From 46d682f8899068b63d3c13fe85a2d26df361d717 Mon Sep 17 00:00:00 2001 From: Andy Miller Date: Thu, 12 Apr 2018 15:25:19 -0600 Subject: [PATCH 1/5] Revert "Fix for audio/video parsedown #1924" This reverts commit 33cfa5e104069e5aafa426f4b29006b61d057714. # Conflicts: # CHANGELOG.md --- composer.json | 3 +- composer.lock | 174 +----------------- .../Common/Markdown/ParsedownGravTrait.php | 13 -- .../Grav/Common/Page/Medium/AudioMedium.php | 1 - .../Grav/Common/Page/Medium/VideoMedium.php | 3 +- 5 files changed, 8 insertions(+), 186 deletions(-) diff --git a/composer.json b/composer.json index 5ad8be9527..9918530bfc 100644 --- a/composer.json +++ b/composer.json @@ -6,10 +6,9 @@ "homepage": "http://getgrav.org", "license": "MIT", "require": { - "roave/security-advisories": "dev-master", "php": ">=5.5.9", "twig/twig": "~1.24", - "erusev/parsedown": "~1.7", + "erusev/parsedown": "1.6.4", "erusev/parsedown-extra": "~0.7", "symfony/yaml": "~2.8", "symfony/console": "~2.8", diff --git a/composer.lock b/composer.lock index 6fd526d012..dff7ccb1ba 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file", "This file is @generated automatically" ], - "content-hash": "a8a5c0cb1969632422711809e4d55e06", + "content-hash": "c71dffc7daccd08aba7a52a476569d4c", "packages": [ { "name": "antoligy/dom-string-iterators", @@ -295,20 +295,19 @@ }, { "name": "erusev/parsedown", - "version": "1.7.1", + "version": "1.6.4", "source": { "type": "git", "url": "https://github.com/erusev/parsedown.git", - "reference": "92e9c27ba0e74b8b028b111d1b6f956a15c01fc1" + "reference": "fbe3fe878f4fe69048bb8a52783a09802004f548" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/erusev/parsedown/zipball/92e9c27ba0e74b8b028b111d1b6f956a15c01fc1", - "reference": "92e9c27ba0e74b8b028b111d1b6f956a15c01fc1", + "url": "https://api.github.com/repos/erusev/parsedown/zipball/fbe3fe878f4fe69048bb8a52783a09802004f548", + "reference": "fbe3fe878f4fe69048bb8a52783a09802004f548", "shasum": "" }, "require": { - "ext-mbstring": "*", "php": ">=5.3.0" }, "require-dev": { @@ -337,7 +336,7 @@ "markdown", "parser" ], - "time": "2018-03-08T01:11:30+00:00" + "time": "2017-11-14T20:44:03+00:00" }, { "name": "erusev/parsedown-extra", @@ -1202,166 +1201,6 @@ ], "time": "2017-10-23T01:57:42+00:00" }, - { - "name": "roave/security-advisories", - "version": "dev-master", - "source": { - "type": "git", - "url": "https://github.com/Roave/SecurityAdvisories.git", - "reference": "c83f6aa0ed08f680c012656d411d1b7c94003012" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/Roave/SecurityAdvisories/zipball/c83f6aa0ed08f680c012656d411d1b7c94003012", - "reference": "c83f6aa0ed08f680c012656d411d1b7c94003012", - "shasum": "" - }, - "conflict": { - "3f/pygmentize": "<1.2", - "adodb/adodb-php": "<5.20.6", - "amphp/artax": "<1.0.6|>=2,<2.0.6", - "amphp/http": "<1.0.1", - "asymmetricrypt/asymmetricrypt": ">=0,<9.9.99", - "aws/aws-sdk-php": ">=3,<3.2.1", - "bugsnag/bugsnag-laravel": ">=2,<2.0.2", - "cakephp/cakephp": ">=1.3,<1.3.18|>=2,<2.4.99|>=2.5,<2.5.99|>=2.6,<2.6.12|>=2.7,<2.7.6|>=3,<3.0.15|>=3.1,<3.1.4", - "cart2quote/module-quotation": ">=4.1.6,<=4.4.5|>=5,<5.4.4", - "cartalyst/sentry": "<=2.1.6", - "codeigniter/framework": "<=3.0.6", - "composer/composer": "<=1.0.0-alpha11", - "contao-components/mediaelement": ">=2.14.2,<2.21.1", - "contao/core": ">=2,<3.5.32", - "contao/core-bundle": ">=4,<4.4.8", - "contao/listing-bundle": ">=4,<4.4.8", - "contao/newsletter-bundle": ">=4,<4.1", - "doctrine/annotations": ">=1,<1.2.7", - "doctrine/cache": ">=1,<1.3.2|>=1.4,<1.4.2", - "doctrine/common": ">=2,<2.4.3|>=2.5,<2.5.1", - "doctrine/dbal": ">=2,<2.0.8|>=2.1,<2.1.2", - "doctrine/doctrine-bundle": "<1.5.2", - "doctrine/doctrine-module": "<=0.7.1", - "doctrine/mongodb-odm": ">=1,<1.0.2", - "doctrine/mongodb-odm-bundle": ">=2,<3.0.1", - "doctrine/orm": ">=2,<2.4.8|>=2.5,<2.5.1", - "dompdf/dompdf": ">=0.6,<0.6.2", - "drupal/core": ">=7,<7.58|>=8,<8.4.6|>=8.5,<8.5.1", - "drupal/drupal": ">=7,<7.58|>=8,<8.4.6|>=8.5,<8.5.1", - "erusev/parsedown": "<1.7", - "ezsystems/ezpublish-legacy": ">=5.3,<5.3.12.3|>=5.4,<5.4.11.3|>=2017.8,<2017.8.1.1|>=2017.12,<2017.12.2.1", - "firebase/php-jwt": "<2", - "friendsofsymfony/rest-bundle": ">=1.2,<1.2.2", - "friendsofsymfony/user-bundle": ">=1.2,<1.3.5", - "gree/jose": "<=2.2", - "gregwar/rst": "<1.0.3", - "guzzlehttp/guzzle": ">=6,<6.2.1|>=4.0.0-rc2,<4.2.4|>=5,<5.3.1", - "illuminate/auth": ">=4,<4.0.99|>=4.1,<=4.1.31|>=4.2,<=4.2.22|>=5,<=5.0.35|>=5.1,<=5.1.46|>=5.2,<=5.2.45|>=5.3,<=5.3.31|>=5.4,<=5.4.36|>=5.5,<5.5.10", - "illuminate/database": ">=4,<4.0.99|>=4.1,<4.1.29", - "illuminate/encryption": ">=4,<=4.0.11|>=4.1,<=4.1.31|>=4.2,<=4.2.22|>=5,<=5.0.35|>=5.1,<=5.1.46|>=5.2,<=5.2.45|>=5.3,<=5.3.31|>=5.4,<=5.4.36|>=5.5,<5.5.40|>=5.6,<5.6.15", - "joomla/session": "<1.3.1", - "laravel/framework": ">=4,<4.0.99|>=4.1,<=4.1.31|>=4.2,<=4.2.22|>=5,<=5.0.35|>=5.1,<=5.1.46|>=5.2,<=5.2.45|>=5.3,<=5.3.31|>=5.4,<=5.4.36|>=5.5,<5.5.40|>=5.6,<5.6.15", - "laravel/socialite": ">=1,<1.0.99|>=2,<2.0.10", - "magento/magento1ce": ">=1.5.0.1,<1.9.3.2", - "magento/magento1ee": ">=1.9,<1.14.3.2", - "magento/magento2ce": ">=2,<2.2", - "monolog/monolog": ">=1.8,<1.12", - "namshi/jose": "<2.2", - "onelogin/php-saml": "<2.10.4", - "oro/crm": ">=1.7,<1.7.4", - "oro/platform": ">=1.7,<1.7.4", - "padraic/humbug_get_contents": "<1.1.2", - "pagarme/pagarme-php": ">=0,<3", - "paragonie/random_compat": "<2", - "phpmailer/phpmailer": ">=5,<5.2.24", - "phpunit/phpunit": ">=4.8.19,<4.8.28|>=5.0.10,<5.6.3", - "phpxmlrpc/extras": "<0.6.1", - "propel/propel": ">=2.0.0-alpha1,<=2.0.0-alpha7", - "propel/propel1": ">=1,<=1.7.1", - "pusher/pusher-php-server": "<2.2.1", - "sabre/dav": ">=1.6,<1.6.99|>=1.7,<1.7.11|>=1.8,<1.8.9", - "shopware/shopware": "<5.3.7", - "silverstripe/cms": ">=3,<=3.0.11|>=3.1,<3.1.11", - "silverstripe/forum": "<=0.6.1|>=0.7,<=0.7.3", - "silverstripe/framework": ">=3,<3.3", - "silverstripe/userforms": "<3", - "simplesamlphp/saml2": "<1.10.6|>=2,<2.3.8|>=3,<3.1.4", - "simplesamlphp/simplesamlphp": "<1.15.2", - "simplesamlphp/simplesamlphp-module-infocard": "<1.0.1", - "socalnick/scn-social-auth": "<1.15.2", - "squizlabs/php_codesniffer": ">=1,<2.8.1|>=3,<3.0.1", - "stormpath/sdk": ">=0,<9.9.99", - "swiftmailer/swiftmailer": ">=4,<5.4.5", - "symfony/dependency-injection": ">=2,<2.0.17", - "symfony/form": ">=2.3,<2.3.35|>=2.4,<2.6.12|>=2.7,<2.7.38|>=2.8,<2.8.31|>=3,<3.2.14|>=3.3,<3.3.13", - "symfony/framework-bundle": ">=2,<2.3.18|>=2.4,<2.4.8|>=2.5,<2.5.2", - "symfony/http-foundation": ">=2,<2.3.27|>=2.4,<2.5.11|>=2.6,<2.6.6", - "symfony/http-kernel": ">=2,<2.3.29|>=2.4,<2.5.12|>=2.6,<2.6.8", - "symfony/intl": ">=2.7,<2.7.38|>=2.8,<2.8.31|>=3,<3.2.14|>=3.3,<3.3.13", - "symfony/routing": ">=2,<2.0.19", - "symfony/security": ">=2,<2.0.25|>=2.1,<2.1.13|>=2.2,<2.2.9|>=2.3,<2.3.37|>=2.4,<2.6.13|>=2.7,<2.7.9|>=2.7.30,<2.7.32|>=2.8.23,<2.8.25|>=3.2.10,<3.2.12|>=3.3.3,<3.3.5", - "symfony/security-core": ">=2.4,<2.6.13|>=2.7,<2.7.9|>=2.7.30,<2.7.32|>=2.8,<2.8.6|>=2.8.23,<2.8.25|>=3,<3.0.6|>=3.2.10,<3.2.12|>=3.3.3,<3.3.5", - "symfony/security-csrf": ">=2.7,<2.7.38|>=2.8,<2.8.31|>=3,<3.2.14|>=3.3,<3.3.13", - "symfony/security-http": ">=2.3,<2.3.41|>=2.4,<2.7.38|>=2.8,<2.8.31|>=3,<3.2.14|>=3.3,<3.3.13", - "symfony/serializer": ">=2,<2.0.11", - "symfony/symfony": ">=2,<2.3.41|>=2.4,<2.7.38|>=2.8,<2.8.31|>=3,<3.2.14|>=3.3,<3.3.13", - "symfony/translation": ">=2,<2.0.17", - "symfony/validator": ">=2,<2.0.24|>=2.1,<2.1.12|>=2.2,<2.2.5|>=2.3,<2.3.3", - "symfony/web-profiler-bundle": ">=2,<2.3.19|>=2.4,<2.4.9|>=2.5,<2.5.4", - "symfony/yaml": ">=2,<2.0.22|>=2.1,<2.1.7", - "thelia/backoffice-default-template": ">=2.1,<2.1.2", - "thelia/thelia": ">=2.1.0-beta1,<2.1.3|>=2.1,<2.1.2", - "titon/framework": ">=0,<9.9.99", - "twig/twig": "<1.20", - "typo3/cms": ">=6.2,<6.2.30|>=7,<7.6.22|>=8,<8.7.5", - "typo3/flow": ">=1,<1.0.4|>=1.1,<1.1.1|>=2,<2.0.1|>=2.3,<2.3.16|>=3,<3.0.10|>=3.1,<3.1.7|>=3.2,<3.2.7|>=3.3,<3.3.5", - "typo3/neos": ">=1.1,<1.1.3|>=1.2,<1.2.13|>=2,<2.0.4", - "willdurand/js-translation-bundle": "<2.1.1", - "yiisoft/yii": ">=1.1.14,<1.1.15", - "yiisoft/yii2": "<2.0.15", - "yiisoft/yii2-bootstrap": "<2.0.4", - "yiisoft/yii2-dev": "<2.0.15", - "yiisoft/yii2-elasticsearch": "<2.0.5", - "yiisoft/yii2-gii": "<2.0.4", - "yiisoft/yii2-jui": "<2.0.4", - "yiisoft/yii2-redis": "<2.0.8", - "zendframework/zend-cache": ">=2.4,<2.4.8|>=2.5,<2.5.3", - "zendframework/zend-captcha": ">=2,<2.4.9|>=2.5,<2.5.2", - "zendframework/zend-crypt": ">=2,<2.4.9|>=2.5,<2.5.2", - "zendframework/zend-db": ">=2,<2.0.99|>=2.1,<2.1.99|>=2.2,<2.2.10|>=2.3,<2.3.5", - "zendframework/zend-diactoros": ">=1,<1.0.4", - "zendframework/zend-form": ">=2,<2.2.7|>=2.3,<2.3.1", - "zendframework/zend-http": ">=2,<2.0.99|>=2.1,<2.1.99|>=2.3,<2.3.8|>=2.4,<2.4.1", - "zendframework/zend-json": ">=2.1,<2.1.6|>=2.2,<2.2.6", - "zendframework/zend-ldap": ">=2,<2.0.99|>=2.1,<2.1.99|>=2.2,<2.2.8|>=2.3,<2.3.3", - "zendframework/zend-mail": ">=2,<2.4.11|>=2.5,<2.7.2", - "zendframework/zend-navigation": ">=2,<2.2.7|>=2.3,<2.3.1", - "zendframework/zend-session": ">=2,<2.0.99|>=2.1,<2.1.99|>=2.2,<2.2.9|>=2.3,<2.3.4", - "zendframework/zend-validator": ">=2.3,<2.3.6", - "zendframework/zend-view": ">=2,<2.2.7|>=2.3,<2.3.1", - "zendframework/zend-xmlrpc": ">=2.1,<2.1.6|>=2.2,<2.2.6", - "zendframework/zendframework": ">=2,<2.4.11|>=2.5,<2.5.1", - "zendframework/zendframework1": "<1.12.20", - "zendframework/zendopenid": ">=2,<2.0.2", - "zendframework/zendxml": ">=1,<1.0.1", - "zetacomponents/mail": "<1.8.2", - "zf-commons/zfc-user": "<1.2.2", - "zfcampus/zf-apigility-doctrine": ">=1,<1.0.3", - "zfr/zfr-oauth2-server-module": "<0.1.2" - }, - "type": "metapackage", - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Marco Pivetta", - "email": "ocramius@gmail.com", - "role": "maintainer" - } - ], - "description": "Prevents installation of composer packages with known security vulnerabilities: no API, simply require it", - "time": "2018-04-02T06:47:13+00:00" - }, { "name": "rockettheme/toolbox", "version": "1.3.9", @@ -3760,7 +3599,6 @@ "aliases": [], "minimum-stability": "stable", "stability-flags": { - "roave/security-advisories": 20, "victorjonsson/markdowndocs": 20 }, "prefer-stable": false, diff --git a/system/src/Grav/Common/Markdown/ParsedownGravTrait.php b/system/src/Grav/Common/Markdown/ParsedownGravTrait.php index 8c384c3857..59be69b0ef 100644 --- a/system/src/Grav/Common/Markdown/ParsedownGravTrait.php +++ b/system/src/Grav/Common/Markdown/ParsedownGravTrait.php @@ -243,19 +243,6 @@ protected function inlineLink($excerpt) return $excerpt; } - /** - * Return Text as-is to get around Parsedown security fixes - * which break these fields - * - * @param $text - * @param $nestable - * @return mixed - */ - public function html($text, $nestable) - { - return $text; - } - // For extending this class via plugins public function __call($method, $args) { diff --git a/system/src/Grav/Common/Page/Medium/AudioMedium.php b/system/src/Grav/Common/Page/Medium/AudioMedium.php index c3bac7bd6c..aae3597767 100644 --- a/system/src/Grav/Common/Page/Medium/AudioMedium.php +++ b/system/src/Grav/Common/Page/Medium/AudioMedium.php @@ -25,7 +25,6 @@ protected function sourceParsedownElement(array $attributes, $reset = true) return [ 'name' => 'audio', - 'handler' => 'html', 'text' => 'Your browser does not support the audio tag.', 'attributes' => $attributes ]; diff --git a/system/src/Grav/Common/Page/Medium/VideoMedium.php b/system/src/Grav/Common/Page/Medium/VideoMedium.php index f7923c3670..b3c8eed852 100644 --- a/system/src/Grav/Common/Page/Medium/VideoMedium.php +++ b/system/src/Grav/Common/Page/Medium/VideoMedium.php @@ -25,8 +25,7 @@ protected function sourceParsedownElement(array $attributes, $reset = true) return [ 'name' => 'video', - 'handler' => 'html', - 'text' => 'Your2 browser does not support the video tag.', + 'text' => 'Your browser does not support the video tag.', 'attributes' => $attributes ]; } From d3a4466d9b7318b3dcb7ced52d09e47a54b2549c Mon Sep 17 00:00:00 2001 From: Andy Miller Date: Thu, 12 Apr 2018 15:25:29 -0600 Subject: [PATCH 2/5] Updated changelog --- CHANGELOG.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5991259aa0..e5c9d91198 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,9 @@ ## mm/dd//2018 1. [](#new) - * moved sortArrayByKey logic into `Utils::` class + * moved Twig `sortArrayByKey` logic into `Utils::` class +1. [](#improved) + * Rolled back Parsedown library to stable `1.6.4` until a better solution for `1.8.0` compatibility can fe found 1. [](#bugfix) * Fix for bad reference to `ZipArchive` in `GPM::Installer` From 46f16ce4db312a41bbe0bceecb0affee59da85cc Mon Sep 17 00:00:00 2001 From: Andy Miller Date: Thu, 12 Apr 2018 15:26:26 -0600 Subject: [PATCH 3/5] Note about updated vendor libs --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e5c9d91198..8c93301cc0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ * moved Twig `sortArrayByKey` logic into `Utils::` class 1. [](#improved) * Rolled back Parsedown library to stable `1.6.4` until a better solution for `1.8.0` compatibility can fe found + * Updated vendor libraries to latest versions 1. [](#bugfix) * Fix for bad reference to `ZipArchive` in `GPM::Installer` @@ -70,7 +71,6 @@ * Optimizations & refactoring to the test suite [#1779](https://github.com/getgrav/grav/pull/1779) * Slight modification of Whoops error colors * Added new configuration option `system.session.initialize` to delay session initialization if needed by a plugin - * Vendor library updated to latest * Updated vendor libraries to latest versions * Removed constructor from `ObjectInterface` * Make it possible to include debug bar also into non-HTML responses From e7405a13fca2c250ab152d387a097669e428878e Mon Sep 17 00:00:00 2001 From: Andy Miller Date: Thu, 12 Apr 2018 15:28:53 -0600 Subject: [PATCH 4/5] Revert "Test fixes for session/parsedown changes, jquery update, quark default theme" This reverts commit cad10b6095bc86fa7610712283f3e88a33dbd2bc. # Conflicts: # CHANGELOG.md --- tests/unit/Grav/Common/Markdown/ParsedownTest.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/unit/Grav/Common/Markdown/ParsedownTest.php b/tests/unit/Grav/Common/Markdown/ParsedownTest.php index 88bccabfb8..e73e11f01c 100644 --- a/tests/unit/Grav/Common/Markdown/ParsedownTest.php +++ b/tests/unit/Grav/Common/Markdown/ParsedownTest.php @@ -315,7 +315,7 @@ public function testExternalLinks() $this->parsedown->text('[cnn.com](http://www.cnn.com)')); $this->assertSame('

google.com

', $this->parsedown->text('[google.com](https://www.google.com)')); - $this->assertSame('

complex url

', + $this->assertSame('

complex url

', $this->parsedown->text('[complex url](https://github.com/getgrav/grav/issues/new?title=[add-resource]%20New%20Plugin/Theme&body=Hello%20**There**)')); } @@ -689,7 +689,7 @@ public function testAttributeLinks() $this->parsedown->text('[Relative Target](../item2-3?target=_blank)')); $this->assertSame('

Relative Rel

', $this->parsedown->text('[Relative Rel](../item2-3?rel=nofollow)')); - $this->assertSame('

Relative Mixed

', + $this->assertSame('

Relative Mixed

', $this->parsedown->text('[Relative Mixed](../item2-3?foo=bar&baz=qux&rel=nofollow&class=button)')); } From 3607124e55e4063941c864cbc8c5790508da06c2 Mon Sep 17 00:00:00 2001 From: Andy Miller Date: Thu, 12 Apr 2018 15:54:16 -0600 Subject: [PATCH 5/5] Prepare for release --- CHANGELOG.md | 2 +- system/defines.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8c93301cc0..d72053458c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,5 @@ # v1.4.3 -## mm/dd//2018 +## 04/12/2018 1. [](#new) * moved Twig `sortArrayByKey` logic into `Utils::` class diff --git a/system/defines.php b/system/defines.php index 6615cf5621..329265a05a 100644 --- a/system/defines.php +++ b/system/defines.php @@ -8,7 +8,7 @@ // Some standard defines define('GRAV', true); -define('GRAV_VERSION', '1.4.2'); +define('GRAV_VERSION', '1.4.3'); define('GRAV_TESTING', false); define('DS', '/');