Changeset 29636 for trunk

Timestamp:

Sep 19, 2014, 10:46:12 AM (10 years ago)

Author:

plg

Message:

bug 3119 fixed: patch by mmoy, allow @import url(​http://...); directives in minified CSS file.

File:

• trunk/include/template.class.php (modified) (8 diffs)

trunk/include/template.class.php

@@ -1916 +1916 @@
       {
         $output = '';
+        $header = '';
         foreach ($pending as $combinable)
         {
           $output .= "/*BEGIN $combinable->path */\n";
-          $output .= $this->process_combinable($combinable, true, $force);
+          $output .= $this->process_combinable($combinable, true, $force, $header);
           $output .= "\n";
         }
+        $output = "/*BEGIN header */\n" . $header . "\n" . $output;
         mkgetdir( dirname(PHPWG_ROOT_PATH.$file) );
         file_put_contents( PHPWG_ROOT_PATH.$file, $output );
@@ -1930 +1932 @@
     elseif ( count($pending)==1)
     {
-      $this->process_combinable($pending[0], false, $force);
+      $header = '';
+      $this->process_combinable($pending[0], false, $force, $header);
       $result[] = $pending[0];
     }
@@ -1943 +1946 @@
    * @param bool $return_content
    * @param bool $force
+   * @param string $header CSS directives that must appear first in
+   *                       the minified file (only used when
+   *                       $return_content===true)
    * @return null|string
    */
-  private function process_combinable($combinable, $return_content, $force)
+  private function process_combinable($combinable, $return_content, $force, &$header)
   {
     global $conf;
@@ -1971 +1977 @@
 
       if ($this->is_css)
-        $content = self::process_css($content, $combinable->path );
+        $content = self::process_css($content, $combinable->path, $header );
       else
         $content = self::process_js($content, $combinable->path );
@@ -1984 +1990 @@
       $content = file_get_contents(PHPWG_ROOT_PATH . $combinable->path);
       if ($this->is_css)
-        $content = self::process_css($content, $combinable->path );
+        $content = self::process_css($content, $combinable->path, $header );
       else
         $content = self::process_js($content, $combinable->path );
@@ -2013 +2019 @@
    * @param string $css file content
    * @param string $file
+   * @param string $header CSS directives that must appear first in
+   *                       the minified file.
    * @return string
    */
-  private static function process_css($css, $file)
-  {
-    $css = self::process_css_rec($css, dirname($file));
+  private static function process_css($css, $file, &$header)
+  {
+    $css = self::process_css_rec($css, dirname($file), $header);
     if (strpos($file, '.min')===false and version_compare(PHP_VERSION, '5.2.4', '>='))
     {
@@ -2032 +2040 @@
    * @param string $css file content
    * @param string $dir
+   * @param string $header CSS directives that must appear first in
+   *                       the minified file.
    * @return string
    */
-  private static function process_css_rec($css, $dir)
+  private static function process_css_rec($css, $dir, &$header)
   {
     static $PATTERN_URL = "#url\(\s*['|\"]{0,1}(.*?)['|\"]{0,1}\s*\)#";
@@ -2057 +2067 @@
     {
       $search = $replace = array();
+      
       foreach ($matches as $match)
       {
         $search[] = $match[0];
-        $sub_css = file_get_contents(PHPWG_ROOT_PATH . $dir . "/$match[1]");
-        $replace[] = self::process_css_rec($sub_css, dirname($dir . "/$match[1]") );
+        
+        if (
+          strpos($match[1], '..') !== false // Possible attempt to get out of Piwigo's dir
+          or strpos($match[1], '://') !== false // Remote URL
+          or !is_readable(PHPWG_ROOT_PATH . $dir . '/' . $match[1])
+          )
+        {
+          // If anything is suspicious, don't try to process the
+          // @import. Since @import need to be first and we are
+          // concatenating several CSS files, remove it from here and return
+          // it through $header.
+          $header .= $match[0];
+          $replace[] = '';
+        }
+        else
+        {
+          $sub_css = file_get_contents(PHPWG_ROOT_PATH . $dir . "/$match[1]");
+          $replace[] = self::process_css_rec($sub_css, dirname($dir . "/$match[1]"), $header);
+        }
       }
       $css = str_replace($search, $replace, $css);