diff --git a/CHANGELOG.md b/CHANGELOG.md
index b53804e8..d846e754 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,11 @@
1. [](#new)
* Added new event `onAdminPage` which allows plugins to customize `Page` object in `$event['page']`
-
+1. [](#improved)
+ * Use `Url:post()` to get the `$_POST` variable (allows common security checks/filtering for the POST data)
+1. [](#bugfix)
+ * Fixed issue in filepicker where missing images would cause a loop to try to load them
+
# v1.8.9
## 08/23/2018
diff --git a/admin.php b/admin.php
index 815e911d..6e1b2191 100644
--- a/admin.php
+++ b/admin.php
@@ -360,7 +360,7 @@ class AdminPlugin extends Plugin
}
// Make local copy of POST.
- $post = !empty($_POST) ? $_POST : [];
+ $post = $this->grav['uri']->post();
// Handle tasks.
$this->admin->task = $task = !empty($post['task']) ? $post['task'] : $this->uri->param('task');
diff --git a/classes/admin.php b/classes/admin.php
index 023e4f3d..f1b2ecbd 100644
--- a/classes/admin.php
+++ b/classes/admin.php
@@ -595,7 +595,8 @@ class Admin
}
if (!$post) {
- $post = isset($_POST['data']) ? $_POST['data'] : [];
+ $post = $this->grav['uri']->post();
+ $post = isset($post['data']) ? $post['data'] : [];
}
// Check to see if a data type is plugin-provided, before looking into core ones
diff --git a/classes/admincontroller.php b/classes/admincontroller.php
index 0a2f492a..d954deb2 100644
--- a/classes/admincontroller.php
+++ b/classes/admincontroller.php
@@ -17,7 +17,7 @@ use Grav\Common\Page\Pages;
use Grav\Common\Page\Collection;
use Grav\Common\User\User;
use Grav\Common\Utils;
-use Grav\Common\Backup\ZipBackup;
+use Grav\Common\Backup\Backups;
use Grav\Plugin\Admin\Twig\AdminTwigExtension;
use Grav\Plugin\Login\TwoFactorAuth\TwoFactorAuth;
use Grav\Common\Yaml;
diff --git a/themes/grav/app/forms/fields/filepicker.js b/themes/grav/app/forms/fields/filepicker.js
index 9672c021..eb844cd6 100644
--- a/themes/grav/app/forms/fields/filepicker.js
+++ b/themes/grav/app/forms/fields/filepicker.js
@@ -2,7 +2,7 @@ import $ from 'jquery';
import { config, uri_params } from 'grav-config';
import request from '../../utils/request';
-const insertTextAt = (string, index, text) => [string.slice(0, index), text, string.slice(index)].join('');
+// const insertTextAt = (string, index, text) => [string.slice(0, index), text, string.slice(index)].join('');
export default class FilePickerField {
@@ -79,14 +79,12 @@ export default class FilePickerField {
let renderOption = function renderOption(item, escape) {
let image = '';
if (imagesPreview && folder && (!item.status || item.status === 'available') && item.name.match(/\.(jpg|jpeg|png|gif)$/i)) {
- const fallback2x = insertTextAt(`${config.base_url_relative}/../${folder}/${item.name}`, -4, '@2x');
- const fallback3x = insertTextAt(`${config.base_url_relative}/../${folder}/${item.name}`, -4, '@3x');
+ // const fallback2x = insertTextAt(`${config.base_url_relative}/../${folder}/${item.name}`, -4, '@2x');
+ // const fallback3x = insertTextAt(`${config.base_url_relative}/../${folder}/${item.name}`, -4, '@3x');
const source = thumbs[item.name] || `${config.base_url_relative}/../${folder}/${item.name}`;
- image = `
- `;
+ // onerror="if(this.src==='${fallback2x}'){this.src='${fallback3x}';}else{this.src='${fallback2x}'}"
+ image = `
`;
}
return `
"+e.stack+"":"";f.default.error("Fetch Failed: \n '+c.translations.PLUGIN_ADMIN.UPDATE+" "+c.translations.PLUGIN_ADMIN.ALL+" "+l+'\n \n '+a+" "+c.translations.PLUGIN_ADMIN.OF_YOUR+" "+o+" "+c.translations.PLUGIN_ADMIN.HAVE_AN_UPDATE_AVAILABLE+"\n
\n ");var d=(0,s.default)("[data-update-packages]").attr("data-packages-slugs")||"";d=d?d.split(","):[];var h=(0,u.default)(d.concat(Object.keys(r))).join();(0,s.default)("[data-update-packages]").attr("data-packages-slugs",""+h),Object.keys(r).forEach(function(t){var a=(0,s.default)("[data-gpm-"+n[i]+'="'+t+'"]'),l=a.find(".gpm-name"),u=l.find("a"),f=a.parents(".content-wrapper");if("plugins"!==o||l.find(".badge.update").length?"themes"===o&&(l.append('"),f.addClass("has-updates")):(l.append(''+c.translations.PLUGIN_ADMIN.UPDATE_AVAILABLE+"!"),f.addClass("has-updates")),a.length){var d=(0,s.default)(".grav-update."+n[i]);if(d.length){var h="testing"===r[t].type?'test release':"";d.html('\n\n '+c.translations.PLUGIN_ADMIN.UPDATE+" "+(n[i].charAt(0).toUpperCase()+n[i].substr(1).toLowerCase())+'\n \n v'+r[t].available+" "+h+" "+c.translations.PLUGIN_ADMIN.OF_THIS+" "+n[i]+" "+c.translations.PLUGIN_ADMIN.IS_NOW_AVAILABLE+"!\n
\n ").css("display","block"),e=!1}}}),(0,s.default)("[data-update-packages]").removeClass("hidden")}}),(0,s.default)(".content-wrapper").addClass("updates-checked"),void(e||(0,s.default)(".warning-reinstall-not-latest-release").removeClass("hidden"))):this}}]),e}();t.default=y;var _=new y;t.Instance=_,t.Notifications=m.default,t.Feed=g.default,h.Instance.on("fetched",function(e,t){_.setPayload(e.payload||{}),_.grav().resources()}),"1"===c.config.enable_auto_updates_check&&h.Instance.fetch()},function(e,t,n){function r(e,t){return t=t||i,a(e,function(e,n,r){for(var i=r.length;++n ul").show();switch(r.find("div").remove(),r.find(".fa-warning").removeClass("fa-warning").addClass("fa-refresh fa-spin"),e.type||(e.type="note"),e.type){case"note":e.intro_text="Note";break;case"info":e.intro_text="Info";break;case"warning":e.intro_text="Warning"}var a="";if(t>9&&(a=" hidden "),e.link){var o=document.createElement("div");o.innerHTML=e.message,i.append('\n"+e.message+"
").text();i.append('\n"+m.translations.PLUGIN_ADMIN.FILE_ERROR_UPLOAD+" "+t.name+"
\n"+n.message+""})}},{key:"onDropzoneComplete",value:function(t){if(!t.accepted&&!t.rejected){var n={status:"error",message:m.translations.PLUGIN_ADMIN.FILE_UNSUPPORTED+": "+t.name.match(/\..+/).join("")};return this.handleError({file:t,data:n,mode:"removeFile",msg:"
"+m.translations.PLUGIN_ADMIN.FILE_ERROR_ADD+" "+t.name+"
\n"+n.message+""})}this.options.reloadPage&&e.location.reload()}},{key:"b64_to_utf8",value:function(e){return e=e.replace(/\s/g,""),decodeURIComponent(escape(window.atob(e)))}},{key:"onDropzoneRemovedFile",value:function(e){var t=this;if(e.accepted&&!e.rejected){var n=e.removeUrl||this.urls.delete,r=(n||"").match(/path:(.*)\//),i={filename:e.name,uri:this.getURI()};e.sessionParams&&(i.task="filessessionremove",i.session=e.sessionParams),(0,p.default)(n,{method:"post",body:i},function(){if(r){r=t.b64_to_utf8(r[1]);var e=t.container.find('[name][type="hidden"]'),n=JSON.parse(e.val()||"{}");delete n[r],e.val(JSON.stringify(n))}})}}},{key:"onDropzoneError",value:function(e,t,n){var r=n?t.error.message:t;return(0,l.default)(e.previewElement).find("[data-dz-errormessage]").html(r),this.handleError({file:e,data:{status:"error"},msg:"
"+r+""})}},{key:"handleError",value:function(e){var t=e.file,n=e.data,r=e.mode,i=e.msg;if("error"===n.status||"unauthorized"===n.status){switch(r){case"addBack":t instanceof File?this.dropzone.addFile.call(this.dropzone,t):(this.dropzone.files.push(t),this.dropzone.options.addedfile.call(this.dropzone,t),this.dropzone.options.thumbnail.call(this.dropzone,t,t.extras.url));break;case"removeFile":default:~this.dropzone.files.indexOf(t)&&(t.rejected=!0,this.dropzone.removeFile.call(this.dropzone,t,{silent:!0}))}var a=(0,l.default)('[data-remodal-id="generic"]');a.find(".error-content").html(i),l.default.remodal.lookup[a.data("remodal")].open()}}}]),t}();t.default=_;var b=[],w=(0,l.default)(),x=function(e,t){var n=(0,l.default)(t).find(".dropzone.files-upload");n.length&&n.each(function(e,t){t=(0,l.default)(t),~w.index(t)||k(t)})},k=function(e){e=(0,l.default)(e);var t=e.find('input[type="file"]'),n=e.data("grav-file-settings")||{};n.accept&&~n.accept.indexOf("*")&&(n.accept=[""]);var r={url:e.data("file-url-add")||(e.closest("form").attr("action")||m.config.current_url)+".json",paramName:n.paramName||"file",dotNotation:n.name||"file",acceptedFiles:n.accept?n.accept.join(","):t.attr("accept")||e.data("media-types"),maxFilesize:"undefined"!=typeof n.filesize?n.filesize:256,maxFiles:n.limit||null,resizeWidth:n.resizeWidth||null,resizeHeight:n.resizeHeight||null,resizeQuality:n.resizeQuality||null,accept:function(e,t){y(e,t,n)}};w=w.add(e),e=e[0],b.push(new _({container:e,options:r}))};t.Instances=function(){return(0,l.default)(".dropzone.files-upload").each(function(e,t){return k(t)}),(0,l.default)("body").on("mutation._grav",x),b}()}).call(t,function(){return this}())},,,function(e,t,r){var i,a;(function(){function r(e){return!!e.exifdata}function o(e,t){t=t||e.match(/^data\:([^\;]+)\;base64,/im)[1]||"",e=e.replace(/^data\:([^\;]+)\;base64,/gim,"");for(var n=atob(e),r=n.length,i=new ArrayBuffer(r),a=new Uint8Array(i),o=0;o
"+e.stack+"":"";f.default.error("Fetch Failed: \n '+c.translations.PLUGIN_ADMIN.UPDATE+" "+c.translations.PLUGIN_ADMIN.ALL+" "+l+'\n \n '+a+" "+c.translations.PLUGIN_ADMIN.OF_YOUR+" "+o+" "+c.translations.PLUGIN_ADMIN.HAVE_AN_UPDATE_AVAILABLE+"\n
\n ");var d=(0,s.default)("[data-update-packages]").attr("data-packages-slugs")||"";d=d?d.split(","):[];var p=(0,u.default)(d.concat(Object.keys(r))).join();(0,s.default)("[data-update-packages]").attr("data-packages-slugs",""+p),Object.keys(r).forEach(function(t){var a=(0,s.default)("[data-gpm-"+n[i]+'="'+t+'"]'),l=a.find(".gpm-name"),u=l.find("a"),f=a.parents(".content-wrapper");if("plugins"!==o||l.find(".badge.update").length?"themes"===o&&(l.append('"),f.addClass("has-updates")):(l.append(''+c.translations.PLUGIN_ADMIN.UPDATE_AVAILABLE+"!"),f.addClass("has-updates")),a.length){var d=(0,s.default)(".grav-update."+n[i]);if(d.length){var p="testing"===r[t].type?'test release':"";d.html('\n\n '+c.translations.PLUGIN_ADMIN.UPDATE+" "+(n[i].charAt(0).toUpperCase()+n[i].substr(1).toLowerCase())+'\n \n v'+r[t].available+" "+p+" "+c.translations.PLUGIN_ADMIN.OF_THIS+" "+n[i]+" "+c.translations.PLUGIN_ADMIN.IS_NOW_AVAILABLE+"!\n
\n ").css("display","block"),e=!1}}}),(0,s.default)("[data-update-packages]").removeClass("hidden")}}),(0,s.default)(".content-wrapper").addClass("updates-checked"),void(e||(0,s.default)(".warning-reinstall-not-latest-release").removeClass("hidden"))):this}}]),e}();t.default=y;var _=new y;t.Instance=_,t.Notifications=m.default,t.Feed=g.default,p.Instance.on("fetched",function(e,t){_.setPayload(e.payload||{}),_.grav().resources()}),"1"===c.config.enable_auto_updates_check&&p.Instance.fetch()},function(e,t,n){function r(e,t){return t=t||i,a(e,function(e,n,r){for(var i=r.length;++n ul").show();switch(r.find("div").remove(),r.find(".fa-warning").removeClass("fa-warning").addClass("fa-refresh fa-spin"),e.type||(e.type="note"),e.type){case"note":e.intro_text="Note";break;case"info":e.intro_text="Info";break;case"warning":e.intro_text="Warning"}var a="";if(t>9&&(a=" hidden "),e.link){var o=document.createElement("div");o.innerHTML=e.message,i.append('\n"+e.message+"
").text();i.append('\n"+m.translations.PLUGIN_ADMIN.FILE_ERROR_UPLOAD+" "+t.name+"
\n"+n.message+""})}},{key:"onDropzoneComplete",value:function(t){if(!t.accepted&&!t.rejected){var n={status:"error",message:m.translations.PLUGIN_ADMIN.FILE_UNSUPPORTED+": "+t.name.match(/\..+/).join("")};return this.handleError({file:t,data:n,mode:"removeFile",msg:"
"+m.translations.PLUGIN_ADMIN.FILE_ERROR_ADD+" "+t.name+"
\n"+n.message+""})}this.options.reloadPage&&e.location.reload()}},{key:"b64_to_utf8",value:function(e){return e=e.replace(/\s/g,""),decodeURIComponent(escape(window.atob(e)))}},{key:"onDropzoneRemovedFile",value:function(e){var t=this;if(e.accepted&&!e.rejected){var n=e.removeUrl||this.urls.delete,r=(n||"").match(/path:(.*)\//),i={filename:e.name,uri:this.getURI()};e.sessionParams&&(i.task="filessessionremove",i.session=e.sessionParams),(0,h.default)(n,{method:"post",body:i},function(){if(r){r=t.b64_to_utf8(r[1]);var e=t.container.find('[name][type="hidden"]'),n=JSON.parse(e.val()||"{}");delete n[r],e.val(JSON.stringify(n))}})}}},{key:"onDropzoneError",value:function(e,t,n){var r=n?t.error.message:t;return(0,l.default)(e.previewElement).find("[data-dz-errormessage]").html(r),this.handleError({file:e,data:{status:"error"},msg:"
"+r+""})}},{key:"handleError",value:function(e){var t=e.file,n=e.data,r=e.mode,i=e.msg;if("error"===n.status||"unauthorized"===n.status){switch(r){case"addBack":t instanceof File?this.dropzone.addFile.call(this.dropzone,t):(this.dropzone.files.push(t),this.dropzone.options.addedfile.call(this.dropzone,t),this.dropzone.options.thumbnail.call(this.dropzone,t,t.extras.url));break;case"removeFile":default:~this.dropzone.files.indexOf(t)&&(t.rejected=!0,this.dropzone.removeFile.call(this.dropzone,t,{silent:!0}))}var a=(0,l.default)('[data-remodal-id="generic"]');a.find(".error-content").html(i),l.default.remodal.lookup[a.data("remodal")].open()}}}]),t}();t.default=_;var b=[],w=(0,l.default)(),x=function(e,t){var n=(0,l.default)(t).find(".dropzone.files-upload");n.length&&n.each(function(e,t){t=(0,l.default)(t),~w.index(t)||k(t)})},k=function(e){e=(0,l.default)(e);var t=e.find('input[type="file"]'),n=e.data("grav-file-settings")||{};n.accept&&~n.accept.indexOf("*")&&(n.accept=[""]);var r={url:e.data("file-url-add")||(e.closest("form").attr("action")||m.config.current_url)+".json",paramName:n.paramName||"file",dotNotation:n.name||"file",acceptedFiles:n.accept?n.accept.join(","):t.attr("accept")||e.data("media-types"),maxFilesize:"undefined"!=typeof n.filesize?n.filesize:256,maxFiles:n.limit||null,resizeWidth:n.resizeWidth||null,resizeHeight:n.resizeHeight||null,resizeQuality:n.resizeQuality||null,accept:function(e,t){y(e,t,n)}};w=w.add(e),e=e[0],b.push(new _({container:e,options:r}))};t.Instances=function(){return(0,l.default)(".dropzone.files-upload").each(function(e,t){return k(t)}),(0,l.default)("body").on("mutation._grav",x),b}()}).call(t,function(){return this}())},,,function(e,t,r){var i,a;(function(){function r(e){return!!e.exifdata}function o(e,t){t=t||e.match(/^data\:([^\;]+)\;base64,/im)[1]||"",e=e.replace(/^data\:([^\;]+)\;base64,/gim,"");for(var n=atob(e),r=n.length,i=new ArrayBuffer(r),a=new Uint8Array(i),o=0;o