Skip to content

Commit a50ebfe

Browse files
oleibmanoleibman
committed
Backport Security Patches for Samples
1 parent a78ceaa commit a50ebfe

File tree

6 files changed

+33
-13
lines changed

6 files changed

+33
-13
lines changed

‎.github/workflows/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,3 +267,4 @@ jobs:
267267
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
268268
with:
269269
bodyFile: release-body.txt
270+
makeLatest: false

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ and this project adheres to [Semantic Versioning](https://semver.org).
1313

1414
### Fixed
1515

16-
- More context options may be needed for http(s) image. Backport of [PR #4276](https://github.com/PHPOffice/PhpSpreadsheet/pull/4276)
16+
- More context options may be needed for http(s) image. Backport of [PR #4276](https://github.com/PHPOffice/PhpSpreadsheet/pull/4276)
17+
- Backported security patches for Samples.
1718

1819
## 1.29.6 - 2024-12-08
1920

‎samples/Calculations/Engineering/Convert-Online.php‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
}
1515

1616
$categories = ConvertUOM::getConversionCategories();
17+
$defaultCategory = $_POST['category'] ?? $categories[0];
1718
$units = [];
1819
foreach ($categories as $category) {
1920
$categoryUnits = ConvertUOM::getConversionCategoryUnitDetails($category)[$category];
@@ -48,7 +49,7 @@
4849
<label for="fromUnit" class="col-sm-2 col-form-label">From Unit</label>
4950
<div class="col-sm-10">
5051
<select name="fromUnit" class="form-select">
51-
<?php foreach ($units[$_POST['category']] as $fromUnitCode => $fromUnitName) {
52+
<?php foreach ($units[$defaultCategory] as $fromUnitCode => $fromUnitName) {
5253
echo "<option value=\"{$fromUnitCode}\" " . ((isset($_POST['fromUnit']) && $_POST['fromUnit'] === $fromUnitCode) ? 'selected' : '') . ">{$fromUnitName}</option>", PHP_EOL;
5354
} ?>
5455
</select>
@@ -58,7 +59,7 @@
5859
<label for="toUnit" class="col-sm-2 col-form-label">To Unit</label>
5960
<div class="col-sm-10">
6061
<select name="toUnit" class="form-select">
61-
<?php foreach ($units[$_POST['category']] as $toUnitCode => $toUnitName) {
62+
<?php foreach ($units[$defaultCategory] as $toUnitCode => $toUnitName) {
6263
echo "<option value=\"{$toUnitCode}\" " . ((isset($_POST['toUnit']) && $_POST['toUnit'] === $toUnitCode) ? 'selected' : '') . ">{$toUnitName}</option>", PHP_EOL;
6364
} ?>
6465
</select>
@@ -73,11 +74,20 @@
7374

7475
<?php
7576
/** If the user has submitted the form, then we need to calculate the value and display the result */
76-
if (isset($_POST['submit'])) {
77+
if (isset($_POST['quantity'], $_POST['fromUnit'], $_POST['toUnit'])) {
7778
$quantity = $_POST['quantity'];
7879
$fromUnit = $_POST['fromUnit'];
7980
$toUnit = $_POST['toUnit'];
80-
$result = ConvertUOM::CONVERT($quantity, $fromUnit, $toUnit);
81+
if (!is_numeric($quantity)) {
82+
$helper->log('Quantity is not numeric');
83+
} elseif (isset($units[$_POST['category']][$fromUnit], $units[$_POST['category']][$toUnit])) {
84+
/** @var float|string */
85+
$result = ConvertUOM::CONVERT($quantity, $fromUnit, $toUnit);
8186

82-
echo "{$quantity} {$units[$_POST['category']][$fromUnit]} is {$result} {$units[$_POST['category']][$toUnit]}", PHP_EOL;
87+
$helper->log("{$quantity} {$units[$_POST['category']][$fromUnit]} is {$result} {$units[$_POST['category']][$toUnit]}");
88+
} else {
89+
$helper->log('Please enter quantity and select From Unit and To Unit');
90+
}
91+
} else {
92+
$helper->log('Please enter quantity and select From Unit and To Unit');
8393
}

‎samples/Wizards/NumberFormat/Accounting.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,8 @@
8585
$helper->log('The Sample Number Value must be numeric');
8686
} elseif (!is_numeric($_POST['decimals']) || strpos($_POST['decimals'], '.') !== false || (int) $_POST['decimals'] < 0) {
8787
$helper->log('The Decimal Places value must be positive integer');
88+
} elseif (!in_array($_POST['currency'], array_keys($currencies), true)) {
89+
$helper->log('Unrecognized currency symbol');
8890
} else {
8991
try {
9092
$wizard = new Wizard\Accounting($_POST['currency'], $_POST['decimals'], isset($_POST['thousands']), (bool) $_POST['position'], (bool) $_POST['spacing']);
@@ -93,12 +95,14 @@
9395
$helper->log('<hr /><b>Code:</b><br />');
9496
$helper->log('use PhpOffice\PhpSpreadsheet\Style\NumberFormat\Wizard;');
9597
$helper->log(
96-
"\$mask = Wizard\\Accounting('{$_POST['currency']}', {$_POST['decimals']}, Wizard\\Number::" .
98+
"\$wizard = new Wizard\\Accounting('{$_POST['currency']}', {$_POST['decimals']}, Wizard\\Number::" .
9799
(isset($_POST['thousands']) ? 'WITH_THOUSANDS_SEPARATOR' : 'WITHOUT_THOUSANDS_SEPARATOR') .
98100
', Wizard\Currency::' . (((bool) $_POST['position']) ? 'LEADING_SYMBOL' : 'TRAILING_SYMBOL') .
99101
', Wizard\Currency::' . (((bool) $_POST['spacing']) ? 'SYMBOL_WITH_SPACING' : 'SYMBOL_WITHOUT_SPACING') .
100-
');<br />'
102+
');'
101103
);
104+
$helper->log('$mask = $wizard->format();');
105+
$helper->log('<br />');
102106
$helper->log('echo (string) $mask;');
103107
$helper->log('<hr /><b>Mask:</b><br />');
104108
$helper->log($mask . '<br />');

‎samples/Wizards/NumberFormat/Currency.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,8 @@
8585
$helper->log('The Sample Number Value must be numeric');
8686
} elseif (!is_numeric($_POST['decimals']) || strpos($_POST['decimals'], '.') !== false || (int) $_POST['decimals'] < 0) {
8787
$helper->log('The Decimal Places value must be positive integer');
88+
} elseif (!in_array($_POST['currency'], array_keys($currencies), true)) {
89+
$helper->log('Unrecognized currency symbol');
8890
} else {
8991
try {
9092
$wizard = new Wizard\Currency($_POST['currency'], $_POST['decimals'], isset($_POST['thousands']), (bool) $_POST['position'], (bool) $_POST['spacing']);
@@ -93,12 +95,14 @@
9395
$helper->log('<hr /><b>Code:</b><br />');
9496
$helper->log('use PhpOffice\PhpSpreadsheet\Style\NumberFormat\Wizard;');
9597
$helper->log(
96-
"\$mask = Wizard\\Currency('{$_POST['currency']}', {$_POST['decimals']}, Wizard\\Number::" .
98+
"\$wizard = new Wizard\\Currency('{$_POST['currency']}', {$_POST['decimals']}, Wizard\\Number::" .
9799
(isset($_POST['thousands']) ? 'WITH_THOUSANDS_SEPARATOR' : 'WITHOUT_THOUSANDS_SEPARATOR') .
98100
', Wizard\Currency::' . (((bool) $_POST['position']) ? 'LEADING_SYMBOL' : 'TRAILING_SYMBOL') .
99101
', Wizard\Currency::' . (((bool) $_POST['spacing']) ? 'SYMBOL_WITH_SPACING' : 'SYMBOL_WITHOUT_SPACING') .
100-
');<br />'
102+
');'
101103
);
104+
$helper->log('$mask = $wizard->format();');
105+
$helper->log('<br />');
102106
$helper->log('echo (string) $mask;');
103107
$helper->log('<hr /><b>Mask:</b><br />');
104108
$helper->log($mask . '<br />');

‎src/PhpSpreadsheet/Helper/Downloader.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,18 @@ class Downloader
2424
public function __construct(string $folder, string $filename, ?string $filetype = null)
2525
{
2626
if ((is_dir($folder) === false) || (is_readable($folder) === false)) {
27-
throw new Exception("Folder {$folder} is not accessable");
27+
throw new Exception('Folder is not accessible');
2828
}
2929
$filepath = "{$folder}/{$filename}";
3030
$this->filepath = (string) realpath($filepath);
3131
$this->filename = basename($filepath);
3232
if ((file_exists($this->filepath) === false) || (is_readable($this->filepath) === false)) {
33-
throw new Exception("{$this->filename} not found, or cannot be read");
33+
throw new Exception('File not found, or cannot be read');
3434
}
3535

3636
$filetype ??= pathinfo($filename, PATHINFO_EXTENSION);
3737
if (array_key_exists(strtolower($filetype), self::CONTENT_TYPES) === false) {
38-
throw new Exception("Invalid filetype: {$filetype} cannot be downloaded");
38+
throw new Exception('Invalid filetype: cannot be downloaded');
3939
}
4040
$this->filetype = strtolower($filetype);
4141
}

0 commit comments

Comments
 (0)