diff --git a/banner/CHANGES.txt b/banner/CHANGES.txt
old mode 100644
new mode 100755
index a8964e7..3b99e9f
--- a/banner/CHANGES.txt
+++ b/banner/CHANGES.txt
@@ -1,6 +1,10 @@
- NetComomns2-banner Changelog
+ NetCommons2-banner Changelog
===============================
+2015/03/19: Version 2.4.2.1
+- 脆弱性に関する修正
+
+
2013/05/20: Version 2.4.0.1
===============================
- カテゴリーが0件の場合、カテゴリーが表示されないバグを修正
diff --git a/banner/components/View.class.php b/banner/components/View.class.php
index 44d7511..b36475f 100644
--- a/banner/components/View.class.php
+++ b/banner/components/View.class.php
@@ -116,7 +116,7 @@ function &getBanners()
$sql = $this->_getBannerSelectSql()
. $this->getBannerFromSql()
. $categoryWhereSql
- . $this->_db->getOrderSQL($orderParams);
+ . $this->_db->getOrderSQL($orderParams, array('banner_sequence', 'block_click_count', 'all_click_count', 'insert_user_name', 'insert_time'));
$banners = $this->_db->execute($sql, $params, $limit, $offset, true, array($this, '_fetchBanner'));
if ($banners === false) {
$this->_db->addError();
diff --git a/banner/install.ini b/banner/install.ini
old mode 100644
new mode 100755
index 35f178b..985a2c4
--- a/banner/install.ini
+++ b/banner/install.ini
@@ -1,4 +1,4 @@
-version = "2.4.0.1"
+version = "2.4.0.2"
action_name = "banner_view_main_init"
edit_action_name="banner_view_edit_list"
block_add_action = "banner_action_edit_initialize"
diff --git a/banner/validator/Validator_UrlRequired.class.php b/banner/validator/Validator_UrlRequired.class.php
old mode 100644
new mode 100755
index ba304ad..6f0841e
--- a/banner/validator/Validator_UrlRequired.class.php
+++ b/banner/validator/Validator_UrlRequired.class.php
@@ -27,19 +27,65 @@ function validate($attributes, $errStr, $params)
{
if (array_key_exists('link_url', $attributes)
&& $attributes['banner_type'] != BANNER_TYPE_SOURCE_VALUE
- && (empty($attributes['link_url'])
- || $attributes['link_url'] == BANNER_DEFAULT_URL)) {
- return $errStr;
+ ) {
+ if (empty($attributes['link_url'])
+ || $attributes['link_url'] == BANNER_DEFAULT_URL
+ ) {
+ return $errStr;
+ }
+ if (!$this->_validateProtocol($attributes['link_url'])) {
+ $container =& DIContainerFactory::getContainer();
+ $filterChain =& $container->getComponent("FilterChain");
+ $smartyAssign =& $filterChain->getFilterByName("SmartyAssign");
+ return sprintf(_FORMAT_WRONG_ERROR, $smartyAssign->getLang('banner_link_url'));
+ }
}
if (array_key_exists('image_url', $attributes)
&& $attributes['banner_type'] == BANNER_TYPE_URL_VALUE
- && (empty($attributes['image_url'])
- || $attributes['image_url'] == BANNER_DEFAULT_URL)) {
- return $errStr;
+ ) {
+ if (empty($attributes['image_url'])
+ || $attributes['image_url'] == BANNER_DEFAULT_URL
+ ) {
+ return $errStr;
+ }
+ if (!$this->_validateProtocol($attributes['image_url'])) {
+ $container =& DIContainerFactory::getContainer();
+ $filterChain =& $container->getComponent("FilterChain");
+ $smartyAssign =& $filterChain->getFilterByName("SmartyAssign");
+ return sprintf(_FORMAT_WRONG_ERROR, $smartyAssign->getLang('banner_image_url'));
+ }
}
return;
}
+
+ /**
+ * プロトコルチェック
+ *
+ * @param string $url
+ * @return boolean
+ * @access private
+ */
+ function _validateProtocol($url)
+ {
+ $container =& DIContainerFactory::getContainer();
+ $db =& $container->getComponent("DbObject");
+ $sql = "SELECT protocol FROM {textarea_protocol}";
+ $protocolArr = $db->execute($sql);
+ if ($protocolArr === false) {
+ return false;
+ }
+
+ if (preg_match("/^\.\//", $url) || preg_match("/^\.\.\//", $url)) {
+ return true;
+ }
+ foreach ($protocolArr as $i=>$protocol) {
+ if (preg_match("/^" . $protocol["protocol"] . "/", $url)) {
+ return true;
+ }
+ }
+ return false;
+ }
}
?>
\ No newline at end of file
diff --git a/blogparts/CHANGES.txt b/blogparts/CHANGES.txt
old mode 100644
new mode 100755
index c0eaca7..921e9da
--- a/blogparts/CHANGES.txt
+++ b/blogparts/CHANGES.txt
@@ -1,6 +1,10 @@
- NetComomns2-blogparts Changelog
+ NetCommons2-blogparts Changelog
===============================
+2015/03/19: Version 2.4.2.1
+- 脆弱性に関する修正
+
+
2013/05/20: Version 2.4.0.1
===============================
- ブログパーツ一覧の幅を固定値に修正
diff --git a/blogparts/components/View.class.php b/blogparts/components/View.class.php
index 6321348..a654ea3 100644
--- a/blogparts/components/View.class.php
+++ b/blogparts/components/View.class.php
@@ -121,7 +121,7 @@ function &getBlogpartsList()
$sql = "SELECT parts_id, parts_name, insert_time, insert_user_id, insert_user_name ".
"FROM {blogparts_parts} ".
- $this->_db->getOrderSQL($orderParams);
+ $this->_db->getOrderSQL($orderParams, array('parts_id', 'parts_name', 'insert_user_name', 'insert_time'));
$blogpartsList = $this->_db->execute($sql);
if ($blogpartsList === false) {
$this->_db->addError();
diff --git a/blogparts/install.ini b/blogparts/install.ini
old mode 100644
new mode 100755
index 4f4d5da..e5bae72
--- a/blogparts/install.ini
+++ b/blogparts/install.ini
@@ -1,4 +1,4 @@
-version = "2.4.0.1"
+version = "2.4.0.2"
; //main時の表示画面
; //blogparts/view/main/init/Init.class.phpとmaple.iniを指定
diff --git a/faq/CHANGES.txt b/faq/CHANGES.txt
old mode 100644
new mode 100755
index 982492f..9ec967b
--- a/faq/CHANGES.txt
+++ b/faq/CHANGES.txt
@@ -1,6 +1,10 @@
- NetComomns2-faq Changelog
+ NetCommons2-faq Changelog
===============================
+2015/03/19: Version 2.4.2.1
+- 脆弱性に関する修正
+
+
2013/05/20: Version 2.4.0.1
===============================
- 携帯対応
diff --git a/faq/components/View.class.php b/faq/components/View.class.php
index 72be925..24e49db 100644
--- a/faq/components/View.class.php
+++ b/faq/components/View.class.php
@@ -105,7 +105,7 @@ function &getFaqs() {
$sql = "SELECT faq_id, faq_name, insert_time, insert_user_id, insert_user_name ".
"FROM {faq} ".
"WHERE room_id = ? ".
- $this->_db->getOrderSQL($orderParams);
+ $this->_db->getOrderSQL($orderParams, array('faq_id', 'faq_name', 'insert_user_name', 'insert_time'));
$result = $this->_db->execute($sql, $params, $limit, $offset);
if ($result === false) {
$this->_db->addError();
diff --git a/faq/install.ini b/faq/install.ini
old mode 100644
new mode 100755
index 400fc79..ab0f123
--- a/faq/install.ini
+++ b/faq/install.ini
@@ -1,4 +1,4 @@
-version = "2.4.0.1"
+version = "2.4.0.2"
action_name = "faq_view_main_init"
edit_action_name = "faq_view_edit_list"
block_add_action = "faq_view_edit_create"
diff --git a/multimedia/CHANGES.txt b/multimedia/CHANGES.txt
old mode 100644
new mode 100755
index de3d6e8..1f3d451
--- a/multimedia/CHANGES.txt
+++ b/multimedia/CHANGES.txt
@@ -1,9 +1,20 @@
- NetComomns2-multimedia Changelog
+ NetCommons2-multimedia Changelog
===============================
-2013/12/05: Version 2.4.0.2
+2019/03/30: Version 2.4.3.0
===============================
-- チャンネル編集をクリックしてもチャンネル画面が表示されないバグを修正
+- 動画再生をjplayerから