Reject 4-byte emoji and stop them causing SQL errors

attachment/attachment.php

@@ -95,7 +95,7 @@ protected function configure_properties()
 			'physical_filename'		=> array('default' => '',	'max' => 255),
 			'attachment_directory'	=> array('default' => '',	'max' => 255),
 			'real_filename'			=> array('default' => '',	'max' => 255),
-			'attachment_comment'	=> array('default' => ''),
+			'attachment_comment'	=> array('default' => '',	'encode_ucr' => true),
 
 			'download_count'		=> array('default' => 0),
 
@@ -202,6 +202,14 @@ public function submit($data = null)
 
 		if (!empty($data))
 		{
+			foreach ($data as $name => $value)
+			{
+				if (isset($this->object_config[$name]))
+				{
+					$data[$name] = $this->validate_property($value, $this->object_config[$name]);
+				}
+			}
+
 			$sql = 'UPDATE ' . $this->sql_table . '
 				SET ' . $this->db->sql_build_array('UPDATE', $data) . '
 				WHERE attachment_id = ' . $this->get_id();

attachment/uploader.php

@@ -16,6 +16,7 @@
 use phpbb\files\upload;
 use phpbb\request\request_interface;
 use phpbb\titania\access;
+use phpbb\titania\unicode;
 use phpbb\titania\ext;
 
 class uploader
@@ -260,6 +261,16 @@ public function upload_file()
 			return false;
 		}
 
+		if (unicode::contains_unsupported($file->get('uploadname')))
+		{
+			$file->error[] = $this->user->lang('INVALID_FILENAME', $file->get('uploadname'));
+			$file->remove();
+			$this->filedata['error'] = array_merge($this->filedata['error'], $file->error);
+			$this->filedata['post_attach'] = false;
+
+			return false;
+		}
+
 		// Set max file size for anyone but team members.
 		if (!$this->access->is_team())
 		{

contribution/extension/type.php

@@ -18,6 +18,7 @@
 use phpbb\titania\attachment\attachment;
 use phpbb\titania\config\config as ext_config;
 use phpbb\titania\contribution\type\base;
+use phpbb\titania\unicode;
 use phpbb\titania\entity\package;
 use phpbb\user;
 
@@ -216,7 +217,7 @@ public function epv_test(\titania_contribution $contrib, \titania_revision $revi
 	public function validate_ext_name($name)
 	{
 		return (bool) preg_match(
-			'#^[a-zA-Z0-9\x7f-\xff]{2,}/[a-zA-Z0-9\x7f-\xff]{2,}$#',
+			'#^[a-zA-Z0-9\x{007F}-\x{FFFF}]{2,}/[a-zA-Z0-9\x{007F}-\x{FFFF}]{2,}$#u',
 			$name
 		);
 	}
@@ -283,10 +284,10 @@ protected function repack(package $package, \titania_contribution $contrib, \tit
 		$data = $this->update_phpbb_requirement($data, $revision);
 		$data = $this->set_version_check($data, $contrib);
 
-		$data = json_encode(
+		$data = unicode::escape_json(json_encode(
 			$data,
 			JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE
-		);
+		));
 
 		file_put_contents($composer_file, $data);
 		$package->restore_root($ext_base_path, $ext_name);

contribution/style/colorizeit_helper.php

@@ -13,6 +13,8 @@
 
 namespace phpbb\titania\contribution\style;
 
+use phpbb\titania\unicode;
+
 class colorizeit_helper
 {
 	/** @var array */
@@ -69,6 +71,14 @@ public function generate_options($zip_file, $temp_dir)
 	public function submit_options($options, $revision_id, $db)
 	{
 		$options = serialize($options);
+
+		// These values come from configuration files inside the uploaded style.
+		// Keep serving unsupported names without attempting to cache them.
+		if (unicode::contains_unsupported($options))
+		{
+			return;
+		}
+
 		$sql = 'UPDATE ' . TITANIA_REVISIONS_TABLE . '
 		    SET revision_clr_options = "' . $db->sql_escape($options) . '"
 		    WHERE revision_id = ' . (int) $revision_id;

contribution/style/type.php

@@ -19,6 +19,7 @@
 use phpbb\titania\attachment\attachment;
 use phpbb\titania\config\config as ext_config;
 use phpbb\titania\contribution\type\base;
+use phpbb\titania\unicode;
 use phpbb\titania\entity\package;
 use phpbb\user;
 
@@ -165,7 +166,7 @@ public function upload_check(attachment $attachment)
 	public function fix_package_name(\titania_contribution $contrib, \titania_revision $revision, attachment $attachment, $root_dir = null)
 	{
 		// If we managed to find a single parent directory, then we use that in the zip name, otherwise we fall back to using contrib_name_clean
-		if ($root_dir !== null)
+		if ($root_dir !== null && !unicode::contains_unsupported($root_dir))
 		{
 			$new_real_filename = $root_dir . '_' . strtolower($revision->revision_version) . '.' . $attachment->extension;
 		}

contribution/translation/type.php

@@ -173,7 +173,7 @@ public function translation_validate(\titania_contribution $contrib, \titania_re
 
 		// Save the translation validation results (we need to save it here so that we can add it to the post later)
 		$queue = $revision->get_queue();
-		$queue->tv_results = $translation_validator_output;
+		$queue->tv_results = utf8_encode_ucr($translation_validator_output);
 		$queue->submit();
 
 		return array(

controller/author.php

@@ -405,6 +405,11 @@ protected function create()
 			));
 			$authors['author'] = array($this->user->data['username'] => $this->user->data['user_id']);
 
+			if ($contrib->contrib_name_clean === '')
+			{
+				$contrib->generate_permalink();
+			}
+
 			$error = $contrib->validate($settings['categories'], $authors, $settings['custom']);
 
 			if (($form_key_error = $message->validate_form_key()) !== false)

controller/contribution/manage.php

@@ -193,6 +193,15 @@ public function manage($contrib_type, $contrib)
 
 			$this->contrib->post_data($this->message);
 
+			if (!$this->is_moderator)
+			{
+				$this->settings['permalink'] = $this->contrib->contrib_name_clean;
+			}
+			else if ($this->settings['permalink'] === '')
+			{
+				$this->settings['permalink'] = $this->contrib->get_generated_permalink();
+			}
+
 			$authors = $this->contrib->get_authors_from_usernames(array(
 				'active_coauthors'		=> $this->settings['coauthors']['active'],
 				'nonactive_coauthors'	=> $this->settings['coauthors']['nonactive'],
@@ -205,7 +214,8 @@ public function manage($contrib_type, $contrib)
 				$this->settings['categories'],
 				$authors,
 				$this->settings['custom'],
-				$this->contrib->contrib_name_clean
+				$this->contrib->contrib_name_clean,
+				$this->settings['permalink']
 			));
 
 			// Did we succeed or have an error?
@@ -473,11 +483,6 @@ protected function submit($authors, $old_settings)
 
 			if ($this->settings['permalink'] != $this->contrib->contrib_name_clean)
 			{
-				if ($this->settings['permalink'] == '')
-				{
-					$this->contrib->generate_permalink();
-					$this->settings['permalink'] = $this->contrib->contrib_name_clean;
-				}
 				$this->contrib->change_permalink($this->settings['permalink']);
 			}
 		}

controller/contribution/revision.php

@@ -15,6 +15,7 @@
 
 use phpbb\titania\composer\repository;
 use phpbb\titania\contribution\type\collection as type_collection;
+use phpbb\titania\unicode;
 use phpbb\titania\ext;
 use Symfony\Component\HttpFoundation\JsonResponse;
 
@@ -589,7 +590,7 @@ protected function create_queue_item($allow_repack, $test_account)
 		{
 			$this->queue->queue_notes .=
 				"\n\n[b]" . $this->user->lang('TEST_ACCOUNT') . "[/b]\n" .
-				$test_account
+				utf8_encode_ucr($test_account)
 			;
 		}
 		$this->queue->submit();
@@ -615,6 +616,20 @@ protected function validate_settings($settings)
 			$error[] = $this->user->lang['NO_REVISION_VERSION'];
 		}
 
+		$metadata = array_merge(
+			array($settings['name'], $settings['version'], $settings['license']),
+			$settings['custom']
+		);
+
+		foreach ($metadata as $value)
+		{
+			if (is_string($value) && unicode::contains_unsupported($value))
+			{
+				$error[] = $this->user->lang['REVISION_EMOJI_NOT_ALLOWED'];
+				break;
+			}
+		}
+
 		if (!empty($this->contrib->type->license_options) && !$this->contrib->type->license_allow_custom
 			&& !in_array($settings['license'], $this->contrib->type->license_options))
 		{

controller/contribution/revision_edit.php

@@ -14,6 +14,7 @@
 namespace phpbb\titania\controller\contribution;
 
 use phpbb\titania\contribution\type\collection as type_collection;
+use phpbb\titania\unicode;
 use phpbb\titania\ext;
 use Symfony\Component\HttpFoundation\JsonResponse;
 
@@ -243,6 +244,16 @@ protected function validate_settings($settings)
 		{
 			$error[] = $this->user->lang['FORM_INVALID'];
 		}
+
+		if (
+			unicode::contains_unsupported($settings['name']) ||
+			unicode::contains_unsupported($settings['license']) ||
+			unicode::contains_unsupported($settings['custom_license'])
+		)
+		{
+			$error[] = $this->user->lang['REVISION_EMOJI_NOT_ALLOWED'];
+		}
+
 		$license_options = ($this->contrib->type->license_options) ?: array();
 
 		if ($license_options && !$this->contrib->type->license_allow_custom && !in_array($settings['license'], $license_options))

entity/database_base.php

@@ -255,7 +255,21 @@ protected function validate_string($value, $config)
 		// Truncate to the maximum length
 		if (isset($config['max']) && $config['max'])
 		{
-			truncate_string($value, $config['max']);
+			$value = truncate_string($value, $config['max']);
+		}
+
+		if (!empty($config['encode_ucr']))
+		{
+			$value = utf8_encode_ucr($value);
+
+			// Numeric references use more storage characters than the
+			// characters they represent.
+			while (!empty($config['max']) && utf8_strlen($value) > $config['max'])
+			{
+				$length = utf8_strlen(html_entity_decode($value, ENT_COMPAT, 'UTF-8'));
+				$value = truncate_string($value, $length - 1);
+				$value = utf8_encode_ucr($value);
+			}
 		}
 
 		return $value;

includes/objects/attention.php

@@ -66,8 +66,8 @@ public function __construct()
 			'attention_time'				=> array('default' => titania::$time),
 			'attention_close_time'			=> array('default' => 0),
 			'attention_close_user'			=> array('default' => 0),
-			'attention_title'				=> array('default' => ''),
-			'attention_description'			=> array('default' => ''),
+			'attention_title'				=> array('default' => '',	'max' => 255,	'encode_ucr' => true),
+			'attention_description'			=> array('default' => '',	'encode_ucr' => true),
 			'notify_reporter'				=> array('default' => 0),
 		));
 

includes/objects/category.php

@@ -11,6 +11,7 @@
 *
 */
 
+use phpbb\titania\unicode;
 use phpbb\titania\ext;
 use phpbb\titania\sync;
 
@@ -702,6 +703,10 @@ public function validate()
 		{
 			$error[] = phpbb::$user->lang['NO_CATEGORY_NAME'];
 		}
+		else if (unicode::contains_unsupported($this->category_name))
+		{
+			$error[] = phpbb::$user->lang['CATEGORY_EMOJI_NOT_ALLOWED'];
+		}
 
 		if (!$this->category_name_clean || !preg_match('/^[a-zA-Z0-9\-\_]+$/', $this->category_name_clean))
 		{