From da95d1bb1e2f64f919466e0cee1313184feb2d28 Mon Sep 17 00:00:00 2001 From: Matias Griese Date: Thu, 13 Sep 2018 17:31:11 +0300 Subject: [PATCH 1/4] Session expires in 30 mins independent from config settings (https://github.com/getgrav/grav-plugin-login/issues/178) --- CHANGELOG.md | 1 + system/src/Grav/Framework/Session/Session.php | 8 +++++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 77e958a0f..611b3ca18 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ * Fix for `Page::translatedLanguages()` to use routes always [#2163](https://github.com/getgrav/grav/issues/2163) * Fixed `nicetime()` twig function * Allow twig tags `{% script %}`, `{% style %}` and `{% switch %}` to be placed outside of blocks + * Session expires in 30 mins independent from config settings [login#178](https://github.com/getgrav/grav-plugin-login/issues/178) # v1.5.1 ## 08/23/2018 diff --git a/system/src/Grav/Framework/Session/Session.php b/system/src/Grav/Framework/Session/Session.php index 3c2a417e1..c060345a5 100644 --- a/system/src/Grav/Framework/Session/Session.php +++ b/system/src/Grav/Framework/Session/Session.php @@ -14,6 +14,8 @@ namespace Grav\Framework\Session; */ class Session implements SessionInterface { + protected $options; + /** * @var bool */ @@ -182,7 +184,10 @@ class Session implements SessionInterface unset($_COOKIE[session_name()]); } - $options = $readonly ? ['read_and_close' => '1'] : []; + $options = $this->options; + if ($readonly) { + $options['read_and_close'] = '1'; + } $success = @session_start($options); if (!$success) { @@ -335,6 +340,7 @@ class Session implements SessionInterface $value = (string)$value; } + $this->options[$key] = $value; ini_set($key, $value); } } From 8295bd8243e91ed16158da5245c261d07f4dd8cf Mon Sep 17 00:00:00 2001 From: Matias Griese Date: Wed, 19 Sep 2018 12:06:49 +0300 Subject: [PATCH 2/4] Added `Utils::detectXssFromArray()` and `Utils::detectXss()` methods --- CHANGELOG.md | 1 + system/src/Grav/Common/Utils.php | 84 ++++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 611b3ca18..7bc0d630a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,7 @@ 1. [](#new) * Added `Deprecated` tab to DebugBar to catch future incompatibilities with later Grav versions * Added deprecation notices for features which will be removed in Grav 2.0 + * Added `Utils::detectXssFromArray()` and `Utils::detectXss()` methods 1. [](#bugfix) * Allow `$page->slug()` to be called before `$page->init()` without breaking the page * Fix for `Page::translatedLanguages()` to use routes always [#2163](https://github.com/getgrav/grav/issues/2163) diff --git a/system/src/Grav/Common/Utils.php b/system/src/Grav/Common/Utils.php index 5de4fe7b1..53c67e7ab 100644 --- a/system/src/Grav/Common/Utils.php +++ b/system/src/Grav/Common/Utils.php @@ -253,6 +253,90 @@ abstract class Utils return $date_formats; } + /** + * @param array $array Array such as $_POST or $_GET + * @param string $prefix Prefix for returned values. + * @return array Returns flatten list of potentially dangerous input values, such as 'data.content'. + */ + public static function detectXssFromArray(array $array, $prefix = '') + { + $list = []; + + foreach ($array as $key => $value) { + if (\is_array($value)) { + $list[] = static::detectXssFromArray($value, $prefix . $key . '.'); + } + if (static::detectXss($value)) { + $list[] = [$prefix . $key]; + } + } + + return array_merge(...$list); + } + + /** + * Determine if string potentially has a XSS attack. This simple function does not catch all XSS and it is likely to + * return false positives because of it tags all potentially dangerous HTML tags and attributes without looking into + * their content. + * + * @param string $string The string to run XSS detection logic on + * @return boolean True if the given `$string` may contain XSS, false otherwise. + * + * Copies the code from: https://github.com/symphonycms/xssfilter/blob/master/extension.driver.php#L138 + */ + public static function detectXss($string) + { + // Skip any null or non string values + if (null === $string || !\is_string($string) || empty($string)) { + return false; + } + + // Keep a copy of the original string before cleaning up + $orig = $string; + + // URL decode + $string = urldecode($string); + + // Convert Hexadecimals + $string = (string)preg_replace_callback('!(&#|\\\)[xX]([0-9a-fA-F]+);?!u', function($m) { + return \chr(hexdec($m[2])); + }, $string); + + // Clean up entities + $string = preg_replace('!(�+[0-9]+)!u','$1;', $string); + + // Decode entities + $string = html_entity_decode($string, ENT_NOQUOTES, 'UTF-8'); + + // Strip whitespace characters + $string = preg_replace('!\s!u','', $string); + + // Set the patterns we'll test against + $patterns = [ + // Match any attribute starting with "on" or xmlns + '#(<[^>]+[\x00-\x20\"\'\/])(on|xmlns)[^>]*>?#iUu', + + // Match javascript:, livescript:, vbscript:, mocha:, feed: and data: protocols + '!((java|live|vb)script|mocha|feed|data):(\w)*!iUu', + + // Match -moz-bindings + '#-moz-binding[\x00-\x20]*:#u', + + // Match style attributes + '#(<[^>]+[\x00-\x20\"\'\/])style=[^>]*>?#iUu', + + // Match potentially dangerous tags + '#]*>?#ui' + ]; + + foreach ($patterns as $pattern) { + // Test both the original string and clean string + if (preg_match($pattern, $string) || preg_match($pattern, $orig)) { + return true; + } + } + return false; + } /** * Truncate text by number of characters but can cut off words. * From ca8805683d4af07048651928b58602244fdcc073 Mon Sep 17 00:00:00 2001 From: Matias Griese Date: Wed, 19 Sep 2018 12:09:32 +0300 Subject: [PATCH 3/4] Added `onHttpPostFilter` event to allow plugins to globally clean up XSS in the forms and tasks --- CHANGELOG.md | 1 + system/src/Grav/Common/Uri.php | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7bc0d630a..9c6c08018 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ * Added `Deprecated` tab to DebugBar to catch future incompatibilities with later Grav versions * Added deprecation notices for features which will be removed in Grav 2.0 * Added `Utils::detectXssFromArray()` and `Utils::detectXss()` methods + * Added `onHttpPostFilter` event to allow plugins to globally clean up XSS in the forms and tasks 1. [](#bugfix) * Allow `$page->slug()` to be called before `$page->init()` without breaking the page * Fix for `Page::translatedLanguages()` to use routes always [#2163](https://github.com/getgrav/grav/issues/2163) diff --git a/system/src/Grav/Common/Uri.php b/system/src/Grav/Common/Uri.php index 35e9d3b3f..9ce2d423d 100644 --- a/system/src/Grav/Common/Uri.php +++ b/system/src/Grav/Common/Uri.php @@ -15,6 +15,7 @@ use Grav\Common\Page\Pages; use Grav\Framework\Route\RouteFactory; use Grav\Framework\Uri\UriFactory; use Grav\Framework\Uri\UriPartsFilter; +use RocketTheme\Toolbox\Event\Event; class Uri { @@ -1284,6 +1285,9 @@ class Uri } elseif (!empty($_POST)) { $this->post = (array)$_POST; } + + $event = new Event(['post' => &$this->post]); + Grav::instance()->fireEvent('onHttpPostFilter', $event); } if ($this->post && null !== $element) { From 51f29e112af6cd69433c88a26b7f64ea70e3879b Mon Sep 17 00:00:00 2001 From: Andy Miller Date: Wed, 19 Sep 2018 13:56:09 -0600 Subject: [PATCH 4/4] updated composer.json --- composer.json | 1 + 1 file changed, 1 insertion(+) diff --git a/composer.json b/composer.json index fbd5106f7..5a5c6a80c 100644 --- a/composer.json +++ b/composer.json @@ -32,6 +32,7 @@ "ext-openssl": "*", "ext-curl": "*", "ext-zip": "*", + "ext-json": "*", "league/climate": "^3.2", "antoligy/dom-string-iterators": "^1.0", "miljar/php-exif": "^0.6.3",