', $enc='', $flags=32, $
 								$glyphIdArray[$k] = TCPDF_STATIC::_getUSHORT($font, $offset);
 								$offset += 2;
 							}
-							for ($k = 0; $k < $segCount; ++$k) {
+							for ($k = 0; $k < $segCount - 1; ++$k) {
 								for ($c = $startCount[$k]; $c <= $endCount[$k]; ++$c) {
 									if ($idRangeOffset[$k] == 0) {
 										$g = ($idDelta[$k] + $c) % 65536;
@@ -1543,11 +1543,11 @@ public static function _getfontpath() {
 	public static function getFontFullPath($file, $fontdir=false) {
 		$fontfile = '';
 		// search files on various directories
-		if (($fontdir !== false) AND @file_exists($fontdir.$file)) {
+		if (($fontdir !== false) AND @TCPDF_STATIC::file_exists($fontdir.$file)) {
 			$fontfile = $fontdir.$file;
-		} elseif (@file_exists(self::_getfontpath().$file)) {
+		} elseif (@TCPDF_STATIC::file_exists(self::_getfontpath().$file)) {
 			$fontfile = self::_getfontpath().$file;
-		} elseif (@file_exists($file)) {
+		} elseif (@TCPDF_STATIC::file_exists($file)) {
 			$fontfile = $file;
 		}
 		return $fontfile;
@@ -2003,7 +2003,11 @@ public static function UTF8StringToArray($str, $isunicode=true, &$currentfont) {
 			$chars = str_split($str);
 			$carr = array_map('ord', $chars);
 		}
-		$currentfont['subsetchars'] += array_fill_keys($carr, true);
+		if (is_array($currentfont['subsetchars']) && is_array($carr)) {
+			$currentfont['subsetchars'] += array_fill_keys($carr, true);
+		} else {
+			$currentfont['subsetchars'] = array_merge($currentfont['subsetchars'], $carr);
+		}
 		return $carr;
 	}
 

diff --git a/lib/tcpdf/include/tcpdf_images.php b/lib/tcpdf/include/tcpdf_images.php
@@ -161,12 +161,8 @@ public static function _toJPEG($image, $quality, $tempfile) {
 	 */
 	public static function _parsejpeg($file) {
 		// check if is a local file
-		if (!@file_exists($file)) {
-			// try to encode spaces on filename
-			$tfile = str_replace(' ', '%20', $file);
-			if (@file_exists($tfile)) {
-				$file = $tfile;
-			}
+		if (!@TCPDF_STATIC::file_exists($file)) {
+			return false;
 		}
 		$a = getimagesize($file);
 		if (empty($a)) {