Prepare Joomla! 5.1.0-alpha4

joomla · Feb 11, 2024 · 05bdf0b · 05bdf0b
1 parent 6c636c9
commit 05bdf0b
Show file tree

Hide file tree

Showing 47 changed files with 206 additions and 26 deletions.
diff --git a/administrator/components/com_banners/forms/banner.xml b/administrator/components/com_banners/forms/banner.xml
@@ -301,6 +301,9 @@
 			<field
 				name="imageurl"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_BANNERS_FIELD_IMAGE_LABEL"
 				directory="banners"
 				hide_none="1"

diff --git a/administrator/components/com_categories/forms/category.xml b/administrator/components/com_categories/forms/category.xml
@@ -234,6 +234,9 @@
 				<field
 					name="image"
 					type="media"
+					schemes="http,https,ftp,ftps,data,file"
+					validate="url"
+					relative="true"
 					label="COM_CATEGORIES_FIELD_IMAGE_LABEL"
 				/>
 

diff --git a/administrator/components/com_config/forms/application.xml b/administrator/components/com_config/forms/application.xml
@@ -1022,6 +1022,9 @@
 		<field
 			name="offline_image"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONFIG_FIELD_OFFLINE_IMAGE_LABEL"
 			showon="offline:1"
 		/>

diff --git a/administrator/components/com_contact/config.xml b/administrator/components/com_contact/config.xml
@@ -253,6 +253,9 @@
 		<field
 			name="image"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_PARAMS_IMAGE_LABEL"
 			default=""
 			showon="show_info:1[AND]show_image:1"
@@ -410,6 +413,9 @@
 		<field
 			name="icon_address"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_ICONS_ADDRESS_LABEL"
 			hide_none="1"
 			default=""
@@ -419,6 +425,9 @@
 		<field
 			name="icon_email"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_ICONS_EMAIL_LABEL"
 			hide_none="1"
 			default=""
@@ -428,6 +437,9 @@
 		<field
 			name="icon_telephone"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_ICONS_TELEPHONE_LABEL"
 			hide_none="1"
 			default=""
@@ -437,6 +449,9 @@
 		<field
 			name="icon_mobile"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_ICONS_MOBILE_LABEL"
 			hide_none="1"
 			default=""
@@ -446,6 +461,9 @@
 		<field
 			name="icon_fax"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_ICONS_FAX_LABEL"
 			hide_none="1"
 			default=""
@@ -455,6 +473,9 @@
 		<field
 			name="icon_webpage"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_ICONS_WEBPAGE_LABEL"
 			hide_none="1"
 			default=""
@@ -464,6 +485,9 @@
 		<field
 			name="icon_misc"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_ICONS_MISC_LABEL"
 			hide_none="1"
 			default=""

diff --git a/administrator/components/com_contact/forms/contact.xml b/administrator/components/com_contact/forms/contact.xml
@@ -211,6 +211,9 @@
 		<field
 			name="image"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_PARAMS_IMAGE_LABEL"
 			hide_none="1"
 		/>

diff --git a/administrator/components/com_content/forms/article.xml b/administrator/components/com_content/forms/article.xml
@@ -723,6 +723,9 @@
 				name="image_intro"
 				type="media"
 				label="COM_CONTENT_FIELD_INTRO_LABEL"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 			/>
 
 			<field
@@ -759,6 +762,9 @@
 			<field
 				name="image_fulltext"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_CONTENT_FIELD_FULL_LABEL"
 			/>
 

diff --git a/administrator/components/com_languages/tmpl/installed/default.php b/administrator/components/com_languages/tmpl/installed/default.php
@@ -119,10 +119,10 @@
                                 <?php echo $this->escape($row->author); ?>
                             </td>
                             <td class="d-none d-md-table-cell text-center">
-                                <?php echo PunycodeHelper::emailToUTF8($this->escape($row->authorEmail)); ?>
+                                <?php echo $this->escape(PunycodeHelper::emailToUTF8($this->escape($row->authorEmail))); ?>
                             </td>
                             <td class="d-none d-md-table-cell text-center">
-                                <?php echo $this->escape($row->extension_id); ?>
+                                <?php echo $this->escape(PunycodeHelper::emailToUTF8($row->extension_id)); ?>
                             </td>
                         </tr>
                     <?php endforeach; ?>

diff --git a/administrator/components/com_menus/forms/item_alias.xml b/administrator/components/com_menus/forms/item_alias.xml
@@ -58,6 +58,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_menus/forms/item_component.xml b/administrator/components/com_menus/forms/item_component.xml
@@ -27,6 +27,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_menus/forms/item_heading.xml b/administrator/components/com_menus/forms/item_heading.xml
@@ -28,6 +28,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_menus/forms/item_separator.xml b/administrator/components/com_menus/forms/item_separator.xml
@@ -23,6 +23,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_menus/forms/item_url.xml b/administrator/components/com_menus/forms/item_url.xml
@@ -54,6 +54,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_menus/forms/itemadmin_alias.xml b/administrator/components/com_menus/forms/itemadmin_alias.xml
@@ -38,6 +38,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_menus/forms/itemadmin_component.xml b/administrator/components/com_menus/forms/itemadmin_component.xml
@@ -22,6 +22,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_menus/forms/itemadmin_container.xml b/administrator/components/com_menus/forms/itemadmin_container.xml
@@ -35,6 +35,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_menus/forms/itemadmin_heading.xml b/administrator/components/com_menus/forms/itemadmin_heading.xml
@@ -35,6 +35,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_menus/forms/itemadmin_url.xml b/administrator/components/com_menus/forms/itemadmin_url.xml
@@ -52,6 +52,9 @@
 			<field
 				name="menu_image"
 				type="media"
+				schemes="http,https,ftp,ftps,data,file"
+				validate="url"
+				relative="true"
 				label="COM_MENUS_ITEM_FIELD_MENU_IMAGE_LABEL"
 			/>
 

diff --git a/administrator/components/com_newsfeeds/forms/newsfeed.xml b/administrator/components/com_newsfeeds/forms/newsfeed.xml
@@ -242,6 +242,9 @@
 				<field
 					name="image_first"
 					type="media"
+					schemes="http,https,ftp,ftps,data,file"
+					validate="url"
+					relative="true"
 					label="COM_NEWSFEEDS_FIELD_FIRST_LABEL"
 				/>
 
@@ -285,6 +288,9 @@
 				<field
 					name="image_second"
 					type="media"
+					schemes="http,https,ftp,ftps,data,file"
+					validate="url"
+					relative="true"
 					label="COM_NEWSFEEDS_FIELD_SECOND_LABEL"
 				/>
 

diff --git a/administrator/components/com_tags/config.xml b/administrator/components/com_tags/config.xml
@@ -73,6 +73,9 @@
 		<field
 			name="tag_list_image"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_TAGS_TAG_LIST_MEDIA_LABEL"
 		/>
 

diff --git a/administrator/components/com_tags/forms/tag.xml b/administrator/components/com_tags/forms/tag.xml
@@ -248,6 +248,9 @@
 				<field
 					name="image_intro"
 					type="media"
+					schemes="http,https,ftp,ftps,data,file"
+					validate="url"
+					relative="true"
 					label="COM_TAGS_FIELD_INTRO_LABEL"
 				/>
 
@@ -280,6 +283,9 @@
 				<field
 					name="image_fulltext"
 					type="media"
+					schemes="http,https,ftp,ftps,data,file"
+					validate="url"
+					relative="true"
 					label="COM_TAGS_FIELD_FULL_LABEL"
 				/>
 

diff --git a/administrator/components/com_users/src/Controller/MethodController.php b/administrator/components/com_users/src/Controller/MethodController.php
@@ -21,6 +21,7 @@
 use Joomla\CMS\User\User;
 use Joomla\CMS\User\UserFactoryAwareInterface;
 use Joomla\CMS\User\UserFactoryAwareTrait;
+use Joomla\CMS\User\UserHelper;
 use Joomla\Component\Users\Administrator\Helper\Mfa as MfaHelper;
 use Joomla\Component\Users\Administrator\Model\BackupcodesModel;
 use Joomla\Component\Users\Administrator\Model\MethodModel;
@@ -387,6 +388,9 @@ public function save($cachable = false, $urlparams = []): void
             return;
         }
 
+        // Method updated, destroy other active sessions
+        UserHelper::destroyUserSessions($userId, true);
+
         $this->setRedirect($url);
     }
 

diff --git a/administrator/components/com_users/tmpl/users/default.php b/administrator/components/com_users/tmpl/users/default.php
@@ -186,7 +186,7 @@
                                     </a>
                                 </td>
                                 <td class="d-none d-xl-table-cell break-word">
-                                    <?php echo PunycodeHelper::emailToUTF8($this->escape($item->email)); ?>
+                                    <?php echo $this->escape(PunycodeHelper::emailToUTF8($this->escape($item->email))); ?>
                                 </td>
                                 <td class="d-none d-xl-table-cell">
                                     <?php if ($item->lastvisitDate !== null) : ?>

diff --git a/administrator/language/en-GB/lib_joomla.ini b/administrator/language/en-GB/lib_joomla.ini
@@ -348,6 +348,7 @@ JLIB_FORM_VALIDATE_FIELD_INVALID="Invalid field: %s"
 JLIB_FORM_VALIDATE_FIELD_REQUIRED="Field required: %s"
 JLIB_FORM_VALIDATE_FIELD_RULE_MISSING="Validation Rule missing: %s"
 JLIB_FORM_VALIDATE_FIELD_URL_SCHEMA_MISSING="Invalid URL: URL schema is missing in %1$s. Please add one of the following at the beginning: %2$s."
+JLIB_FORM_VALIDATE_FIELD_URL_INJECTION_DETECTED="Invalid URL: A code injection has been detected in %1$s."
 JLIB_FORM_VALUE_CACHE_APCU="APC User Cache"
 JLIB_FORM_VALUE_CACHE_FILE="File"
 JLIB_FORM_VALUE_CACHE_MEMCACHED="Memcached (Experimental)"

diff --git a/administrator/templates/atum/templateDetails.xml b/administrator/templates/atum/templateDetails.xml
@@ -118,6 +118,9 @@
 					<field
 						name="loginLogo"
 						type="media"
+						schemes="http,https,ftp,ftps,data,file"
+						validate="url"
+						relative="true"
 						label="TPL_ATUM_IMAGE_LABEL"
 					/>
 					<field
@@ -136,6 +139,9 @@
 					<field
 						name="logoBrandLarge"
 						type="media"
+						schemes="http,https,ftp,ftps,data,file"
+						validate="url"
+						relative="true"
 						label="TPL_ATUM_IMAGE_LABEL"
 					/>
 					<field
@@ -154,6 +160,9 @@
 					<field
 						name="logoBrandSmall"
 						type="media"
+						schemes="http,https,ftp,ftps,data,file"
+						validate="url"
+						relative="true"
 						label="TPL_ATUM_IMAGE_LABEL"
 					/>
 					<field

diff --git a/components/com_contact/forms/form.xml b/components/com_contact/forms/form.xml
@@ -111,6 +111,9 @@
 		<field
 			name="image"
 			type="media"
+			schemes="http,https,ftp,ftps,data,file"
+			validate="url"
+			relative="true"
 			label="COM_CONTACT_FIELD_PARAMS_IMAGE_LABEL"
 			hide_none="1"
 		/>

diff --git a/components/com_contact/tmpl/contact/default_address.php b/components/com_contact/tmpl/contact/default_address.php
@@ -152,7 +152,7 @@
     <dd>
         <span class="contact-webpage">
             <a href="<?php echo $this->item->webpage; ?>" target="_blank" rel="noopener noreferrer">
-            <?php echo PunycodeHelper::urlToUTF8($this->item->webpage); ?></a>
+            <?php echo $this->escape(PunycodeHelper::urlToUTF8($this->item->webpage)); ?></a>
         </span>
     </dd>
 <?php endif; ?>

diff --git a/components/com_contact/tmpl/contact/default_profile.php b/components/com_contact/tmpl/contact/default_profile.php
@@ -30,9 +30,9 @@
                             $v_http = substr($profile->value, 0, 4);
 
                             if ($v_http === 'http') :
-                                echo '<dd><a href="' . $profile->text . '">' . PunycodeHelper::urlToUTF8($profile->text) . '</a></dd>';
+                                echo '<dd><a href="' . $profile->text . '">' . $this->escape(PunycodeHelper::urlToUTF8($profile->text)) . '</a></dd>';
                             else :
-                                echo '<dd><a href="http://' . $profile->text . '">' . PunycodeHelper::urlToUTF8($profile->text) . '</a></dd>';
+                                echo '<dd><a href="http://' . $profile->text . '">' . $this->escape(PunycodeHelper::urlToUTF8($profile->text)) . '</a></dd>';
                             endif;
                             break;