external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add PCRE_DOLLAR_ENDONLY to preg_match()

Browse source 
When using preg_match() to check for a match that starts at the
beginning of the string and ends at the last character of the string, we
do not want to allow an additional newline character to sneak in.
Amongst other potential loopholes, adding the PCRE_DOLLAR_ENDONLY
modifier prevents users from registering with user names that end with a
newline character.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
This commit is contained in:
Lukas Fleischer 2014-08-05 23:52:03 +02:00
parent 13693fbdbc
commit 237a4570e2
3 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
web/html/pkgsubmit.php
View file

@ -193,7 +193,7 @@ if ($uid):
/* Validate package base name. */ /* Validate package base name. */
if (!$error) { if (!$error) {
$pkgbase_name = $pkgbase_info['pkgbase']; $pkgbase_name = $pkgbase_info['pkgbase'];
if (!preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $pkgbase_name)) { if (!preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/D", $pkgbase_name)) {
$error = __("Invalid name: only lowercase letters are allowed."); $error = __("Invalid name: only lowercase letters are allowed.");
} }
@ -209,7 +209,7 @@ if ($uid):
/* Validate package names. */ /* Validate package names. */
$pkg_name = $pi['pkgname']; $pkg_name = $pi['pkgname'];
if (!preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $pkg_name)) { if (!preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/D", $pkg_name)) {
$error = __("Invalid name: only lowercase letters are allowed."); $error = __("Invalid name: only lowercase letters are allowed.");
break; break;
} }

2
web/lib/acctfuncs.inc.php
View file

@ -544,7 +544,7 @@ function valid_username($user) {
if (strlen($user) < USERNAME_MIN_LEN || if (strlen($user) < USERNAME_MIN_LEN ||
strlen($user) > USERNAME_MAX_LEN) { strlen($user) > USERNAME_MAX_LEN) {
return false; return false;
} else if (!preg_match("/^[a-z0-9]+[.\-_]?[a-z0-9]+$/i", $user)) { } else if (!preg_match("/^[a-z0-9]+[.\-_]?[a-z0-9]+$/Di", $user)) {
return false; return false;
} }

2
web/lib/pkgreqfuncs.inc.php
View file

@ -91,7 +91,7 @@ function pkgreq_file($ids, $type, $merge_into, $comments) {
global $AUR_REQUEST_ML; global $AUR_REQUEST_ML;
global $AUTO_ORPHAN_AGE; global $AUTO_ORPHAN_AGE;
if (!empty($merge_into) && !preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $merge_into)) { if (!empty($merge_into) && !preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/D", $merge_into)) {
return array(false, __("Invalid name: only lowercase letters are allowed.")); return array(false, __("Invalid name: only lowercase letters are allowed."));
} }