diff --git a/CHANGELOG b/CHANGELOG index 9a26b563..1090e03a 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,10 @@ +=== ** v1.0.8 ** === + +* [BUG] Corregido error al guardar claves con carácteres especiales +* [BUG] Corregido error al guardar el idioma tras la instalación +* [MOD] Verificación de versión de PHP en la instalación +* [MOD] Actualización de traducciones + === ** v1.0.7 ** === * [BUG] Corregido error en la selección del código de caráteres del lenguaje @@ -172,6 +179,13 @@ --- +=== ** v1.0.8 ** === + +* [BUG] Fixed error on saving passwords with special characters. Thanks to @chadrempp +* [BUG] Fixed error on saving detected browser language after installing +* [MOD] PHP version is verified on installation process +* [MOD] Translations updates + === ** v1.0.7 ** === * [BUG] Fixed error on language charset selection diff --git a/ajax/ajax_accountsave.php b/ajax/ajax_accountsave.php index 2d34d268..efcf8c08 100644 --- a/ajax/ajax_accountsave.php +++ b/ajax/ajax_accountsave.php @@ -45,8 +45,8 @@ $frmSelCustomer = SP_Common::parseParams('p', 'customerId', 0); $frmNewCustomer = SP_Common::parseParams('p', 'customer_new'); $frmName = SP_Common::parseParams('p', 'name'); $frmLogin = SP_Common::parseParams('p', 'login'); -$frmPassword = SP_Common::parseParams('p', 'password'); -$frmPasswordV = SP_Common::parseParams('p', 'password2'); +$frmPassword = SP_Common::parseParams('p', 'password', '', false, false, false); +$frmPasswordV = SP_Common::parseParams('p', 'password2', '', false, false, false); $frmCategoryId = SP_Common::parseParams('p', 'categoryId', 0); $frmUGroups = SP_Common::parseParams('p', 'ugroups'); $frmNotes = SP_Common::parseParams('p', 'notice'); diff --git a/ajax/ajax_configsave.php b/ajax/ajax_configsave.php index a247889c..9e008fa9 100644 --- a/ajax/ajax_configsave.php +++ b/ajax/ajax_configsave.php @@ -63,7 +63,7 @@ if ($frmAction == "config") { $frmLdapBase = SP_Common::parseParams('p', 'ldapbase'); $frmLdapGroup = SP_Common::parseParams('p', 'ldapgroup'); $frmLdapBindUser = SP_Common::parseParams('p', 'ldapbinduser'); - $frmLdapBindPass = SP_Common::parseParams('p', 'ldapbindpass'); + $frmLdapBindPass = SP_Common::parseParams('p', 'ldapbindpass', '', false, false, false); $frmMailEnabled = SP_Common::parseParams('p', 'mailenabled', 0, FALSE, 1); $frmMailServer = SP_Common::parseParams('p', 'mailserver'); @@ -133,9 +133,9 @@ if ($frmAction == "config") { SP_Common::printXML(_('Configuración actualizada'), 0); } elseif ($frmAction == "crypt") { - $currentMasterPass = SP_Common::parseParams('p', 'curMasterPwd'); - $newMasterPass = SP_Common::parseParams('p', 'newMasterPwd'); - $newMasterPassR = SP_Common::parseParams('p', 'newMasterPwdR'); + $currentMasterPass = SP_Common::parseParams('p', 'curMasterPwd', '', false, false, false); + $newMasterPass = SP_Common::parseParams('p', 'newMasterPwd', '', false, false, false); + $newMasterPassR = SP_Common::parseParams('p', 'newMasterPwdR', '', false, false, false); $confirmPassChange = SP_Common::parseParams('p', 'confirmPassChange', 0, FALSE, 1); $noAccountPassChange = SP_Common::parseParams('p', 'chkNoAccountChange', 0, FALSE, 1); diff --git a/ajax/ajax_doLogin.php b/ajax/ajax_doLogin.php index 29f240da..6aaf0aa7 100644 --- a/ajax/ajax_doLogin.php +++ b/ajax/ajax_doLogin.php @@ -33,7 +33,7 @@ if ( ! SP_Common::parseParams('p', 'login', FALSE) ){ } $userLogin = SP_Common::parseParams('p', 'user'); -$userPass = SP_Common::parseParams('p', 'pass'); +$userPass = SP_Common::parseParams('p', 'pass', '', false, false, false); $masterPass = SP_Common::parseParams('p', 'mpass'); if ( ! $userLogin OR ! $userPass ){ diff --git a/ajax/ajax_usersSave.php b/ajax/ajax_usersSave.php index 48a16464..23fdca60 100644 --- a/ajax/ajax_usersSave.php +++ b/ajax/ajax_usersSave.php @@ -55,8 +55,8 @@ if ($frmSaveType == 1 || $frmSaveType == 2) { $frmUsrGroup = SP_Common::parseParams('p', 'groupid', 0); $frmUsrEmail = SP_Common::parseParams('p', 'email'); $frmUsrNotes = SP_Common::parseParams('p', 'notes'); - $frmUsrPass = SP_Common::parseParams('p', 'pass'); - $frmUsrPassV = SP_Common::parseParams('p', 'passv'); + $frmUsrPass = SP_Common::parseParams('p', 'pass', '', false, false, false); + $frmUsrPassV = SP_Common::parseParams('p', 'passv', '', false, false, false); $frmAdminApp = SP_Common::parseParams('p', 'adminapp', 0, FALSE, 1); $frmAdminAcc = SP_Common::parseParams('p', 'adminacc', 0, FALSE, 1); $frmDisabled = SP_Common::parseParams('p', 'disabled', 0, FALSE, 1); diff --git a/inc/common.class.php b/inc/common.class.php index 15bcb8be..829c345c 100644 --- a/inc/common.class.php +++ b/inc/common.class.php @@ -215,7 +215,7 @@ class SP_Common { * @param mixed $force opcional, valor devuelto si el parámeto está definido * @return boo|string si está presente el parámeto en la petición devuelve bool. Si lo está, devuelve el valor. */ - public static function parseParams($method, $param, $default = '', $onlyCHeck = FALSE, $force = FALSE){ + public static function parseParams($method, $param, $default = '', $onlyCHeck = FALSE, $force = FALSE, $sanitize = TRUE){ $out = ''; switch ($method){ @@ -254,7 +254,7 @@ class SP_Common { } if (is_string($out)){ - return ( $method != 's' ) ? SP_Html::sanitize($out) : $out; + return ( $method != 's' && $sanitize === TRUE ) ? SP_Html::sanitize($out) : $out; } if (is_array($out)){ diff --git a/inc/config.class.php b/inc/config.class.php index 01f1c089..e41fbf2e 100644 --- a/inc/config.class.php +++ b/inc/config.class.php @@ -391,7 +391,9 @@ class SP_Config{ self::setValue('mailenabled', 0); self::setValue('wikienabled', 0); self::setValue('demoenabled', 0); - + self::setValue('filesenabled', 1); + self::setValue('checkupdates', 1); + self::setValue('allowed_exts', 'PDF,JPG,GIF,PNG,ODT,ODS,DOC,DOCX,XLS,XSL,VSD,TXT,CSV,BAK'); self::setValue('allowed_size', 1024); self::setValue('wikisearchurl', ''); @@ -404,7 +406,7 @@ class SP_Config{ self::setValue('mailserver', ''); self::setValue('mailfrom', ''); self::setValue('wikifilter', ''); - self::setValue('sitelang', 'es_ES'); + self::setValue('sitelang', str_replace('.utf8','',SP_Init::$LANG)); self::setValue('session_timeout', '300'); self::setValue('account_link', 1); self::setValue('account_count', 10); diff --git a/inc/db.class.php b/inc/db.class.php index 9d8cc773..e826f903 100644 --- a/inc/db.class.php +++ b/inc/db.class.php @@ -167,13 +167,13 @@ class DB { ." WHERE table_schema='".SP_Config::getValue("dbname")."' " . "AND table_name = 'usrData';"; - $resquery = self::$_db->query($query); + $resQuery = self::$_db->query($query); - if( $resquery ) { - $row = $resquery->fetch_row(); + if( $resQuery ) { + $row = $resQuery->fetch_row(); } - if( ! $resquery || $row[0] == 0) { + if( ! $resQuery || $row[0] == 0) { return false; } diff --git a/inc/locales/en_US/LC_MESSAGES/messages.mo b/inc/locales/en_US/LC_MESSAGES/messages.mo index 8ec5177c..4f2e1d41 100644 Binary files a/inc/locales/en_US/LC_MESSAGES/messages.mo and b/inc/locales/en_US/LC_MESSAGES/messages.mo differ diff --git a/inc/tpl/install.php b/inc/tpl/install.php index ec655dea..f2f1f878 100644 --- a/inc/tpl/install.php +++ b/inc/tpl/install.php @@ -22,7 +22,8 @@ * along with sysPass. If not, see . * */ -$errors = SP_Util::checkModules(); +$modulesErrors = SP_Util::checkModules(); +$versionErrors = SP_Util::checkPhpVersion(); $resInstall = array(); $isCompleted = 0; @@ -32,7 +33,7 @@ if (isset($_POST['install']) AND $_POST['install'] == 'true') { if (count($resInstall) == 0) { $resInstall[] = array('type' => 'ok', 'description' => _('Instalación finalizada'), - 'hint' => 'Pulse aquí para acceder'); + 'hint' => _('Pulse aquí para acceder')); $isCompleted = 1; } } @@ -48,18 +49,20 @@ if (isset($_POST['install']) AND $_POST['install'] == 'true') { 'warning', + $securityErrors[] = array('type' => 'warning', 'description' => _('La version de PHP es vulnerable al ataque NULL Byte (CVE-2006-7243)'), 'hint' => _('Actualice la versión de PHP para usar sysPass de forma segura')); } if (!SP_Util::secureRNG_available()) { - $errors[] = array('type' => 'warning', + $securityErrors[] = array('type' => 'warning', 'description' => _('No se encuentra el generador de números aleatorios.'), 'hint' => _('Sin esta función un atacante puede utilizar su cuenta al resetear la clave')); } -$errors = array_merge($errors, $resInstall); +$errors = array_merge($modulesErrors, $versionErrors, $securityErrors, $resInstall); if (count($errors) > 0) { echo '