diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ac6143c7..ec6b7f57 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -18,6 +18,10 @@ on:
schedule:
- cron: '28 22 * * 5'
+permissions:
+ contents: read
+ security-events: write
+
jobs:
analyze:
name: Analyze
@@ -26,18 +30,18 @@ jobs:
strategy:
fail-fast: false
matrix:
- language: [ 'javascript' ]
- # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
+ language: [ 'actions', 'javascript' ]
+ # CodeQL supports [ 'actions', 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
# Learn more:
# https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
steps:
- name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@v3
+ uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -46,4 +50,4 @@ jobs:
# queries: ./path/to/local/query, your-org/your-repo/queries@main
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v3
+ uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f3795964..d347a6fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,12 +4,16 @@ on:
push:
tags: '[0-9]+.[0-9]?[0-9]?[0-9]?.?[0-9]+'
+permissions: {}
+
jobs:
draft:
+ permissions:
+ contents: write
runs-on: ubuntu-latest
steps:
- name: Fetch changelog from tag
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
with:
sparse-checkout: CHANGELOG.md
sparse-checkout-cone-mode: false
diff --git a/.github/workflows/snyk-scan.yml b/.github/workflows/snyk-scan.yml
index 66f67e7a..2dc75680 100644
--- a/.github/workflows/snyk-scan.yml
+++ b/.github/workflows/snyk-scan.yml
@@ -8,13 +8,23 @@ on:
branches: [ master ]
pull_request:
branches: [ master ]
+
+permissions:
+ contents: read
+ security-events: write
+
jobs:
# https://github.com/snyk/actions/tree/master/php
snyk-php:
runs-on: ubuntu-latest
- if: ${{ github.repository == 'PrivateBin/PrivateBin' }}
+ if: |
+ github.repository == 'PrivateBin/PrivateBin' && (
+ github.event.pull_request.author_association == 'COLLABORATOR' ||
+ github.event.pull_request.author_association == 'CONTRIBUTOR' ||
+ github.event.pull_request.author_association == 'MEMBER' ||
+ github.event.pull_request.author_association == 'OWNER' )
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
- name: Install Google Cloud Storage
run: composer require --no-update google/cloud-storage && composer update --no-dev
- name: Run Snyk to check for vulnerabilities
@@ -25,6 +35,6 @@ jobs:
with:
args: --sarif-file-output=snyk.sarif
- name: Upload result to GitHub Code Scanning
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: snyk.sarif
diff --git a/.github/workflows/test-results.yml b/.github/workflows/test-results.yml
index 2a315b7a..c918e4fa 100644
--- a/.github/workflows/test-results.yml
+++ b/.github/workflows/test-results.yml
@@ -5,6 +5,7 @@ on:
workflows: ["Tests"]
types:
- completed
+
permissions: {}
jobs:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 94cc5403..4a7d2e1e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,15 +1,18 @@
name: Tests
+
on:
push:
workflow_dispatch:
+permissions: {}
+
jobs:
Composer:
runs-on: ubuntu-latest
steps:
- name: Checkout
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
- name: Validate composer.json and composer.lock
run: composer validate
- name: Install dependencies
@@ -36,7 +39,7 @@ jobs:
# let's get started!
- name: Checkout
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
# cache PHP extensions
- name: Setup cache environment
@@ -106,20 +109,111 @@ jobs:
- name: Upload Test Results
if: always()
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v5
with:
name: Test Results (PHP ${{ matrix.php-versions }})
path: tst/results.xml
+ PHPunitConfigCombinations:
+ name: PHP configuration combination unit tests
+ runs-on: ubuntu-latest
+ env:
+ php-version: '8.4'
+ extensions: gd, sqlite3
+ extensions-cache-key-name: phpextensions
+
+ steps:
+
+ # let's get started!
+ - name: Checkout
+ uses: actions/checkout@v5
+
+ # cache PHP extensions
+ - name: Setup cache environment
+ id: extcache
+ uses: shivammathur/cache-extensions@v1
+ with:
+ php-version: ${{ env.php-version }}
+ extensions: ${{ env.extensions }}
+ key: ${{ runner.os }}-${{ env.extensions-cache-key }}
+
+ - name: Cache extensions
+ uses: actions/cache@v4
+ with:
+ path: ${{ steps.extcache.outputs.dir }}
+ key: ${{ steps.extcache.outputs.key }}
+ restore-keys: ${{ runner.os }}-${{ env.extensions-cache-key }}
+
+ - name: Setup PHP
+ uses: shivammathur/setup-php@v2
+ with:
+ php-version: ${{ env.php-version }}
+ extensions: ${{ env.extensions }}
+
+ # Setup GitHub CI PHP problem matchers
+ # https://github.com/shivammathur/setup-php#problem-matchers
+ - name: Setup problem matchers for PHP
+ run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+
+ - name: Setup problem matchers for PHPUnit
+ run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
+
+ # composer cache
+ - name: Remove composer lock
+ run: rm composer.lock
+
+ - name: Get composer cache directory
+ id: composer-cache
+ run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+ # http://man7.org/linux/man-pages/man1/date.1.html
+ # https://github.com/actions/cache#creating-a-cache-key
+ - name: Get Date
+ id: get-date
+ run: echo "date=$(/bin/date -u "+%Y%m%d")" >> $GITHUB_OUTPUT
+ shell: bash
+
+ - name: Cache dependencies
+ uses: actions/cache@v4
+ with:
+ path: "${{ steps.composer-cache.outputs.dir }}"
+ key: "${{ runner.os }}-composer-${{ steps.get-date.outputs.date }}-${{ hashFiles('**/composer.json') }}"
+ restore-keys: "${{ runner.os }}-composer-${{ steps.get-date.outputs.date }}-"
+
+ # composer installation
+ - name: Unset platform requirement
+ run: composer config --unset platform
+
+ - name: Setup PHPunit
+ run: composer install -n
+
+ - name: Install Google Cloud Storage
+ run: composer require google/cloud-storage
+
+ # testing
+ - name: Generate configuration combination unit tests
+ run: bin/configuration-test-generator
+
+ - name: Run unit tests
+ run: ../vendor/bin/phpunit --no-coverage --log-junit results.xml ConfigurationCombinationsTest.php
+ working-directory: tst
+
+ - name: Upload Test Results
+ if: always()
+ uses: actions/upload-artifact@v5
+ with:
+ name: Test Results
+ path: tst/results.xml
+
Mocha:
runs-on: ubuntu-latest
steps:
- name: Checkout
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
- name: Setup Node
- uses: actions/setup-node@v4
+ uses: actions/setup-node@v6
with:
node-version: '18'
cache: 'npm'
@@ -138,7 +232,7 @@ jobs:
- name: Upload Test Results
if: always()
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v5
with:
name: Test Results (Mocha)
path: js/mocha-results.xml
@@ -148,7 +242,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Upload
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v5
with:
name: Event File
path: "${{ github.event_path }}"
diff --git a/.gitignore b/.gitignore
index 07ce26ed..09ca72e8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,7 @@ vendor/**/tst
vendor/**/tests
vendor/**/build_phar.php
!vendor/**/*.php
+vendor/bin/**
# Ignore local node modules, unit testing logs, api docs and IDE project files
js/node_modules/
diff --git a/.scrutinizer.yml b/.scrutinizer.yml
index bd393ccc..d27e1bc6 100644
--- a/.scrutinizer.yml
+++ b/.scrutinizer.yml
@@ -15,14 +15,12 @@ coding_style:
additive: false
concatenation: true
build:
- image: default-bionic
environment:
php:
- version: 7.4
+ version: 8.2
tests:
override:
- -
- command: 'composer require google/cloud-storage && cd tst && ../vendor/bin/phpunit'
+ - command: 'composer require google/cloud-storage && cd tst && XDEBUG_MODE=coverage ../vendor/bin/phpunit'
coverage:
file: 'tst/log/coverage-clover.xml'
format: 'clover'
diff --git a/BADGES.md b/BADGES.md
index 7724869c..5bd6301e 100644
--- a/BADGES.md
+++ b/BADGES.md
@@ -1,11 +1,7 @@
# Badges
-[](https://travis-ci.org/PrivateBin/PrivateBin) [](https://scrutinizer-ci.com/g/PrivateBin/PrivateBin/build-status/master)
-[](https://www.codacy.com/app/PrivateBin/PrivateBin)
-[](https://codeclimate.com/github/PrivateBin/PrivateBin)
+[](https://scrutinizer-ci.com/g/PrivateBin/PrivateBin/build-status/master) [](https://codeclimate.com/github/PrivateBin/PrivateBin)
[](https://scrutinizer-ci.com/g/PrivateBin/PrivateBin/?branch=master)
-[](https://insight.sensiolabs.com/projects/57c9e74e-c6f9-4de6-a876-df66ec2ea1ff)
-[](https://www.codacy.com/app/PrivateBin/PrivateBin)
-[](https://codeclimate.com/github/PrivateBin/PrivateBin/coverage) [](https://scrutinizer-ci.com/g/PrivateBin/PrivateBin/?branch=master)
+[](https://scrutinizer-ci.com/g/PrivateBin/PrivateBin/?branch=master)
[](https://www.browserstack.com/)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1fc8c4a0..86e455a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
# PrivateBin version history
+## 1.7.9 (not yet released)
+* CHANGED: Upgrading libraries to: base-x 5.0.1, bootstrap 5.3.8, DOMpurify 3.2.7, ip-lib 1.21.0 & kjua 0.10.0
+* CHANGED: Refactored jQuery DOM element creation into plain JavaScript
+* FIXED: Prevent arbitrary PHP file inclusion when enabling template switching
+* FIXED: Malicious filename can be used for self-XSS / HTML injection locally for users
+* FIXED: Sanitize file name in attachment size hint
+* FIXED: Unable to create a new paste from the cloned one when a JSON file attached (#1585)
+* FIXED: traffic limiter not working when using Filesystem storage and PHP opcache
+* FIXED: Configuration combinations test errors
+
## 1.7.8 (2025-06-30)
* FIXED: Duplicate attachment for every comment (#1577)
* FIXED: Attachments with empty file names (#1577)
diff --git a/bin/configuration-test-generator b/bin/configuration-test-generator
index d81c3302..3382d4c5 100755
--- a/bin/configuration-test-generator
+++ b/bin/configuration-test-generator
@@ -536,7 +536,8 @@ EOT;
break;
case 'Delete':
$code .= PHP_EOL . <<<'EOT'
- $this->_model->create(Helper::getPasteId(), Helper::getPaste());
+ $paste = Helper::getPaste();
+ $this->_model->create(Helper::getPasteId(), $paste);
$this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
$_GET['pasteid'] = Helper::getPasteId();
$_GET['deletetoken'] = hash_hmac('sha256', Helper::getPasteId(), $this->_model->read(Helper::getPasteId())['meta']['salt']);
@@ -574,7 +575,7 @@ EOT;
$code .= <<<'EOT'
$this->assertMatchesRegularExpression(
- '#
]*id="status"[^>]*>.*Paste was properly deleted[^<]*
#s',
+ '#]*id="status"[^>]*>.*Paste was properly deleted[^<]*(