Changeset 3219 for trunk/lib/MT/App.pm

Timestamp:

12/03/08 07:58:25 (12 months ago)

Author:

fumiakiy

Message:

Merging the latest of fireball branch to trunk. svn merge -r3095:3215 http://code.sixapart.com/svn/movabletype/branches/fireball . (two conflicts resolved; MT.pm, mt.php and mt-check.cgi merged manually.)

Files:

• trunk/lib/MT/App.pm (modified) (6 diffs)

trunk/lib/MT/App.pm

@@ -1974 +1974 @@
 
         $url = $q->param('url');
-        if ( $url && !is_url($url) ) {
+        if ( $url && (!is_url($url) || ($url =~ m/[<>]/)) ) {
             return $app->error( $app->translate("URL is invalid.") );
         }
@@ -1987 +1987 @@
         return $app->error( $app->translate("User requires username.") );
     }
+    if ( $name =~ m/([<>])/) {
+        return $app->error( $app->translate("[_1] contains an invalid character: [_2]", $app->translate("Username"), encode_html( $1 ) ) );
+    }
 
     my $existing = MT::Author->exist( { name => $name } );
@@ -1996 +1999 @@
     unless ($nickname) {
         return $app->error( $app->translate("User requires display name.") );
+    }
+    if ( $nickname =~ m/([<>])/) {
+        return $app->error( $app->translate("[_1] contains an invalid character: [_2]", $app->translate("Display Name"), encode_html( $1 ) ) );
     }
 
@@ -2004 +2010 @@
             return $app->error(
                 $app->translate("Email Address is invalid.") );
+        }
+
+        if ( $email =~ m/([<>])/) {
+            return $app->error( $app->translate("[_1] contains an invalid character: [_2]", $app->translate("Email Address"), encode_html( $1 ) ) );
         }
     }
@@ -2399 +2409 @@
     my $url     = $app->uri;
     my $blog_id = $app->param('blog_id');
+
     if ( ref $param ne 'HASH' ) {
-
         # old scalar signature
         $param = { error => $param };
     }
 
-    if ( $MT::DebugMode && $@ ) {
-        $param->{error} = '<pre>' . encode_html( $param->{error} ) . '</pre>';
+    my $error = $param->{error};
+
+    if ( $MT::DebugMode ) {
+        if ( $@ ) {
+            # Use 'pre' tag to wrap Perl error
+            $error = '<pre>' . encode_html( $error ) . '</pre>';
+        }
     }
     else {
-        $param->{error} = encode_html( $param->{error} );
-        $param->{error}
+        if ($error =~ m/^(.+?)( at .+? line \d+)(.*)$/s) {
+            # Hide any module path info from perl error message
+            # Information could be revealing info about where MT app
+            # resides on server, and what version is being used, which
+            # may be helpful forensics to an attacker.
+            $error = $1;
+        }
+        $error = encode_html( $error );
+        $error
             =~ s!(https?://\S+)!<a href="$1" target="_blank">$1</a>!g;
     }
-    $tmpl = $app->load_tmpl('error.tmpl')
-        or return "Can't load error template; got error '"
-        . encode_html( $app->errstr )
-        . "'. Giving up. Original error was <pre>$param->{error}</pre>";
+
+    $tmpl = $app->load_tmpl('error.tmpl');
+    if (!$tmpl) {
+        $error = '<pre>' . $error . '</pre>' unless $error =~ m/<pre>/;
+        return "Can't load error template; got error '"
+            . encode_html( $app->errstr )
+            . "'. Giving up. Original error was: $error";
+    }
     my $type = $app->param('__type') || '';
     if ( $type eq 'dialog' ) {
@@ -2428 +2454 @@
         $param->{value}  ||= $app->{value}  || $app->translate("Go Back");
     }
+    local $param->{error} = $error;
     $tmpl->param($param);
     my $out = $tmpl->output;
     if ( !defined $out ) {
+        $error = '<pre>' . $error . '</pre>' unless $error =~ m/<pre>/;
         return
               "Can't build error template; got error '"
             . encode_html( $tmpl->errstr )
-            . "'. Giving up. Original error was <pre>$param->{error}</pre>";
+            . "'. Giving up. Original error was: $error";
     }
     return $app->l10n_filter($out);