Chapril/paste.chapril.org-privatebin
Chapril/paste.chapril.org-privatebin
25
1
Fork 0
Code Issues Releases Wiki Activity

Merge branch 'master' into crowdin-translation

Browse Source
This commit is contained in:
El RIDO 2022-02-13 09:01:27 +01:00
commit e822673e90
No known key found for this signature in database
GPG Key ID: 0F5C940A6BD81F92
15 changed files with 254 additions and 121 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
CHANGELOG.md
View File

@ -1,19 +1,20 @@
# PrivateBin version history # PrivateBin version history
* **1.4 (not yet released)** * **1.4 (not yet released)**
* ADDED: Translation for Estonian * ADDED: Translations for Estonian and Lojban
* ADDED: new HTTP headers improving security (#765) * ADDED: new HTTP headers improving security (#765)
* ADDED: Download button for paste text (#774) * ADDED: Download button for paste text (#774)
* ADDED: Opt-out of federated learning of cohorts (FLoC) (#776) * ADDED: Opt-out of federated learning of cohorts (FLoC) (#776)
* ADDED: Configuration option to exempt IPs from the rate-limiter (#787) * ADDED: Configuration option to exempt IPs from the rate-limiter (#787)
* ADDED: Google Cloud Storage backend support (#795) * ADDED: Google Cloud Storage backend support (#795)
* ADDED: Oracle database support (#868)
* CHANGED: Language selection cookie only transmitted over HTTPS (#472) * CHANGED: Language selection cookie only transmitted over HTTPS (#472)
* CHANGED: Upgrading libraries to: random_compat 2.0.20 * CHANGED: Upgrading libraries to: random_compat 2.0.20
* CHANGED: Removed automatic `.ini` configuration file migration (#808) * CHANGED: Removed automatic `.ini` configuration file migration (#808)
* CHANGED: Removed configurable `dir` for `traffic` & `purge` limiters (#419) * CHANGED: Removed configurable `dir` for `traffic` & `purge` limiters (#419)
* CHANGED: Server salt, traffic and purge limiter now stored in the storage backend (#419) * CHANGED: Server salt, traffic and purge limiter now stored in the storage backend (#419)
* **1.3.5 (2021-04-05)** * **1.3.5 (2021-04-05)**
* ADDED: Translation for Hebrew, Lithuanian, Indonesian and Catalan * ADDED: Translations for Hebrew, Lithuanian, Indonesian and Catalan
* ADDED: Make the project info configurable (#681) * ADDED: Make the project info configurable (#681)
* CHANGED: Upgrading libraries to: DOMpurify 2.2.7, kjua 0.9.0 & random_compat 2.0.18 * CHANGED: Upgrading libraries to: DOMpurify 2.2.7, kjua 0.9.0 & random_compat 2.0.18
* CHANGED: Open all links in new window (#630) * CHANGED: Open all links in new window (#630)

2
CREDITS.md
View File

@ -29,6 +29,7 @@ Sébastien Sauvage - original idea and main developer
* Lucas Savva - configurable config file location, NixOS packaging * Lucas Savva - configurable config file location, NixOS packaging
* rodehoed - option to exempt ips from the rate-limiter * rodehoed - option to exempt ips from the rate-limiter
* Mark van Holsteijn - Google Cloud Storage backend * Mark van Holsteijn - Google Cloud Storage backend
* Austin Huang - Oracle database support
## Translations ## Translations
* Hexalyse - French * Hexalyse - French
@ -53,3 +54,4 @@ Sébastien Sauvage - original idea and main developer
* whenwesober - Indonesian * whenwesober - Indonesian
* retiolus - Catalan * retiolus - Catalan
* sarnane - Estonian * sarnane - Estonian
* foxsouns - Lojban

10
INSTALL.md
View File

@ -190,8 +190,14 @@ CREATE TABLE prefix_config (
INSERT INTO prefix_config VALUES('VERSION', '1.3.5'); INSERT INTO prefix_config VALUES('VERSION', '1.3.5');
``` ```
In **PostgreSQL**, the data, attachment, nickname and vizhash columns needs to In **PostgreSQL**, the `data`, `attachment`, `nickname` and `vizhash` columns
be TEXT and not BLOB or MEDIUMBLOB. need to be `TEXT` and not `BLOB` or `MEDIUMBLOB`. The key names in brackets,
after `PRIMARY KEY`, need to be removed.
In **Oracle**, the `data`, `attachment`, `nickname` and `vizhash` columns need
to be `CLOB` and not `BLOB` or `MEDIUMBLOB`, the `id` column in the `config`
table needs to be `VARCHAR2(16)` and the `meta` column in the `paste` table
and the `value` column in the `config` table need to be `VARCHAR2(4000)`.
### Using Google Cloud Storage ### Using Google Cloud Storage
If you want to deploy PrivateBin in a serverless manner in the Google Cloud, you If you want to deploy PrivateBin in a serverless manner in the Google Cloud, you

1
Procfile Normal file
View File

@ -0,0 +1 @@
web: vendor/bin/heroku-php-apache2

1
i18n/languages.json
View File

@ -89,6 +89,7 @@
"ku": ["Kurdî", "Kurdish"], "ku": ["Kurdî", "Kurdish"],
"kj": ["Kuanyama", "Kwanyama"], "kj": ["Kuanyama", "Kwanyama"],
"la": ["lingua latina", "Latin"], "la": ["lingua latina", "Latin"],
"jbo":["jbobau", "Lojban"],
"lb": ["Lëtzebuergesch", "Luxembourgish"], "lb": ["Lëtzebuergesch", "Luxembourgish"],
"lg": ["Luganda", "Ganda"], "lg": ["Luganda", "Ganda"],
"li": ["Limburgs", "Limburgish"], "li": ["Limburgs", "Limburgish"],

2
js/common.js
View File

@ -10,7 +10,7 @@ global.fs = require('fs');
global.WebCrypto = require('@peculiar/webcrypto').Crypto; global.WebCrypto = require('@peculiar/webcrypto').Crypto;
// application libraries to test // application libraries to test
global.$ = global.jQuery = require('./jquery-3.4.1'); global.$ = global.jQuery = require('./jquery-3.6.0');
global.RawDeflate = require('./rawinflate-0.3').RawDeflate; global.RawDeflate = require('./rawinflate-0.3').RawDeflate;
global.zlib = require('./zlib-1.2.11').zlib; global.zlib = require('./zlib-1.2.11').zlib;
require('./prettify'); require('./prettify');

2
js/jquery-3.4.1.js vendored
View File

File diff suppressed because one or more lines are too long

2
js/jquery-3.6.0.js vendored Normal file
View File

File diff suppressed because one or more lines are too long

3
js/privatebin.js
View File

@ -601,7 +601,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
* @prop {string[]} * @prop {string[]}
* @readonly * @readonly
*/ */
const supportedLanguages = ['bg', 'ca', 'cs', 'de', 'es', 'et', 'fr', 'he', 'hu', 'id', 'it', 'lt', 'no', 'nl', 'pl', 'pt', 'oc', 'ru', 'sl', 'uk', 'zh']; const supportedLanguages = ['bg', 'ca', 'cs', 'de', 'es', 'et', 'fr', 'he', 'hu', 'id', 'it', 'jbo', 'lt', 'no', 'nl', 'pl', 'pt', 'oc', 'ru', 'sl', 'uk', 'zh'];
/** /**
* built in language * built in language
@ -785,6 +785,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
case 'he': case 'he':
return n === 1 ? 0 : (n === 2 ? 1 : ((n < 0 || n > 10) && (n % 10 === 0) ? 2 : 3)); return n === 1 ? 0 : (n === 2 ? 1 : ((n < 0 || n > 10) && (n % 10 === 0) ? 2 : 3));
case 'id': case 'id':
case 'jbo':
return 0; return 0;
case 'lt': case 'lt':
return n % 10 === 1 && n % 100 !== 11 ? 0 : ((n % 10 >= 2 && n % 100 < 10 || n % 100 >= 20) ? 1 : 2); return n % 10 === 1 && n % 100 !== 11 ? 0 : ((n % 10 >= 2 && n % 100 < 10 || n % 100 >= 20) ? 1 : 2);

302
lib/Data/Database.php
View File

@ -97,6 +97,11 @@ class Database extends AbstractData
self::$_type = strtolower( self::$_type = strtolower(
substr($options['dsn'], 0, strpos($options['dsn'], ':')) substr($options['dsn'], 0, strpos($options['dsn'], ':'))
); );
// MySQL uses backticks to quote identifiers by default,
// tell it to expect ANSI SQL double quotes
if (self::$_type === 'mysql' && defined('PDO::MYSQL_ATTR_INIT_COMMAND')) {
$options['opt'][PDO::MYSQL_ATTR_INIT_COMMAND] = "SET sql_mode='ANSI_QUOTES'";
}
$tableQuery = self::_getTableQuery(self::$_type); $tableQuery = self::_getTableQuery(self::$_type);
self::$_db = new PDO( self::$_db = new PDO(
$options['dsn'], $options['dsn'],
@ -200,8 +205,8 @@ class Database extends AbstractData
} }
try { try {
return self::_exec( return self::_exec(
'INSERT INTO ' . self::_sanitizeIdentifier('paste') . 'INSERT INTO "' . self::_sanitizeIdentifier('paste') .
' VALUES(?,?,?,?,?,?,?,?,?)', '" VALUES(?,?,?,?,?,?,?,?,?)',
array( array(
$pasteid, $pasteid,
$isVersion1 ? $paste['data'] : Json::encode($paste), $isVersion1 ? $paste['data'] : Json::encode($paste),
@ -235,8 +240,8 @@ class Database extends AbstractData
self::$_cache[$pasteid] = false; self::$_cache[$pasteid] = false;
try { try {
$paste = self::_select( $paste = self::_select(
'SELECT * FROM ' . self::_sanitizeIdentifier('paste') . 'SELECT * FROM "' . self::_sanitizeIdentifier('paste') .
' WHERE dataid = ?', array($pasteid), true '" WHERE "dataid" = ?', array($pasteid), true
); );
} catch (Exception $e) { } catch (Exception $e) {
$paste = false; $paste = false;
@ -297,12 +302,12 @@ class Database extends AbstractData
public function delete($pasteid) public function delete($pasteid)
{ {
self::_exec( self::_exec(
'DELETE FROM ' . self::_sanitizeIdentifier('paste') . 'DELETE FROM "' . self::_sanitizeIdentifier('paste') .
' WHERE dataid = ?', array($pasteid) '" WHERE "dataid" = ?', array($pasteid)
); );
self::_exec( self::_exec(
'DELETE FROM ' . self::_sanitizeIdentifier('comment') . 'DELETE FROM "' . self::_sanitizeIdentifier('comment') .
' WHERE pasteid = ?', array($pasteid) '" WHERE "pasteid" = ?', array($pasteid)
); );
if ( if (
array_key_exists($pasteid, self::$_cache) array_key_exists($pasteid, self::$_cache)
@ -357,8 +362,8 @@ class Database extends AbstractData
} }
try { try {
return self::_exec( return self::_exec(
'INSERT INTO ' . self::_sanitizeIdentifier('comment') . 'INSERT INTO "' . self::_sanitizeIdentifier('comment') .
' VALUES(?,?,?,?,?,?,?)', '" VALUES(?,?,?,?,?,?,?)',
array( array(
$commentid, $commentid,
$pasteid, $pasteid,
@ -384,13 +389,13 @@ class Database extends AbstractData
public function readComments($pasteid) public function readComments($pasteid)
{ {
$rows = self::_select( $rows = self::_select(
'SELECT * FROM ' . self::_sanitizeIdentifier('comment') . 'SELECT * FROM "' . self::_sanitizeIdentifier('comment') .
' WHERE pasteid = ?', array($pasteid) '" WHERE "pasteid" = ?', array($pasteid)
); );
// create comment list // create comment list
$comments = array(); $comments = array();
if (count($rows)) { if (is_array($rows) && count($rows)) {
foreach ($rows as $row) { foreach ($rows as $row) {
$i = $this->getOpenSlot($comments, (int) $row['postdate']); $i = $this->getOpenSlot($comments, (int) $row['postdate']);
$data = Json::decode($row['data']); $data = Json::decode($row['data']);
@ -429,8 +434,8 @@ class Database extends AbstractData
{ {
try { try {
return (bool) self::_select( return (bool) self::_select(
'SELECT dataid FROM ' . self::_sanitizeIdentifier('comment') . 'SELECT "dataid" FROM "' . self::_sanitizeIdentifier('comment') .
' WHERE pasteid = ? AND parentid = ? AND dataid = ?', '" WHERE "pasteid" = ? AND "parentid" = ? AND "dataid" = ?',
array($pasteid, $parentid, $commentid), true array($pasteid, $parentid, $commentid), true
); );
} catch (Exception $e) { } catch (Exception $e) {
@ -458,8 +463,8 @@ class Database extends AbstractData
} }
} }
return self::_exec( return self::_exec(
'UPDATE ' . self::_sanitizeIdentifier('config') . 'UPDATE "' . self::_sanitizeIdentifier('config') .
' SET value = ? WHERE id = ?', '" SET "value" = ? WHERE "id" = ?',
array($value, strtoupper($namespace)) array($value, strtoupper($namespace))
); );
} }
@ -479,8 +484,8 @@ class Database extends AbstractData
if ($value === '') { if ($value === '') {
// initialize the row, so that setValue can rely on UPDATE queries // initialize the row, so that setValue can rely on UPDATE queries
self::_exec( self::_exec(
'INSERT INTO ' . self::_sanitizeIdentifier('config') . 'INSERT INTO "' . self::_sanitizeIdentifier('config') .
' VALUES(?,?)', '" VALUES(?,?)',
array($configKey, '') array($configKey, '')
); );
@ -517,11 +522,12 @@ class Database extends AbstractData
{ {
$pastes = array(); $pastes = array();
$rows = self::_select( $rows = self::_select(
'SELECT dataid FROM ' . self::_sanitizeIdentifier('paste') . 'SELECT "dataid" FROM "' . self::_sanitizeIdentifier('paste') .
' WHERE expiredate < ? AND expiredate != ? LIMIT ?', '" WHERE "expiredate" < ? AND "expiredate" != ? ' .
(self::$_type === 'oci' ? 'FETCH NEXT ? ROWS ONLY' : 'LIMIT ?'),
array(time(), 0, $batchsize) array(time(), 0, $batchsize)
); );
if (count($rows)) { if (is_array($rows) && count($rows)) {
foreach ($rows as $row) { foreach ($rows as $row) {
$pastes[] = $row['dataid']; $pastes[] = $row['dataid'];
} }
@ -542,7 +548,17 @@ class Database extends AbstractData
private static function _exec($sql, array $params) private static function _exec($sql, array $params)
{ {
$statement = self::$_db->prepare($sql); $statement = self::$_db->prepare($sql);
$result = $statement->execute($params); foreach ($params as $key => &$parameter) {
$position = $key + 1;
if (is_int($parameter)) {
$statement->bindParam($position, $parameter, PDO::PARAM_INT);
} elseif (strlen($parameter) >= 4000) {
$statement->bindParam($position, $parameter, PDO::PARAM_STR, strlen($parameter));
} else {
$statement->bindParam($position, $parameter);
}
}
$result = $statement->execute();
$statement->closeCursor(); $statement->closeCursor();
return $result; return $result;
} }
@ -562,10 +578,24 @@ class Database extends AbstractData
{ {
$statement = self::$_db->prepare($sql); $statement = self::$_db->prepare($sql);
$statement->execute($params); $statement->execute($params);
$result = $firstOnly ? if ($firstOnly) {
$statement->fetch(PDO::FETCH_ASSOC) : $result = $statement->fetch(PDO::FETCH_ASSOC);
$statement->fetchAll(PDO::FETCH_ASSOC); } elseif (self::$_type === 'oci') {
// workaround for https://bugs.php.net/bug.php?id=46728
$result = array();
while ($row = $statement->fetch(PDO::FETCH_ASSOC)) {
$result[] = array_map('self::_sanitizeClob', $row);
}
} else {
$result = $statement->fetchAll(PDO::FETCH_ASSOC);
}
$statement->closeCursor(); $statement->closeCursor();
if (self::$_type === 'oci' && is_array($result)) {
// returned CLOB values are streams, convert these into strings
$result = $firstOnly ?
array_map('self::_sanitizeClob', $result) :
$result;
}
return $result; return $result;
} }
@ -598,14 +628,15 @@ class Database extends AbstractData
{ {
switch ($type) { switch ($type) {
case 'ibm': case 'ibm':
$sql = 'SELECT tabname FROM SYSCAT.TABLES '; $sql = 'SELECT "tabname" FROM "SYSCAT"."TABLES"';
break; break;
case 'informix': case 'informix':
$sql = 'SELECT tabname FROM systables '; $sql = 'SELECT "tabname" FROM "systables"';
break; break;
case 'mssql': case 'mssql':
$sql = 'SELECT name FROM sysobjects ' // U: tables created by the user
. "WHERE type = 'U' ORDER BY name"; $sql = 'SELECT "name" FROM "sysobjects" '
. 'WHERE "type" = \'U\' ORDER BY "name"';
break; break;
case 'mysql': case 'mysql':
$sql = 'SHOW TABLES'; $sql = 'SHOW TABLES';
@ -614,23 +645,23 @@ class Database extends AbstractData
$sql = 'SELECT table_name FROM all_tables'; $sql = 'SELECT table_name FROM all_tables';
break; break;
case 'pgsql': case 'pgsql':
$sql = 'SELECT c.relname AS table_name ' $sql = 'SELECT c."relname" AS "table_name" '
. 'FROM pg_class c, pg_user u ' . 'FROM "pg_class" c, "pg_user" u '
. "WHERE c.relowner = u.usesysid AND c.relkind = 'r' " . 'WHERE c."relowner" = u."usesysid" AND c."relkind" = \'r\' '
. 'AND NOT EXISTS (SELECT 1 FROM pg_views WHERE viewname = c.relname) ' . 'AND NOT EXISTS (SELECT 1 FROM "pg_views" WHERE "viewname" = c."relname") '
. "AND c.relname !~ '^(pg_|sql_)' " . "AND c.\"relname\" !~ '^(pg_|sql_)' "
. 'UNION ' . 'UNION '
. 'SELECT c.relname AS table_name ' . 'SELECT c."relname" AS "table_name" '
. 'FROM pg_class c ' . 'FROM "pg_class" c '
. "WHERE c.relkind = 'r' " . "WHERE c.\"relkind\" = 'r' "
. 'AND NOT EXISTS (SELECT 1 FROM pg_views WHERE viewname = c.relname) ' . 'AND NOT EXISTS (SELECT 1 FROM "pg_views" WHERE "viewname" = c."relname") '
. 'AND NOT EXISTS (SELECT 1 FROM pg_user WHERE usesysid = c.relowner) ' . 'AND NOT EXISTS (SELECT 1 FROM "pg_user" WHERE "usesysid" = c."relowner") '
. "AND c.relname !~ '^pg_'"; . "AND c.\"relname\" !~ '^pg_'";
break; break;
case 'sqlite': case 'sqlite':
$sql = "SELECT name FROM sqlite_master WHERE type='table' " $sql = 'SELECT "name" FROM "sqlite_master" WHERE "type"=\'table\' '
. 'UNION ALL SELECT name FROM sqlite_temp_master ' . 'UNION ALL SELECT "name" FROM "sqlite_temp_master" '
. "WHERE type='table' ORDER BY name"; . 'WHERE "type"=\'table\' ORDER BY "name"';
break; break;
default: default:
throw new Exception( throw new Exception(
@ -652,8 +683,8 @@ class Database extends AbstractData
{ {
try { try {
$row = self::_select( $row = self::_select(
'SELECT value FROM ' . self::_sanitizeIdentifier('config') . 'SELECT "value" FROM "' . self::_sanitizeIdentifier('config') .
' WHERE id = ?', array($key), true '" WHERE "id" = ?', array($key), true
); );
} catch (PDOException $e) { } catch (PDOException $e) {
return ''; return '';
@ -672,10 +703,14 @@ class Database extends AbstractData
private static function _getPrimaryKeyClauses($key = 'dataid') private static function _getPrimaryKeyClauses($key = 'dataid')
{ {
$main_key = $after_key = ''; $main_key = $after_key = '';
if (self::$_type === 'mysql') { switch (self::$_type) {
$after_key = ", PRIMARY KEY ($key)"; case 'mysql':
} else { case 'oci':
$after_key = ", PRIMARY KEY (\"$key\")";
break;
default:
$main_key = ' PRIMARY KEY'; $main_key = ' PRIMARY KEY';
break;
} }
return array($main_key, $after_key); return array($main_key, $after_key);
} }
@ -683,7 +718,7 @@ class Database extends AbstractData
/** /**
* get the data type, depending on the database driver * get the data type, depending on the database driver
* *
* PostgreSQL uses a different API for BLOBs then SQL, hence we use TEXT * PostgreSQL and OCI uses a different API for BLOBs then SQL, hence we use TEXT and CLOB
* *
* @access private * @access private
* @static * @static
@ -691,13 +726,20 @@ class Database extends AbstractData
*/ */
private static function _getDataType() private static function _getDataType()
{ {
return self::$_type === 'pgsql' ? 'TEXT' : 'BLOB'; switch (self::$_type) {
case 'oci':
return 'CLOB';
case 'pgsql':
return 'TEXT';
default:
return 'BLOB';
}
} }
/** /**
* get the attachment type, depending on the database driver * get the attachment type, depending on the database driver
* *
* PostgreSQL uses a different API for BLOBs then SQL, hence we use TEXT * PostgreSQL and OCI use different APIs for BLOBs then SQL, hence we use TEXT and CLOB
* *
* @access private * @access private
* @static * @static
@ -705,7 +747,33 @@ class Database extends AbstractData
*/ */
private static function _getAttachmentType() private static function _getAttachmentType()
{ {
return self::$_type === 'pgsql' ? 'TEXT' : 'MEDIUMBLOB'; switch (self::$_type) {
case 'oci':
return 'CLOB';
case 'pgsql':
return 'TEXT';
default:
return 'MEDIUMBLOB';
}
}
/**
* get the meta type, depending on the database driver
*
* OCI doesn't accept TEXT so it has to be VARCHAR2(4000)
*
* @access private
* @static
* @return string
*/
private static function _getMetaType()
{
switch (self::$_type) {
case 'oci':
return 'VARCHAR2(4000)';
default:
return 'TEXT';
}
} }
/** /**
@ -719,17 +787,18 @@ class Database extends AbstractData
list($main_key, $after_key) = self::_getPrimaryKeyClauses(); list($main_key, $after_key) = self::_getPrimaryKeyClauses();
$dataType = self::_getDataType(); $dataType = self::_getDataType();
$attachmentType = self::_getAttachmentType(); $attachmentType = self::_getAttachmentType();
$metaType = self::_getMetaType();
self::$_db->exec( self::$_db->exec(
'CREATE TABLE ' . self::_sanitizeIdentifier('paste') . ' ( ' . 'CREATE TABLE "' . self::_sanitizeIdentifier('paste') . '" ( ' .
"dataid CHAR(16) NOT NULL$main_key, " . "\"dataid\" CHAR(16) NOT NULL$main_key, " .
"data $attachmentType, " . "\"data\" $attachmentType, " .
'postdate INT, ' . '"postdate" INT, ' .
'expiredate INT, ' . '"expiredate" INT, ' .
'opendiscussion INT, ' . '"opendiscussion" INT, ' .
'burnafterreading INT, ' . '"burnafterreading" INT, ' .
'meta TEXT, ' . "\"meta\" $metaType, " .
"attachment $attachmentType, " . "\"attachment\" $attachmentType, " .
"attachmentname $dataType$after_key );" "\"attachmentname\" $dataType$after_key )"
); );
} }
@ -744,19 +813,35 @@ class Database extends AbstractData
list($main_key, $after_key) = self::_getPrimaryKeyClauses(); list($main_key, $after_key) = self::_getPrimaryKeyClauses();
$dataType = self::_getDataType(); $dataType = self::_getDataType();
self::$_db->exec( self::$_db->exec(
'CREATE TABLE ' . self::_sanitizeIdentifier('comment') . ' ( ' . 'CREATE TABLE "' . self::_sanitizeIdentifier('comment') . '" ( ' .
"dataid CHAR(16) NOT NULL$main_key, " . "\"dataid\" CHAR(16) NOT NULL$main_key, " .
'pasteid CHAR(16), ' . '"pasteid" CHAR(16), ' .
'parentid CHAR(16), ' . '"parentid" CHAR(16), ' .
"data $dataType, " . "\"data\" $dataType, " .
"nickname $dataType, " . "\"nickname\" $dataType, " .
"vizhash $dataType, " . "\"vizhash\" $dataType, " .
"postdate INT$after_key );" "\"postdate\" INT$after_key )"
); );
if (self::$_type === 'oci') {
self::$_db->exec( self::$_db->exec(
'CREATE INDEX IF NOT EXISTS comment_parent ON ' . 'declare
self::_sanitizeIdentifier('comment') . '(pasteid);' already_exists exception;
columns_indexed exception;
pragma exception_init( already_exists, -955 );
pragma exception_init(columns_indexed, -1408);
begin
execute immediate \'create index "comment_parent" on "' . self::_sanitizeIdentifier('comment') . '" ("pasteid")\';
exception
when already_exists or columns_indexed then
NULL;
end;'
); );
} else {
self::$_db->exec(
'CREATE INDEX IF NOT EXISTS "comment_parent" ON "' .
self::_sanitizeIdentifier('comment') . '" ("pasteid")'
);
}
} }
/** /**
@ -768,17 +853,37 @@ class Database extends AbstractData
private static function _createConfigTable() private static function _createConfigTable()
{ {
list($main_key, $after_key) = self::_getPrimaryKeyClauses('id'); list($main_key, $after_key) = self::_getPrimaryKeyClauses('id');
$charType = self::$_type === 'oci' ? 'VARCHAR2(16)' : 'CHAR(16)';
$textType = self::_getMetaType();
self::$_db->exec( self::$_db->exec(
'CREATE TABLE ' . self::_sanitizeIdentifier('config') . 'CREATE TABLE "' . self::_sanitizeIdentifier('config') .
" ( id CHAR(16) NOT NULL$main_key, value TEXT$after_key );" "\" ( \"id\" $charType NOT NULL$main_key, \"value\" $textType$after_key )"
); );
self::_exec( self::_exec(
'INSERT INTO ' . self::_sanitizeIdentifier('config') . 'INSERT INTO "' . self::_sanitizeIdentifier('config') .
' VALUES(?,?)', '" VALUES(?,?)',
array('VERSION', Controller::VERSION) array('VERSION', Controller::VERSION)
); );
} }
/**
* sanitizes CLOB values used with OCI
*
* From: https://stackoverflow.com/questions/36200534/pdo-oci-into-a-clob-field
*
* @access public
* @static
* @param int|string|resource $value
* @return int|string
*/
public static function _sanitizeClob($value)
{
if (is_resource($value)) {
$value = stream_get_contents($value);
}
return $value;
}
/** /**
* sanitizes identifiers * sanitizes identifiers
* *
@ -807,43 +912,46 @@ class Database extends AbstractData
case '0.21': case '0.21':
// create the meta column if necessary (pre 0.21 change) // create the meta column if necessary (pre 0.21 change)
try { try {
self::$_db->exec('SELECT meta FROM ' . self::_sanitizeIdentifier('paste') . ' LIMIT 1;'); self::$_db->exec(
'SELECT "meta" FROM "' . self::_sanitizeIdentifier('paste') . '" ' .
(self::$_type === 'oci' ? 'FETCH NEXT 1 ROWS ONLY' : 'LIMIT 1')
);
} catch (PDOException $e) { } catch (PDOException $e) {
self::$_db->exec('ALTER TABLE ' . self::_sanitizeIdentifier('paste') . ' ADD COLUMN meta TEXT;'); self::$_db->exec('ALTER TABLE "' . self::_sanitizeIdentifier('paste') . '" ADD COLUMN "meta" TEXT');
} }
// SQLite only allows one ALTER statement at a time... // SQLite only allows one ALTER statement at a time...
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('paste') . 'ALTER TABLE "' . self::_sanitizeIdentifier('paste') .
" ADD COLUMN attachment $attachmentType;" "\" ADD COLUMN \"attachment\" $attachmentType"
); );
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('paste') . " ADD COLUMN attachmentname $dataType;" 'ALTER TABLE "' . self::_sanitizeIdentifier('paste') . "\" ADD COLUMN \"attachmentname\" $dataType"
); );
// SQLite doesn't support MODIFY, but it allows TEXT of similar // SQLite doesn't support MODIFY, but it allows TEXT of similar
// size as BLOB, so there is no need to change it there // size as BLOB, so there is no need to change it there
if (self::$_type !== 'sqlite') { if (self::$_type !== 'sqlite') {
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('paste') . 'ALTER TABLE "' . self::_sanitizeIdentifier('paste') .
" ADD PRIMARY KEY (dataid), MODIFY COLUMN data $dataType;" "\" ADD PRIMARY KEY (\"dataid\"), MODIFY COLUMN \"data\" $dataType"
); );
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('comment') . 'ALTER TABLE "' . self::_sanitizeIdentifier('comment') .
" ADD PRIMARY KEY (dataid), MODIFY COLUMN data $dataType, " . "\" ADD PRIMARY KEY (\"dataid\"), MODIFY COLUMN \"data\" $dataType, " .
"MODIFY COLUMN nickname $dataType, MODIFY COLUMN vizhash $dataType;" "MODIFY COLUMN \"nickname\" $dataType, MODIFY COLUMN \"vizhash\" $dataType"
); );
} else { } else {
self::$_db->exec( self::$_db->exec(
'CREATE UNIQUE INDEX IF NOT EXISTS paste_dataid ON ' . 'CREATE UNIQUE INDEX IF NOT EXISTS "paste_dataid" ON "' .
self::_sanitizeIdentifier('paste') . '(dataid);' self::_sanitizeIdentifier('paste') . '" ("dataid")'
); );
self::$_db->exec( self::$_db->exec(
'CREATE UNIQUE INDEX IF NOT EXISTS comment_dataid ON ' . 'CREATE UNIQUE INDEX IF NOT EXISTS "comment_dataid" ON "' .
self::_sanitizeIdentifier('comment') . '(dataid);' self::_sanitizeIdentifier('comment') . '" ("dataid")'
); );
} }
self::$_db->exec( self::$_db->exec(
'CREATE INDEX IF NOT EXISTS comment_parent ON ' . 'CREATE INDEX IF NOT EXISTS "comment_parent" ON "' .
self::_sanitizeIdentifier('comment') . '(pasteid);' self::_sanitizeIdentifier('comment') . '" ("pasteid")'
); );
// no break, continue with updates for 0.22 and later // no break, continue with updates for 0.22 and later
case '1.3': case '1.3':
@ -852,15 +960,15 @@ class Database extends AbstractData
// to change it there // to change it there
if (self::$_type !== 'sqlite' && self::$_type !== 'pgsql') { if (self::$_type !== 'sqlite' && self::$_type !== 'pgsql') {
self::$_db->exec( self::$_db->exec(
'ALTER TABLE ' . self::_sanitizeIdentifier('paste') . 'ALTER TABLE "' . self::_sanitizeIdentifier('paste') .
" MODIFY COLUMN data $attachmentType;" "\" MODIFY COLUMN \"data\" $attachmentType"
); );
} }
// no break, continue with updates for all newer versions // no break, continue with updates for all newer versions
default: default:
self::_exec( self::_exec(
'UPDATE ' . self::_sanitizeIdentifier('config') . 'UPDATE "' . self::_sanitizeIdentifier('config') .
' SET value = ? WHERE id = ?', '" SET "value" = ? WHERE "id" = ?',
array(Controller::VERSION, 'VERSION') array(Controller::VERSION, 'VERSION')
); );
} }

3
lib/I18n.php
View File

@ -195,7 +195,7 @@ class I18n
if (count(self::$_availableLanguages) == 0) { if (count(self::$_availableLanguages) == 0) {
$i18n = dir(self::_getPath()); $i18n = dir(self::_getPath());
while (false !== ($file = $i18n->read())) { while (false !== ($file = $i18n->read())) {
if (preg_match('/^([a-z]{2}).json$/', $file, $match) === 1) { if (preg_match('/^([a-z]{2,3}).json$/', $file, $match) === 1) {
self::$_availableLanguages[] = $match[1]; self::$_availableLanguages[] = $match[1];
} }
} }
@ -324,6 +324,7 @@ class I18n
case 'he': case 'he':
return $n === 1 ? 0 : ($n === 2 ? 1 : (($n < 0 || $n > 10) && ($n % 10 === 0) ? 2 : 3)); return $n === 1 ? 0 : ($n === 2 ? 1 : (($n < 0 || $n > 10) && ($n % 10 === 0) ? 2 : 3));
case 'id': case 'id':
case 'jbo':
return 0; return 0;
case 'lt': case 'lt':
return $n % 10 === 1 && $n % 100 !== 11 ? 0 : (($n % 10 >= 2 && $n % 100 < 10 || $n % 100 >= 20) ? 1 : 2); return $n % 10 === 1 && $n % 100 !== 11 ? 0 : (($n % 10 >= 2 && $n % 100 < 10 || $n % 100 >= 20) ? 1 : 2);

4
tpl/bootstrap.php
View File

@ -41,7 +41,7 @@ if ($SYNTAXHIGHLIGHTING) :
endif; endif;
?> ?>
<noscript><link type="text/css" rel="stylesheet" href="css/noscript.css" /></noscript> <noscript><link type="text/css" rel="stylesheet" href="css/noscript.css" /></noscript>
<script type="text/javascript" data-cfasync="false" src="js/jquery-3.4.1.js" integrity="sha512-bnIvzh6FU75ZKxp0GXLH9bewza/OIw6dLVh9ICg0gogclmYGguQJWl8U30WpbsGTqbIiAwxTsbe76DErLq5EDQ==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/jquery-3.6.0.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4=" crossorigin="anonymous"></script>
<?php <?php
if ($QRCODE) : if ($QRCODE) :
?> ?>
@ -72,7 +72,7 @@ endif;
?> ?>
<script type="text/javascript" data-cfasync="false" src="js/purify-2.2.7.js" integrity="sha512-7Ka1I/nJuR2CL8wzIS5PJS4HgEMd0HJ6kfAl6fFhwFBB27rhztFbe0tS+Ex+Qg+5n4nZIT4lty4k4Di3+X9T4A==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/purify-2.2.7.js" integrity="sha512-7Ka1I/nJuR2CL8wzIS5PJS4HgEMd0HJ6kfAl6fFhwFBB27rhztFbe0tS+Ex+Qg+5n4nZIT4lty4k4Di3+X9T4A==" crossorigin="anonymous"></script>
<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-lJwDAY69TQuYQZ7FjUFPfhgYeZ2L6y5bmGt1hR+d3kMm2sddivGr7ZDdLLSe/CBgn1JrsKMj3th9dPyXN3dLHw==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-PTOcxIWIPWCnb5vC4fmQDMqYGerwsu3AndVyPxn9NlQffIWYMPf/p28Z9SIygXsmcYjmTRmUiW5y7df63mNTfg==" crossorigin="anonymous"></script>
<!-- icon --> <!-- icon -->
<link rel="apple-touch-icon" href="<?php echo I18n::encode($BASEPATH); ?>img/apple-touch-icon.png" sizes="180x180" /> <link rel="apple-touch-icon" href="<?php echo I18n::encode($BASEPATH); ?>img/apple-touch-icon.png" sizes="180x180" />
<link rel="icon" type="image/png" href="img/favicon-32x32.png" sizes="32x32" /> <link rel="icon" type="image/png" href="img/favicon-32x32.png" sizes="32x32" />

4
tpl/page.php
View File

@ -20,7 +20,7 @@ if ($SYNTAXHIGHLIGHTING):
endif; endif;
endif; endif;
?> ?>
<script type="text/javascript" data-cfasync="false" src="js/jquery-3.4.1.js" integrity="sha512-bnIvzh6FU75ZKxp0GXLH9bewza/OIw6dLVh9ICg0gogclmYGguQJWl8U30WpbsGTqbIiAwxTsbe76DErLq5EDQ==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/jquery-3.6.0.js" integrity="sha512-bnIvzh6FU75ZKxp0GXLH9bewza/OIw6dLVh9ICg0gogclmYGguQJWl8U30WpbsGTqbIiAwxTsbe76DErLq5EDQ==" crossorigin="anonymous"></script>
<?php <?php
if ($QRCODE): if ($QRCODE):
?> ?>
@ -50,7 +50,7 @@ endif;
?> ?>
<script type="text/javascript" data-cfasync="false" src="js/purify-2.2.7.js" integrity="sha512-7Ka1I/nJuR2CL8wzIS5PJS4HgEMd0HJ6kfAl6fFhwFBB27rhztFbe0tS+Ex+Qg+5n4nZIT4lty4k4Di3+X9T4A==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/purify-2.2.7.js" integrity="sha512-7Ka1I/nJuR2CL8wzIS5PJS4HgEMd0HJ6kfAl6fFhwFBB27rhztFbe0tS+Ex+Qg+5n4nZIT4lty4k4Di3+X9T4A==" crossorigin="anonymous"></script>
<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-lJwDAY69TQuYQZ7FjUFPfhgYeZ2L6y5bmGt1hR+d3kMm2sddivGr7ZDdLLSe/CBgn1JrsKMj3th9dPyXN3dLHw==" crossorigin="anonymous"></script> <script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-PTOcxIWIPWCnb5vC4fmQDMqYGerwsu3AndVyPxn9NlQffIWYMPf/p28Z9SIygXsmcYjmTRmUiW5y7df63mNTfg==" crossorigin="anonymous"></script>
<!-- icon --> <!-- icon -->
<link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" /> <link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" />
<link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" /> <link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" />

2
tst/Bootstrap.php
View File

@ -304,7 +304,7 @@ class StorageObjectStub extends StorageObject
$this->_generation = $generation; $this->_generation = $generation;
$this->_info = $info; $this->_info = $info;
$this->_connection = $connection; $this->_connection = $connection;
$timeCreated = new Datetime(); $timeCreated = new DateTime();
$this->_info['metadata']['timeCreated'] = $timeCreated->format('Y-m-d\TH:i:s.u\Z'); $this->_info['metadata']['timeCreated'] = $timeCreated->format('Y-m-d\TH:i:s.u\Z');
} }

12
tst/Data/DatabaseTest.php
View File

@ -388,4 +388,16 @@ class DatabaseTest extends PHPUnit_Framework_TestCase
$this->assertEquals(Controller::VERSION, $result['value']); $this->assertEquals(Controller::VERSION, $result['value']);
Helper::rmDir($this->_path); Helper::rmDir($this->_path);
} }
public function testOciClob()
{
$int = (int) random_bytes(1);
$string = random_bytes(10);
$clob = fopen('php://memory', 'r+');
fwrite($clob, $string);
rewind($clob);
$this->assertEquals($int, Database::_sanitizeClob($int));
$this->assertEquals($string, Database::_sanitizeClob($string));
$this->assertEquals($string, Database::_sanitizeClob($clob));
}
} }