/** * Processes a raw template for conditionals, phrases etc into PHP code for eval() * * @param string Template * * @return string */ function compile_template($template, &$errors = array()) { $orig_template = $template; $template = preg_replace('#[\\x00-\\x08\\x0B\\x0C\\x0E-\\x1F]#', '', $template); $new_syntax = (strpos($template, '<vb:') !== false OR strpos($template, '{vb:') !== false); $old_syntax = (strpos($template, '<if') !== false OR strpos($template, '<phrase') !== false); $maybe_old_syntax = preg_match('/(^|[^{])\$[a-z0-9_]+\[?/si', $template); if (!$new_syntax AND ($old_syntax OR $maybe_old_syntax)) { $template = addslashes($template); $template = process_template_conditionals($template); $template = process_template_phrases('phrase', $template, 'parse_phrase_tag'); $template = process_seo_urls($template); if (!function_exists('replace_template_variables') OR !function_exists('validate_string_for_interpolation')) { require_once(DIR . '/includes/functions_misc.php'); } //only check the old style syntax, the new style doesn't use string interpolation and isn't affected //by this exploit. The new syntax doesn't 100% pass this check. if(!validate_string_for_interpolation($template)) { global $vbphrase; echo "<p> </p><p> </p>"; print_form_header('', '', 0, 1, '', '65%'); print_table_header($vbphrase['vbulletin_message']); print_description_row($vbphrase['template_text_not_safe']); print_table_footer(2, construct_button_code($vbphrase['go_back'], 'javascript:history.back(1)')); print_cp_footer(); exit; } $template = replace_template_variables($template, false); $template = str_replace('\\\\$', '\\$', $template); if (function_exists('token_get_all')) { $tokens = @token_get_all('<?php $var = "' . $template . '"; ?>'); foreach ($tokens AS $token) { if (is_array($token)) { switch ($token[0]) { case T_INCLUDE: case T_INCLUDE_ONCE: case T_REQUIRE: case T_REQUIRE_ONCE: { global $vbphrase; echo "<p> </p><p> </p>"; print_form_header('', '', 0, 1, '', '65%'); print_table_header($vbphrase['vbulletin_message']); print_description_row($vbphrase['file_inclusion_not_permitted']); print_table_footer(2, construct_button_code($vbphrase['go_back'], 'javascript:history.back(1)')); print_cp_footer(); exit; } } } } } } else { require_once(DIR . '/includes/class_template_parser.php'); $parser = new vB_TemplateParser($orig_template); try { $parser->validate($errors); } catch (vB_Exception_TemplateFatalError $e) { global $vbphrase; echo "<p> </p><p> </p>"; print_form_header('', '', 0, 1, '', '65%'); print_table_header($vbphrase['vbulletin_message']); print_description_row($vbphrase[$e->getMessage()]); print_table_footer(2, construct_button_code($vbphrase['go_back'], 'javascript:history.back(1)')); print_cp_footer(); exit; } $template = $parser->compile(); // TODO: Reimplement these - if done, $session[], $bbuserinfo[], $vboptions will parse in the template without using {vb:raw, which isn't what we // necessarily want to happen /* if (!function_exists('replace_template_variables')) { require_once(DIR . '/includes/functions_misc.php'); } $template = replace_template_variables($template, false); */ } if (function_exists('verify_demo_template')) { verify_demo_template($template); } ($hook = vBulletinHook::fetch_hook('template_compile')) ? eval($hook) : false; return $template; }
/** * Imports a language from a language XML file * * @param string XML language string * @param integer Language to overwrite * @param string Override title for imported language * @param boolean Allow import of language from mismatched vBulletin version * @param boolean Allow user-select of imported language * @param boolean Echo output.. * @param boolean Read charset from XML header */ function xml_import_language($xml = false, $languageid = -1, $title = '', $anyversion = false, $userselect = true, $output = true, $readcharset = false) { global $vbulletin, $vbphrase; print_dots_start('<b>' . $vbphrase['importing_language'] . "</b>, {$vbphrase['please_wait']}", ':', 'dspan'); require_once DIR . '/includes/class_xml.php'; require_once DIR . '/includes/functions_misc.php'; $xmlobj = new vB_XML_Parser($xml, $GLOBALS['path'], $readcharset); if ($xmlobj->error_no == 1) { print_dots_stop(); print_stop_message('no_xml_and_no_path'); } else { if ($xmlobj->error_no == 2) { print_dots_stop(); print_stop_message('please_ensure_x_file_is_located_at_y', 'vbulletin-language.xml', $GLOBALS['path']); } } if (!($arr =& $xmlobj->parse())) { print_dots_stop(); print_stop_message('xml_error_x_at_line_y', $xmlobj->error_string(), $xmlobj->error_line()); } if (!$arr['phrasetype']) { print_dots_stop(); print_stop_message('invalid_file_specified'); } $title = empty($title) ? $arr['name'] : $title; $version = $arr['vbversion']; $master = $arr['type'] == 'master' ? 1 : 0; $just_phrases = $arr['type'] == 'phrases' ? 1 : 0; if (!empty($arr['settings'])) { $langinfo = $arr['settings']; } $langinfo['product'] = empty($arr['product']) ? 'vbulletin' : $arr['product']; // look for skipped groups $skipped_groups = array(); if (!empty($arr['skippedgroups'])) { $skippedgroups =& $arr['skippedgroups']['skippedgroup']; if (!is_array($skippedgroups[0])) { $skippedgroups = array($skippedgroups); } foreach ($skippedgroups as $skipped) { if (is_array($skipped)) { $skipped_groups[] = $vbulletin->db->escape_string($skipped['value']); } else { $skipped_groups[] = $vbulletin->db->escape_string($skipped); } } } if ($skipped_groups) { $sql_skipped = "AND " . TABLE_PREFIX . "phrase.fieldname NOT IN ('" . implode("', '", $skipped_groups) . "')"; } else { $sql_skipped = ''; } foreach ($langinfo as $key => $val) { $langinfo["{$key}"] = $vbulletin->db->escape_string(trim($val)); } $langinfo['options'] = intval($langinfo['options']); if ($version != $vbulletin->options['templateversion'] and !$anyversion and !$master) { print_dots_stop(); print_stop_message('upload_file_created_with_different_version', $vbulletin->options['templateversion'], $version); } //set up the phrase array $arr = $arr['phrasetype']; if (!is_array($arr[0])) { $arr = array($arr); } //spin through the phrases to check validity. We want to do this *before* we prep for import //so that if we abort do to an error, we haven't made any changes first foreach (array_keys($arr) as $key) { $phraseTypes =& $arr["{$key}"]; foreach ($phraseTypes['phrase'] as $phrase) { if (!validate_string_for_interpolation($phrase['value'])) { print_dots_stop(); print_stop_message('phrase_text_not_safe', $phrase['name']); } } } // prepare for import if ($master) { // lets stop it from dieing cause someone borked a previous update $vbulletin->db->query_write("DELETE FROM " . TABLE_PREFIX . "phrase WHERE languageid = -10"); // master style if ($output and VB_AREA != 'Install' and VB_AREA != 'Upgrade') { echo "<h3>{$vbphrase['master_language']}</h3>\n<p>{$vbphrase['please_wait']}</p>"; vbflush(); } $vbulletin->db->query_write("\n\t\t\tUPDATE " . TABLE_PREFIX . "phrase SET\n\t\t\t\tlanguageid = -10\n\t\t\tWHERE languageid = -1\n\t\t\t\tAND (product = '" . $vbulletin->db->escape_string($langinfo['product']) . "'" . iif($langinfo['product'] == 'vbulletin', " OR product = ''") . ")\n\t\t\t\t{$sql_skipped}\n\t\t"); $languageid = -1; } else { if ($languageid == 0) { // creating a new language if ($just_phrases) { print_dots_stop(); print_stop_message('language_only_phrases', $title); } else { if ($test = $vbulletin->db->query_first("SELECT languageid FROM " . TABLE_PREFIX . "language WHERE title = '" . $vbulletin->db->escape_string($title) . "'")) { print_dots_stop(); print_stop_message('language_already_exists', $title); } else { echo "<h3><b>" . construct_phrase($vbphrase['creating_a_new_language_called_x'], $title) . "</b></h3>\n<p>{$vbphrase['please_wait']}</p>"; vbflush(); /*insert query*/ $vbulletin->db->query_write("\n\t\t\t\t\tINSERT INTO " . TABLE_PREFIX . "language (\n\t\t\t\t\t\ttitle, options, languagecode, charset,\n\t\t\t\t\t\tdateoverride, timeoverride, decimalsep, thousandsep,\n\t\t\t\t\t\tregistereddateoverride, calformat1override, calformat2override, locale, logdateoverride\n\t\t\t\t\t) VALUES (\n\t\t\t\t\t\t'" . $vbulletin->db->escape_string($title) . "', {$langinfo['options']}, '{$langinfo['languagecode']}', '{$langinfo['charset']}',\n\t\t\t\t\t\t'{$langinfo['dateoverride']}', '{$langinfo['timeoverride']}', '{$langinfo['decimalsep']}', '{$langinfo['thousandsep']}',\n\t\t\t\t\t\t'{$langinfo['registereddateoverride']}', '{$langinfo['calformat1override']}', '{$langinfo['calformat2override']}', '{$langinfo['locale']}', '{$langinfo['logdateoverride']}'\n\t\t\t\t\t)\n\t\t\t\t"); $languageid = $vbulletin->db->insert_id(); } } } else { // overwriting an existing language if ($getlanguage = $vbulletin->db->query_first("SELECT title FROM " . TABLE_PREFIX . "language WHERE languageid = {$languageid}")) { if (!$just_phrases) { echo "<h3><b>" . construct_phrase($vbphrase['overwriting_language_x'], $getlanguage['title']) . "</b></h3>\n<p>{$vbphrase['please_wait']}</p>"; vbflush(); $vbulletin->db->query_write("\n\t\t\t\t\t\tUPDATE " . TABLE_PREFIX . "language SET\n\t\t\t\t\t\t\toptions = {$langinfo['options']},\n\t\t\t\t\t\t\tlanguagecode = '{$langinfo['languagecode']}',\n\t\t\t\t\t\t\tcharset = '{$langinfo['charset']}',\n\t\t\t\t\t\t\tlocale = '{$langinfo['locale']}',\n\t\t\t\t\t\t\timagesoverride = '{$langinfo['imagesoverride']}',\n\t\t\t\t\t\t\tdateoverride = '{$langinfo['dateoverride']}',\n\t\t\t\t\t\t\ttimeoverride = '{$langinfo['timeoverride']}',\n\t\t\t\t\t\t\tdecimalsep = '{$langinfo['decimalsep']}',\n\t\t\t\t\t\t\tthousandsep = '{$langinfo['thousandsep']}',\n\t\t\t\t\t\t\tregistereddateoverride = '{$langinfo['registereddateoverride']}',\n\t\t\t\t\t\t\tcalformat1override = '{$langinfo['calformat1override']}',\n\t\t\t\t\t\t\tcalformat2override = '{$langinfo['calformat2override']}',\n\t\t\t\t\t\t\tlogdateoverride = '{$langinfo['logdateoverride']}'\n\t\t\t\t\t\tWHERE languageid = {$languageid}\n\t\t\t\t\t"); $vbulletin->db->query_write("\n\t\t\t\t\t\tUPDATE " . TABLE_PREFIX . "phrase, " . TABLE_PREFIX . "phrase AS phrase2\n\t\t\t\t\t\tSET " . TABLE_PREFIX . "phrase.languageid = -11\n\t\t\t\t\t\tWHERE " . TABLE_PREFIX . "phrase.languageid = {$languageid}\n\t\t\t\t\t\t\tAND (" . TABLE_PREFIX . "phrase.product = '" . $vbulletin->db->escape_string($langinfo['product']) . "'" . iif($langinfo['product'] == 'vbulletin', " OR " . TABLE_PREFIX . "phrase.product = ''") . ")\n\t\t\t\t\t\t\tAND (phrase2.product = '" . $vbulletin->db->escape_string($langinfo['product']) . "'" . iif($langinfo['product'] == 'vbulletin', " OR phrase2.product = ''") . ")\n\t\t\t\t\t\t\tAND " . TABLE_PREFIX . "phrase.varname = phrase2.varname\n\t\t\t\t\t\t\tAND phrase2.languageid = 0\n\t\t\t\t\t\t\tAND " . TABLE_PREFIX . "phrase.fieldname = phrase2.fieldname\n\t\t\t\t\t\t\t{$sql_skipped}\n\t\t\t\t\t"); $vbulletin->db->query_write("\n\t\t\t\t\t\tUPDATE " . TABLE_PREFIX . "phrase SET\n\t\t\t\t\t\t\tlanguageid = -10\n\t\t\t\t\t\tWHERE languageid = {$languageid}\n\t\t\t\t\t\t\tAND (product = '" . $vbulletin->db->escape_string($langinfo['product']) . "'" . iif($langinfo['product'] == 'vbulletin', " OR product = ''") . ")\n\t\t\t\t\t\t\t{$sql_skipped}\n\t\t\t\t\t"); } } else { print_stop_message('cant_overwrite_non_existent_language'); } } } // get current phrase types $current_phrasetypes = fetch_phrasetypes_array(false); if (!$master) { $globalPhrases = array(); $getphrases = $vbulletin->db->query_read("\n\t\t\tSELECT varname, fieldname\n\t\t\tFROM " . TABLE_PREFIX . "phrase\n\t\t\tWHERE languageid IN (0, -1)\n\t\t"); while ($getphrase = $vbulletin->db->fetch_array($getphrases)) { $globalPhrases["{$getphrase['varname']}~{$getphrase['fieldname']}"] = true; } } // import language // track new phrasetypes $new_phrasetypes = array(); foreach (array_keys($arr) as $key) { $phraseTypes =& $arr["{$key}"]; $sql = array(); $strlen = 0; if ($phraseTypes['fieldname'] == '' or !preg_match('#^[a-z0-9_]+$#i', $phraseTypes['fieldname'])) { continue; } $fieldname = $phraseTypes['fieldname']; if (!is_array($phraseTypes['phrase'][0])) { $phraseTypes['phrase'] = array($phraseTypes['phrase']); } // check if the phrasetype is new if (!isset($current_phrasetypes[$fieldname]) and !empty($phraseTypes['phrase'])) { $new_phrasetypes[] = array('fieldname' => $fieldname, 'title' => $phraseTypes['name']); } // Send some output to the browser inside this loop so certain hosts // don't artificially kill the script. See bug #34585 if ($output) { echo ' '; vbflush(); } foreach ($phraseTypes['phrase'] as $phrase) { if ($master) { $insertLanguageId = -1; } else { if (!isset($globalPhrases["{$phrase['name']}~{$fieldname}"])) { $insertLanguageId = 0; } else { if ($phrase['custom']) { // this is a custom phrase (language 0) -- we don't want it to end up in the custom language continue; } else { $insertLanguageId = $languageid; } } } $sql[] = "\n\t\t\t\t({$insertLanguageId},\n\t\t\t\t'" . $vbulletin->db->escape_string($fieldname) . "',\n\t\t\t\t'" . $vbulletin->db->escape_string($phrase['name']) . "',\n\t\t\t\t'" . $vbulletin->db->escape_string($phrase['value']) . "',\n\t\t\t\t'" . $vbulletin->db->escape_string($langinfo['product']) . "',\n\t\t\t\t'" . $vbulletin->db->escape_string($phrase['username']) . "',\n\t\t\t\t" . intval($phrase['date']) . ",\n\t\t\t\t'" . $vbulletin->db->escape_string($phrase['version']) . "')\n\t\t\t"; $strlen += strlen(end($sql)); if ($strlen > 102400) { // insert max of 100k of phrases at a time /*insert query*/ $vbulletin->db->query_write("\n\t\t\t\t\tREPLACE INTO " . TABLE_PREFIX . "phrase\n\t\t\t\t\t\t(languageid, fieldname, varname, text, product, username, dateline, version)\n\t\t\t\t\tVALUES\n\t\t\t\t\t\t" . implode(",\n", $sql)); $sql = array(); $strlen = 0; } // Send some output to the browser inside this loop so certain hosts // don't artificially kill the script. See bug #34585 if ($output) { echo ' '; vbflush(); } } if ($sql) { /*insert query*/ $vbulletin->db->query_write("\n\t\t\t\tREPLACE INTO " . TABLE_PREFIX . "phrase\n\t\t\t\t\t(languageid, fieldname, varname, text, product, username, dateline, version)\n\t\t\t\tVALUES\n\t\t\t\t\t" . implode(",\n", $sql)); } unset($arr["{$key}"], $phraseTypes); } unset($sql, $arr, $current_phrasetypes); // insert any new phrasetypes foreach ($new_phrasetypes as $phrasetype) { add_phrase_type($phrasetype['fieldname'], $phrasetype['title'], $langinfo['product']); } $vbulletin->db->query_write("\n\t\tUPDATE IGNORE " . TABLE_PREFIX . "phrase\n\t\tSET " . TABLE_PREFIX . "phrase.languageid = {$languageid}\n\t\tWHERE " . TABLE_PREFIX . "phrase.languageid = -11\n\t\t\tAND (" . TABLE_PREFIX . "phrase.product = '" . $vbulletin->db->escape_string($langinfo['product']) . "'" . iif($langinfo['product'] == 'vbulletin', " OR " . TABLE_PREFIX . "phrase.product = ''") . ")\n\t\t\t{$sql_skipped}\n\t"); // now delete any phrases that were moved into the temporary language for safe-keeping $vbulletin->db->query_write("\n\t\tDELETE FROM " . TABLE_PREFIX . "phrase\n\t\tWHERE languageid IN (-10, -11)\n\t\t\tAND (product = '" . $vbulletin->db->escape_string($langinfo['product']) . "'" . iif($langinfo['product'] == 'vbulletin', " OR product = ''") . ")\n\t\t\t{$sql_skipped}\n\t"); print_dots_stop(); }
} // ############################################################################# if ($_POST['do'] == 'insert') { $vars = array('faq' => vB_Cleaner::TYPE_STR, 'faqparent' => vB_Cleaner::TYPE_STR, 'volatile' => vB_Cleaner::TYPE_INT, 'product' => vB_Cleaner::TYPE_STR, 'displayorder' => vB_Cleaner::TYPE_INT, 'title' => vB_Cleaner::TYPE_ARRAY_STR, 'text' => vB_Cleaner::TYPE_ARRAY_STR, 'deftitle' => vB_Cleaner::TYPE_STR, 'deftext' => vB_Cleaner::TYPE_STR); $vbulletin->input->clean_array_gpc('r', $vars); if ($vbulletin->GPC['deftitle'] == '') { print_stop_message2('invalid_title_specified'); } if (!preg_match('#^[a-z0-9_]+$#i', $vbulletin->GPC['faq'])) { print_stop_message2('invalid_faq_varname'); } if (!validate_string_for_interpolation($vbulletin->GPC['deftext'])) { print_stop_message2('faq_text_not_safe'); } foreach ($vbulletin->GPC['text'] as $text) { if (!validate_string_for_interpolation($text)) { print_stop_message2('faq_text_not_safe'); } } // ensure that the faq name is in 'word_word_word' format $fixedfaq = strtolower(preg_replace('#\\s+#s', '_', $vbulletin->GPC['faq'])); if ($fixedfaq !== $vbulletin->GPC['faq']) { print_form_header('faq', 'insert'); print_table_header($vbphrase['faq_link_name_changed']); print_description_row(construct_phrase($vbphrase['to_maintain_compatibility_with_the_system_name_changed'], $vbulletin->GPC['faq'], $fixedfaq)); print_input_row($vbphrase['varname'], 'faq', $fixedfaq); $vbulletin->GPC['faq'] = $fixedfaq; foreach (array_keys($vars) as $varname_outer) { $var &= $vbulletin->GPC[$varname_outer]; if (is_array($var)) { foreach ($var as $varname_inner => $value) {
/** * Add a new phrase or update an existing phrase * @param string $fieldname New Phrase Type for adding, old Phrase Type for editing * @param string $varname New Varname for adding, old Varname for editing * @param array $data Phrase data to be added or updated * 'text' => Phrase text array. * 'oldvarname' => Old varname for editing only * 'oldfieldname' => Old fieldname for editing only * 't' => * 'ismaster' => * 'product' => Product ID of the phrase * @return void */ public function save($fieldname, $varname, $data) { $fieldname = trim($fieldname); $varname = trim($varname); $vb5_config =& vB::getConfig(); $install = false; if (defined('VBINSTALL') and VBINSTALL) { $install = true; } $session = vB::getCurrentSession(); if (!empty($session)) { $userinfo = $session->fetch_userinfo(); } else { $userinfo = vB_User::fetchUserinfo(1); } require_once DIR . '/includes/adminfunctions.php'; $full_product_info = fetch_product_list(true); if (empty($varname)) { throw new vB_Exception_Api('please_complete_required_fields'); } if (!preg_match('#^[' . self::VALID_CLASS . ']+$#', $varname)) { throw new vB_Exception_Api('invalid_phrase_varname'); } require_once DIR . '/includes/functions_misc.php'; foreach ($data['text'] as $text) { if (!validate_string_for_interpolation($text)) { throw new vB_Exception_Api('phrase_text_not_safe', array($varname)); } } // it's an update if (!empty($data['oldvarname']) and !empty($data['oldfieldname'])) { if (vB::getDbAssertor()->getField('phrase_fetchid', array(vB_dB_Query::TYPE_KEY => vB_dB_Query::QUERY_STORED, 'varname' => $varname))) { // Don't check if we are moving a phrase to another group but keeping the same name. See VBV-4192. if ($varname != $data['oldvarname'] and $fieldname != $data['oldfieldname']) { throw new vB_Exception_Api('there_is_already_phrase_named_x', array($varname)); } if ($varname != $data['oldvarname']) { throw new vB_Exception_Api('variable_name_exists', array($data['oldvarname'], $varname)); } } if (!is_array($data['oldfieldname'])) { $data['oldfieldname'] = array($data['oldfieldname']); } if (!in_array($fieldname, $data['oldfieldname'])) { $data['oldfieldname'][] = $fieldname; } // delete old phrases vB::getDbAssertor()->assertQuery('deleteOldPhrases', array('varname' => $data['oldvarname'], 'fieldname' => $data['oldfieldname'], 't' => $data['t'], 'debug' => empty($data['skipdebug']) && ($vb5_config['Misc']['debug'] or $install))); $update = 1; $this->setPhraseDate(); } if (empty($update)) { if (empty($data['text'][0]) and $data['text'][0] != '0' and !$data['t'] or empty($varname)) { throw new vB_Exception_Api('please_complete_required_fields'); } if (vB::getDbAssertor()->getField('phrase_fetchid', array('varname' => $varname, 'fieldname' => $fieldname))) { throw new vB_Exception_Api('there_is_already_phrase_named_x', array($varname)); } } if ($data['ismaster']) { if (($vb5_config['Misc']['debug'] or $install) and !$data['t']) { /*insert query*/ vB::getDbAssertor()->assertQuery('phrase', array(vB_dB_Query::TYPE_KEY => vB_dB_Query::QUERY_REPLACE, 'languageid' => -1, 'varname' => $varname, 'text' => $data['text'][0], 'fieldname' => $fieldname, 'product' => $data['product'], 'username' => $userinfo['username'], 'dateline' => vB::getRequest()->getTimeNow(), 'version' => $full_product_info[$data['product']]['version'])); } unset($data['text'][0]); } foreach ($data['text'] as $_languageid => $txt) { $_languageid = intval($_languageid); if (!empty($txt) or $txt == '0') { /*insert query*/ vB::getDbAssertor()->assertQuery('phrase', array(vB_dB_Query::TYPE_KEY => vB_dB_Query::QUERY_REPLACE, 'languageid' => $_languageid, 'varname' => $varname, 'text' => $txt, 'fieldname' => $fieldname, 'product' => $data['product'], 'username' => $userinfo['username'], 'dateline' => vB::getRequest()->getTimeNow(), 'version' => $full_product_info[$data['product']]['version'])); } } require_once DIR . '/includes/adminfunctions.php'; require_once DIR . '/includes/adminfunctions_language.php'; build_language(-1); }