2.3.9 patch does not work on 2.3.7

nocte

nocte

Well-known member
This is what i get on rebuild master data after uploading the patch files from https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/ to a XF 2.3.7 installation.

Code: 
user@web /home/forum/web $ php cmd.php xf:rebuild-master-data
PHP Fatal error:  Uncaught ErrorException: [E_WARNING] The use statement with non-compound name 'array_key_exists' has no effect in /home/forum/web/src/XF/Container.php:6
Stack trace:
#0 /home/forum/web/src/vendor/composer/ClassLoader.php(576): XF::handlePhpError(2, '...', '...', 6)
#1 /home/forum/web/src/vendor/composer/ClassLoader.php(576): include()
#2 /home/forum/web/src/vendor/composer/ClassLoader.php(427): Composer\Autoload\{closure}('...')
#3 /home/forum/web/src/XF.php(777): Composer\Autoload\ClassLoader->loadClass('...')
#4 /home/forum/web/src/XF.php(762): XF::setupApp('...')
#5 /home/forum/web/src/XF.php(248): XF::app()
#6 [internal function]: XF::handleException(Object(ErrorException))
#7 {main}
  thrown in /home/forum/web/src/XF/Container.php on line 6
 
Chris D said:
Yes please :)
Click to expand...
Done, kind of works. But now I get a huge amount of these errors:

Code: 
 Macro public:message_macros :: signature() error: Call to undefined method XF\Util\Url::getValidUrl()

:(

seems to be related to this:

K

Fixed Thread 'Method XF\BbCodeRenderer\Html::getValidUrl should be in a utility class'

Not really a bug, but a development annoyance that could be fixed easily:
Method XF\BbCodeRenderer\Html::getValidUrl can be useful in various places, but it's a protected method of the BB code renderer class.

It would be great if this was in a utility class instaead so it could be used everywhere.
 
Would adding this code to the class fix this:

Code: 
    /**
     * Returns a version of the passed in URL that is valid for use in a message or false
     * if the URL is definitively unusable. Note that this is distinct from the URL being valid
     * from an RFC perspective, as users may submit URLs that don't always have all components
     * URL encoded as needed. We generally defer to the browsers to handle this for us rather
     * than rejecting the URL.
     *
     * @param string $url
     * @param string|null $allowedProtocolRegex Regular expression for allowed protocols. Defaults to https?|ftp
     *
     * @return false|string
     */
    public static function getValidUrl(string $url, ?string $allowedProtocolRegex = null)
    {
        if ($allowedProtocolRegex === null)
        {
            $allowedProtocolRegex = '#^(https?|ftp)://#i';
        }

        $url = trim($url);

        if (preg_match('/proxy\.php\?\w+=(http[^&]+)&/i', $url, $match))
        {
            // proxy link of some sort, adjust to the original one
            $proxiedUrl = urldecode($match[1]);
            if (preg_match('/./su', $proxiedUrl))
            {
                $url = $proxiedUrl;
            }
        }

        if (preg_match('/^(\?|\/|#|:)/', $url))
        {
            return false;
        }

        if (strpos($url, "\n") !== false)
        {
            return false;
        }

        if (preg_match('#^(data|https?://data|javascript|about):#i', $url))
        {
            return false;
        }

        if (preg_match($allowedProtocolRegex, $url))
        {
            return $url;
        }

        return 'http://' . $url;
    }
}
 
The patch is for people who cannot upgrade, but if you can upgrade, that is the strong recommendation. Alternatively, you could stay unpatched until you're ready.

I won't be providing support on specific changes to make to the patch just yet, so advice is to revert back to your stable version, upgrade, or wait in case there are additional things we need to patch.
 
You must log in or register to reply here.

Similar threads

vbresults
Fixed XF::logError does not work in CLI
Replies
3
Views
104
vbresults
vbresults
S
  • Question Question
XF 2.3 Merge users does not work (sql error)
Replies
3
Views
32
Ozzy47
Ozzy47
Sado Yasashii
  • Solved
XF 2.2 The prefix does not work on some browsers
Replies
1
Views
522
Sado Yasashii
Sado Yasashii
Mr Lucky
Not a bug Select for moderation counter does not work when Paypal donation button on page
Replies
2
Views
582
Jeremy P
Jeremy P
viglesias
  • Question Question
XF 2.2 Odysee player does not work on Xenforo, why?
Replies
3
Views
303
viglesias
viglesias
Back
Top Bottom