phplist

NOTE:: Before reporting an issue, make sure you are running the latest version, currently 3.3.1


View Issue Details Jump to Notes ] Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0015363phplist applicationHTML Email Supportpublic11-11-09 19:1116-04-10 19:38
Reporterneffets 
PrioritynormalSeverityminorReproducibilityalways
StatusresolvedResolutionfixed 
PlatformSuse SLES10OSLinux x64OS Version2.2.10
Product Version 
Target Version2.10.12Fixed in Version2.10.12 
Summary0015363: addAbsoluteResources does not / or fails in matching schema
Descriptionfunction: addAbsoluteResources (lib.php line 533)

the preg_match cannot match because "[x|y|z]" is used instead of "(x|y|z)"
AND
after this it matched (a failure) on links to if "http" are in the link anywhere.

Imagine link:
   a href="/.bin/fwd.fcgi?http://www.b2b-deutschland.de/wirtschaftsnews/091110/duerftige-aussichten-fuer-arcandor-glaeubiger/index.php" [^]
It matched, but should not.

Result the url was not absolutized.

Attended result for website=www.b2b-deutschland.de should be:
  a href="http://www.b2b-deutschland.de/.bin/fwd.fcgi?http://www.b2b-deutschland.de/wirtschaftsnews/091110/duerftige-aussichten-fuer-arcandor-glaeubiger/index.php" [^]

Patch:

Steps To ReproduceTake a link with relative path for own link tracking and give it a parameter with a fully qualified uri.
e.g.
 a href="http://www.b2b-deutschland.de/.bin/fwd.fcgi?http://www.b2b-deutschland.de/wirtschaftsnews/091110/duerftige-aussichten-fuer-arcandor-glaeubiger/index.php" [^]
Additional InformationPatch lib.php
533c533
< if (preg_match("#[http|javascript|https|ftp|mailto]:#i",$match)) {
---
> if (preg_match("#^(http|javascript|https|ftp|mailto):#i",$match)) {
TagsNo tags attached.
Attached Filesdiff file icon patch_sts1.diff [^] (586 bytes) 11-11-09 19:11 [Show Content]

- Relationships

-  Notes
(0050776)
neffets (reporter)
12-11-09 10:47

ACHTUNG:
  version mentioned ist 2.10.10. the current release (not 2.2.10)


Copyright © 2000 - 2017 MantisBT Team
Powered by Mantis Bugtracker