diff --git a/banner/CHANGES.txt b/banner/CHANGES.txt old mode 100644 new mode 100755 index a8964e7..3b99e9f --- a/banner/CHANGES.txt +++ b/banner/CHANGES.txt @@ -1,6 +1,10 @@ - NetComomns2-banner Changelog + NetCommons2-banner Changelog =============================== +2015/03/19: Version 2.4.2.1 +- 脆弱性に関する修正 + + 2013/05/20: Version 2.4.0.1 =============================== - カテゴリーが0件の場合、カテゴリーが表示されないバグを修正 diff --git a/banner/components/View.class.php b/banner/components/View.class.php index 44d7511..b36475f 100644 --- a/banner/components/View.class.php +++ b/banner/components/View.class.php @@ -116,7 +116,7 @@ function &getBanners() $sql = $this->_getBannerSelectSql() . $this->getBannerFromSql() . $categoryWhereSql - . $this->_db->getOrderSQL($orderParams); + . $this->_db->getOrderSQL($orderParams, array('banner_sequence', 'block_click_count', 'all_click_count', 'insert_user_name', 'insert_time')); $banners = $this->_db->execute($sql, $params, $limit, $offset, true, array($this, '_fetchBanner')); if ($banners === false) { $this->_db->addError(); diff --git a/banner/install.ini b/banner/install.ini old mode 100644 new mode 100755 index 35f178b..985a2c4 --- a/banner/install.ini +++ b/banner/install.ini @@ -1,4 +1,4 @@ -version = "2.4.0.1" +version = "2.4.0.2" action_name = "banner_view_main_init" edit_action_name="banner_view_edit_list" block_add_action = "banner_action_edit_initialize" diff --git a/banner/validator/Validator_UrlRequired.class.php b/banner/validator/Validator_UrlRequired.class.php old mode 100644 new mode 100755 index ba304ad..6f0841e --- a/banner/validator/Validator_UrlRequired.class.php +++ b/banner/validator/Validator_UrlRequired.class.php @@ -27,19 +27,65 @@ function validate($attributes, $errStr, $params) { if (array_key_exists('link_url', $attributes) && $attributes['banner_type'] != BANNER_TYPE_SOURCE_VALUE - && (empty($attributes['link_url']) - || $attributes['link_url'] == BANNER_DEFAULT_URL)) { - return $errStr; + ) { + if (empty($attributes['link_url']) + || $attributes['link_url'] == BANNER_DEFAULT_URL + ) { + return $errStr; + } + if (!$this->_validateProtocol($attributes['link_url'])) { + $container =& DIContainerFactory::getContainer(); + $filterChain =& $container->getComponent("FilterChain"); + $smartyAssign =& $filterChain->getFilterByName("SmartyAssign"); + return sprintf(_FORMAT_WRONG_ERROR, $smartyAssign->getLang('banner_link_url')); + } } if (array_key_exists('image_url', $attributes) && $attributes['banner_type'] == BANNER_TYPE_URL_VALUE - && (empty($attributes['image_url']) - || $attributes['image_url'] == BANNER_DEFAULT_URL)) { - return $errStr; + ) { + if (empty($attributes['image_url']) + || $attributes['image_url'] == BANNER_DEFAULT_URL + ) { + return $errStr; + } + if (!$this->_validateProtocol($attributes['image_url'])) { + $container =& DIContainerFactory::getContainer(); + $filterChain =& $container->getComponent("FilterChain"); + $smartyAssign =& $filterChain->getFilterByName("SmartyAssign"); + return sprintf(_FORMAT_WRONG_ERROR, $smartyAssign->getLang('banner_image_url')); + } } return; } + + /** + * プロトコルチェック + * + * @param string $url + * @return boolean + * @access private + */ + function _validateProtocol($url) + { + $container =& DIContainerFactory::getContainer(); + $db =& $container->getComponent("DbObject"); + $sql = "SELECT protocol FROM {textarea_protocol}"; + $protocolArr = $db->execute($sql); + if ($protocolArr === false) { + return false; + } + + if (preg_match("/^\.\//", $url) || preg_match("/^\.\.\//", $url)) { + return true; + } + foreach ($protocolArr as $i=>$protocol) { + if (preg_match("/^" . $protocol["protocol"] . "/", $url)) { + return true; + } + } + return false; + } } ?> \ No newline at end of file diff --git a/blogparts/CHANGES.txt b/blogparts/CHANGES.txt old mode 100644 new mode 100755 index c0eaca7..921e9da --- a/blogparts/CHANGES.txt +++ b/blogparts/CHANGES.txt @@ -1,6 +1,10 @@ - NetComomns2-blogparts Changelog + NetCommons2-blogparts Changelog =============================== +2015/03/19: Version 2.4.2.1 +- 脆弱性に関する修正 + + 2013/05/20: Version 2.4.0.1 =============================== - ブログパーツ一覧の幅を固定値に修正 diff --git a/blogparts/components/View.class.php b/blogparts/components/View.class.php index 6321348..a654ea3 100644 --- a/blogparts/components/View.class.php +++ b/blogparts/components/View.class.php @@ -121,7 +121,7 @@ function &getBlogpartsList() $sql = "SELECT parts_id, parts_name, insert_time, insert_user_id, insert_user_name ". "FROM {blogparts_parts} ". - $this->_db->getOrderSQL($orderParams); + $this->_db->getOrderSQL($orderParams, array('parts_id', 'parts_name', 'insert_user_name', 'insert_time')); $blogpartsList = $this->_db->execute($sql); if ($blogpartsList === false) { $this->_db->addError(); diff --git a/blogparts/install.ini b/blogparts/install.ini old mode 100644 new mode 100755 index 4f4d5da..e5bae72 --- a/blogparts/install.ini +++ b/blogparts/install.ini @@ -1,4 +1,4 @@ -version = "2.4.0.1" +version = "2.4.0.2" ; //main時の表示画面 ; //blogparts/view/main/init/Init.class.phpとmaple.iniを指定 diff --git a/faq/CHANGES.txt b/faq/CHANGES.txt old mode 100644 new mode 100755 index 982492f..9ec967b --- a/faq/CHANGES.txt +++ b/faq/CHANGES.txt @@ -1,6 +1,10 @@ - NetComomns2-faq Changelog + NetCommons2-faq Changelog =============================== +2015/03/19: Version 2.4.2.1 +- 脆弱性に関する修正 + + 2013/05/20: Version 2.4.0.1 =============================== - 携帯対応 diff --git a/faq/components/View.class.php b/faq/components/View.class.php index 72be925..24e49db 100644 --- a/faq/components/View.class.php +++ b/faq/components/View.class.php @@ -105,7 +105,7 @@ function &getFaqs() { $sql = "SELECT faq_id, faq_name, insert_time, insert_user_id, insert_user_name ". "FROM {faq} ". "WHERE room_id = ? ". - $this->_db->getOrderSQL($orderParams); + $this->_db->getOrderSQL($orderParams, array('faq_id', 'faq_name', 'insert_user_name', 'insert_time')); $result = $this->_db->execute($sql, $params, $limit, $offset); if ($result === false) { $this->_db->addError(); diff --git a/faq/install.ini b/faq/install.ini old mode 100644 new mode 100755 index 400fc79..ab0f123 --- a/faq/install.ini +++ b/faq/install.ini @@ -1,4 +1,4 @@ -version = "2.4.0.1" +version = "2.4.0.2" action_name = "faq_view_main_init" edit_action_name = "faq_view_edit_list" block_add_action = "faq_view_edit_create" diff --git a/multimedia/CHANGES.txt b/multimedia/CHANGES.txt old mode 100644 new mode 100755 index de3d6e8..1f3d451 --- a/multimedia/CHANGES.txt +++ b/multimedia/CHANGES.txt @@ -1,9 +1,20 @@ - NetComomns2-multimedia Changelog + NetCommons2-multimedia Changelog =============================== -2013/12/05: Version 2.4.0.2 +2019/03/30: Version 2.4.3.0 =============================== -- チャンネル編集をクリックしてもチャンネル画面が表示されないバグを修正 +- 動画再生をjplayerから