Merge branch '4.0' into 'main'

thorsten · Dec 14, 2024 · ff255b2 · ff255b2
2 parents 6d90b46 + 2ff2f5b
commit ff255b2
Show file tree

Hide file tree

Showing 10 changed files with 154 additions and 115 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,10 +13,18 @@ This is a log of major user-visible changes in each phpMyFAQ release.
 - removed Webpack, now using Vite v6 (Thorsten)
 - migrated from Jest to vitest (Thorsten)
 
-### phpMyFAQ v4.0.1 - unreleased
+### phpMyFAQ v4.0.2 - unreleased
 
 - improved update handling of .htaccess file (Thorsten)
 - updated 3rd party dependencies (Thorsten)
+- fixed minor bugs (Thorsten)
+
+### phpMyFAQ v4.0.1 - 2024-12-13
+
+- fixed security vulnerability (Thorsten)
+- improved update handling of .htaccess file (Thorsten)
+- updated 3rd party dependencies (Thorsten)
+- fixed minor bugs (Thorsten)
 
 ### phpMyFAQ v4.0.0 - 2024-12-06
 

diff --git a/composer.lock b/composer.lock
diff --git a/phpmyfaq/admin/category.main.php b/phpmyfaq/admin/category.main.php
@@ -30,6 +30,7 @@
 use phpMyFAQ\Template\TwigWrapper;
 use phpMyFAQ\Translation;
 use phpMyFAQ\User\CurrentUser;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
 use Symfony\Component\HttpFoundation\Request;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
@@ -48,7 +49,9 @@
 $request = Request::createFromGlobals();
 $uploadedFile = $request->files->get('image') ?? [];
 $categoryImage = new Image($faqConfig);
-$categoryImage->setUploadedFile($uploadedFile);
+if ($uploadedFile instanceof UploadedFile) {
+    $categoryImage->setUploadedFile($uploadedFile);
+}
 
 $categoryPermission = new Permission($faqConfig);
 $seo = new Seo($faqConfig);
@@ -79,7 +82,7 @@
             ->setUserId(Filter::filterInput(INPUT_POST, 'user_id', FILTER_VALIDATE_INT))
             ->setGroupId(Filter::filterInput(INPUT_POST, 'group_id', FILTER_VALIDATE_INT) ?? -1)
             ->setActive(Filter::filterInput(INPUT_POST, 'active', FILTER_VALIDATE_INT) ?? false)
-            ->setImage($categoryImage->getFileName($categoryId, $categoryLang) ?? '')
+            ->setImage($categoryImage->getFileName($categoryId, $categoryLang))
             ->setParentId($parentId)
             ->setShowHome(Filter::filterInput(INPUT_POST, 'show_home', FILTER_VALIDATE_INT));
 

diff --git a/phpmyfaq/admin/footer.php b/phpmyfaq/admin/footer.php
@@ -29,7 +29,6 @@
 }
 
 $faqConfig = Configuration::getConfigurationInstance();
-$user = CurrentUser::getCurrentUser($faqConfig);
 
 $twig = new TwigWrapper(PMF_ROOT_DIR . '/assets/templates');
 $template = $twig->loadTemplate('@admin/footer.twig');

diff --git a/phpmyfaq/assets/templates/setup/update.twig b/phpmyfaq/assets/templates/setup/update.twig
@@ -56,6 +56,12 @@
 
           {{ include('./setup/update/step' ~ currentStep ~ '.twig') }}
 
+          {% if checkBasicError %}
+            <div class="alert alert-danger my-5" role="alert">
+              {{ checkBasicError | raw }}
+            </div>
+          {% endif %}
+
         </div>
         </section>
     </main>

diff --git a/phpmyfaq/src/phpMyFAQ/Category/Image.php b/phpmyfaq/src/phpMyFAQ/Category/Image.php
@@ -19,6 +19,7 @@
 
 use phpMyFAQ\Configuration;
 use phpMyFAQ\Core\Exception;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
 
 /**
  * Class CategoryImage
@@ -32,7 +33,7 @@ class Image
 
     private bool $isUpload = false;
 
-    private array $uploadedFile = [];
+    private UploadedFile $uploadedFile;
 
     private string $fileName = '';
 
@@ -46,11 +47,11 @@ public function __construct(private readonly Configuration $configuration)
     }
 
     /**
-     * Sets the uploaded file array from $_FILES.
+     * Sets the uploaded file
      */
-    public function setUploadedFile(array $uploadedFile): Image
+    public function setUploadedFile(UploadedFile $uploadedFile): Image
     {
-        if (isset($uploadedFile['error']) && UPLOAD_ERR_OK === $uploadedFile['error']) {
+        if ($uploadedFile->isValid()) {
             $this->isUpload = true;
         }
 
@@ -70,7 +71,7 @@ public function getFileName(int $categoryId, string $categoryName): string
                     'category-%d-%s.%s',
                     $categoryId,
                     $categoryName,
-                    $this->getFileExtension($this->uploadedFile['type'])
+                    $this->getFileExtension($this->uploadedFile->getMimeType())
                 )
             );
         }
@@ -106,12 +107,10 @@ private function getFileExtension(string $mimeType): string
     /**
      * Checks for valid image MIME types, returns true if valid
      */
-    private function isValidMimeType(string $file): bool
+    private function isValidMimeType(string $contentType): bool
     {
         $types = ['image/jpeg','image/gif','image/png', 'image/webp'];
-        $type = mime_content_type($file);
-
-        return in_array($type, $types);
+        return in_array($contentType, $types);
     }
 
     /**
@@ -122,20 +121,18 @@ private function isValidMimeType(string $file): bool
     public function upload(): bool
     {
         if (
-            $this->isUpload && is_uploaded_file($this->uploadedFile['tmp_name'])
-            && $this->uploadedFile['size'] < $this->configuration->get('records.maxAttachmentSize')
+            $this->isUpload && $this->uploadedFile->isValid()
+            && $this->uploadedFile->getSize() < $this->configuration->get('records.maxAttachmentSize')
         ) {
-            if (false === getimagesize($this->uploadedFile['tmp_name'])) {
+            if (false === $this->uploadedFile->getSize()) {
                 throw new Exception('Cannot detect image size');
             }
 
-            if (!$this->isValidMimeType($this->uploadedFile['tmp_name'])) {
+            if (!$this->isValidMimeType($this->uploadedFile->getClientMimeType())) {
                 throw new Exception('Image MIME type validation failed.');
             }
 
-            if (!move_uploaded_file($this->uploadedFile['tmp_name'], self::UPLOAD_DIR . $this->fileName)) {
-                throw new Exception('Cannot move uploaded image');
-            }
+            $this->uploadedFile->move(self::UPLOAD_DIR, $this->fileName);
 
             return true;
         }