Merge branch 'bugfix/update-dompdf-11117'

fixes #11117
This commit is contained in:
Alexander A. Klimov 2016-02-15 14:42:19 +01:00
commit 45c95778ae
18 changed files with 140 additions and 111 deletions

View File

@ -106,7 +106,7 @@ Icinga CLI
%package vendor-dompdf
Version: 0.6.1
Version: 0.6.2
Release: 1%{?dist}
Summary: Icinga Web 2 vendor library dompdf
Group: Development/Libraries

View File

@ -1,6 +1,6 @@
curl https://codeload.github.com/dompdf/dompdf/tar.gz/v0.6.1 -o dompdf-0.6.1.tar.gz
tar xzf dompdf-0.6.1.tar.gz --strip-components 1 dompdf-0.6.1/{include/*.php,lib,dompdf*.php,LICENSE.LGPL}
rm dompdf-0.6.1.tar.gz
curl https://codeload.github.com/dompdf/dompdf/tar.gz/v0.6.2 -o dompdf-0.6.2.tar.gz
tar xzf dompdf-0.6.2.tar.gz --strip-components 1 --wildcards dompdf-0.6.2/{include/\*.php,lib,dompdf\*.php,LICENSE.LGPL}
rm dompdf-0.6.2.tar.gz
mv LICENSE.LGPL LICENSE
curl https://codeload.github.com/PhenX/php-font-lib/tar.gz/0.4 -o php-font-lib-0.4.tar.gz

View File

@ -129,6 +129,8 @@ global $_dompdf_show_warnings, $_dompdf_debug, $_DOMPDF_DEBUG_TYPES;
$sapi = php_sapi_name();
$options = array();
$dompdf = new DOMPDF();
switch ( $sapi ) {
case "cli":
@ -168,7 +170,7 @@ switch ( $sapi ) {
if ( $file === "-" )
$outfile = "dompdf_out.pdf";
else
$outfile = str_ireplace(array(".html", ".htm", ".php"), "", $file) . ".pdf";
$outfile = str_ireplace(array(".html", ".htm"), "", $file) . ".pdf";
}
if ( isset($opts["v"]) )
@ -193,6 +195,8 @@ switch ( $sapi ) {
default:
$dompdf->set_option('enable_php', false);
if ( isset($_GET["input_file"]) )
$file = rawurldecode($_GET["input_file"]);
else
@ -219,26 +223,12 @@ switch ( $sapi ) {
$file_parts = explode_url($file);
/* Check to see if the input file is local and, if so, that the base path falls within that specified by DOMDPF_CHROOT */
if(($file_parts['protocol'] == '' || $file_parts['protocol'] === 'file://')) {
$file = realpath($file);
if ( strpos($file, DOMPDF_CHROOT) !== 0 ) {
throw new DOMPDF_Exception("Permission denied on $file. The file could not be found under the directory specified by DOMPDF_CHROOT.");
}
}
if($file_parts['protocol'] === 'php://') {
throw new DOMPDF_Exception("Permission denied on $file. This script does not allow PHP streams.");
}
$outfile = "dompdf_out.pdf"; # Don't allow them to set the output file
$save_file = false; # Don't save the file
break;
}
$dompdf = new DOMPDF();
if ( $file === "-" ) {
$str = "";
while ( !feof(STDIN) )

View File

@ -1,6 +1,7 @@
<?php
// Please refer to dompdf_config.inc.php for details on each configuration option.
//define("DOMPDF_TEMP_DIR", "/tmp");
//define("DOMPDF_CHROOT", DOMPDF_DIR);
//define("DOMPDF_FONT_DIR", DOMPDF_DIR."/lib/fonts/");
//define("DOMPDF_FONT_CACHE", DOMPDF_DIR."/lib/fonts/");
//define("DOMPDF_UNICODE_ENABLED", true);
@ -9,8 +10,6 @@
//define("DOMPDF_DEFAULT_PAPER_SIZE", "letter");
//define("DOMPDF_DEFAULT_FONT", "serif");
//define("DOMPDF_DPI", 72);
//define("DOMPDF_ENABLE_PHP", true);
//define("DOMPDF_ENABLE_REMOTE", true);
define("DOMPDF_ENABLE_CSS_FLOAT", true);
//define("DOMPDF_ENABLE_JAVASCRIPT", false);
//define("DEBUGPNG", true);
@ -26,6 +25,17 @@ define("DOMPDF_ENABLE_CSS_FLOAT", true);
//define("DOMPDF_ENABLE_HTML5PARSER", true);
//define("DOMPDF_ENABLE_FONTSUBSETTING", true);
// DOMPDF authentication
// Authentication for the dompdf/www
//define("DOMPDF_ADMIN_USERNAME", "user");
//define("DOMPDF_ADMIN_PASSWORD", "password");
/**
* Attention!
* The following settings may increase the risk of system exploit.
* Do not change these settings without understanding the consequences.
* Additional documentation is available on the dompdf wiki at:
* https://github.com/dompdf/dompdf/wiki
*/
//define("DOMPDF_CHROOT", DOMPDF_DIR);
//define("DOMPDF_ENABLE_PHP", false);
//define("DOMPDF_ENABLE_REMOTE", false);

View File

@ -5,7 +5,7 @@
* @author Benj Carson <benjcarson@digitaljunkies.ca>
* @author Helmut Tischer <htischer@weihenstephan.org>
* @author Fabien Ménager <fabien.menager@gmail.com>
* @autho Brian Sweeney <eclecticgeek@gmail.com>
* @author Brian Sweeney <eclecticgeek@gmail.com>
* @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
*/
@ -246,9 +246,11 @@ def("DOMPDF_DPI", 96);
* If this setting is set to true then DOMPDF will automatically evaluate
* inline PHP contained within <script type="text/php"> ... </script> tags.
*
* Attention!
* Enabling this for documents you do not trust (e.g. arbitrary remote html
* pages) is a security risk. Set this option to false if you wish to process
* untrusted documents.
* pages) is a security risk. Inline scripts are run with the same level of
* system access available to dompdf. Set this option to false (recommended)
* if you wish to process untrusted documents.
*
* @var bool
*/

View File

@ -100,7 +100,7 @@ abstract class Abstract_Renderer {
//Therefore read dimension directly from file, instead of creating gd object first.
//$img_w = imagesx($src); $img_h = imagesy($src);
list($img_w, $img_h) = dompdf_getimagesize($img);
list($img_w, $img_h) = dompdf_getimagesize($img, $this->_dompdf->get_http_context());
if (!isset($img_w) || $img_w == 0 || !isset($img_h) || $img_h == 0) {
return;
}

View File

@ -604,7 +604,7 @@ class CPDF_Adapter implements Canvas {
}
function image($img, $x, $y, $w, $h, $resolution = "normal") {
list($width, $height, $type) = dompdf_getimagesize($img);
list($width, $height, $type) = dompdf_getimagesize($img, $this->_dompdf->get_http_context());
$debug_png = $this->_dompdf->get_option("debug_png");

View File

@ -185,6 +185,25 @@ class DOMPDF {
*/
private $_quirksmode = false;
/**
* Protocol whitelist
*
* Protocols and PHP wrappers allowed in URLs. Full support is not
* guarantee for the protocols/wrappers contained in this array.
*
* @var array
*/
private $_allowed_protocols = array(null, "", "file://", "http://", "https://");
/**
* Local file extension whitelist
*
* File extensions supported by dompdf for local files.
*
* @var array
*/
private $_allowed_local_file_extensions = array("htm", "html");
/**
* The list of built-in fonts
*
@ -474,6 +493,10 @@ class DOMPDF {
list($this->_protocol, $this->_base_host, $this->_base_path) = explode_url($file);
}
if ( !in_array($this->_protocol, $this->_allowed_protocols) ) {
throw new DOMPDF_Exception("Permission denied on $file. The communication protocol is not supported.");
}
if ( !$this->get_option("enable_remote") && ($this->_protocol != "" && $this->_protocol !== "file://" ) ) {
throw new DOMPDF_Exception("Remote file requested, but DOMPDF_ENABLE_REMOTE is false.");
}
@ -482,20 +505,21 @@ class DOMPDF {
// Get the full path to $file, returns false if the file doesn't exist
$realfile = realpath($file);
if ( !$realfile ) {
throw new DOMPDF_Exception("File '$file' not found.");
}
$chroot = $this->get_option("chroot");
if ( strpos($realfile, $chroot) !== 0 ) {
throw new DOMPDF_Exception("Permission denied on $file. The file could not be found under the directory specified by DOMPDF_CHROOT.");
}
// Exclude dot files (e.g. .htaccess)
if ( substr(basename($realfile), 0, 1) === "." ) {
$ext = pathinfo($realfile, PATHINFO_EXTENSION);
if (!in_array($ext, $this->_allowed_local_file_extensions)) {
throw new DOMPDF_Exception("Permission denied on $file.");
}
if ( !$realfile ) {
throw new DOMPDF_Exception("File '$file' not found.");
}
$file = $realfile;
}

View File

@ -217,10 +217,18 @@ class Font_Metrics {
*/
static function save_font_families() {
// replace the path to the DOMPDF font directories with the corresponding constants (allows for more portability)
$cache_data = var_export(self::$_font_lookup, true);
$cache_data = str_replace('\''.DOMPDF_FONT_DIR , 'DOMPDF_FONT_DIR . \'' , $cache_data);
$cache_data = str_replace('\''.DOMPDF_DIR , 'DOMPDF_DIR . \'' , $cache_data);
$cache_data = "<"."?php return $cache_data ?".">";
$cache_data = sprintf("<?php return array (%s", PHP_EOL);
foreach (self::$_font_lookup as $family => $variants) {
$cache_data .= sprintf(" '%s' => array(%s", addslashes($family), PHP_EOL);
foreach ($variants as $variant => $path) {
$path = sprintf("'%s'", $path);
$path = str_replace('\'' . DOMPDF_FONT_DIR , 'DOMPDF_FONT_DIR . \'' , $path);
$path = str_replace('\'' . DOMPDF_DIR , 'DOMPDF_DIR . \'' , $path);
$cache_data .= sprintf(" '%s' => %s,%s", $variant, $path, PHP_EOL);
}
$cache_data .= sprintf(" ),%s", PHP_EOL);
}
$cache_data .= ") ?>";
file_put_contents(self::CACHE_FILE, $cache_data);
}
@ -249,13 +257,18 @@ class Font_Metrics {
return;
}
self::$_font_lookup = require_once self::CACHE_FILE;
$cache_data = require_once self::CACHE_FILE;
// If the font family cache is still in the old format
if ( self::$_font_lookup === 1 ) {
$cache_data = file_get_contents(self::CACHE_FILE);
file_put_contents(self::CACHE_FILE, "<"."?php return $cache_data ?".">");
self::$_font_lookup = require_once self::CACHE_FILE;
$cache_data = require_once self::CACHE_FILE;
}
self::$_font_lookup = array();
foreach ($cache_data as $key => $value) {
self::$_font_lookup[stripslashes($key)] = $value;
}
// Merge provided fonts
@ -318,7 +331,7 @@ class Font_Metrics {
self::$_font_lookup[mb_strtolower($fontname)] = $entry;
}
static function register_font($style, $remote_file) {
static function register_font($style, $remote_file, $context = null) {
$fontname = mb_strtolower($style["family"]);
$families = Font_Metrics::get_font_families();
@ -328,6 +341,7 @@ class Font_Metrics {
}
$local_file = DOMPDF_FONT_DIR . md5($remote_file);
$local_temp_file = DOMPDF_TEMP_DIR . "/" . md5($remote_file);
$cache_entry = $local_file;
$local_file .= ".ttf";
@ -336,23 +350,28 @@ class Font_Metrics {
if ( !isset($entry[$style_string]) ) {
$entry[$style_string] = $cache_entry;
Font_Metrics::set_font_family($fontname, $entry);
// Download the remote file
if ( !is_file($local_file) ) {
file_put_contents($local_file, file_get_contents($remote_file));
}
file_put_contents($local_temp_file, file_get_contents($remote_file, null, $context));
$font = Font::load($local_file);
$font = Font::load($local_temp_file);
if (!$font) {
unlink($local_temp_file);
return false;
}
$font->parse();
$font->saveAdobeFontMetrics("$cache_entry.ufm");
unlink($local_temp_file);
if ( !file_exists("$cache_entry.ufm") ) {
return false;
}
// Save the changes
file_put_contents($local_file, file_get_contents($remote_file, null, $context));
Font_Metrics::set_font_family($fontname, $entry);
Font_Metrics::save_font_families();
}

View File

@ -128,18 +128,16 @@ function d($mixed) {
* is appended (o.k. also for Windows)
*/
function build_url($protocol, $host, $base_path, $url) {
$protocol = mb_strtolower($protocol);
if (strlen($url) == 0) {
//return $protocol . $host . rtrim($base_path, "/\\") . "/";
return $protocol . $host . $base_path;
}
// Is the url already fully qualified or a Data URI?
if (mb_strpos($url, "://") !== false || mb_strpos($url, "data:") === 0) {
return $url;
}
$ret = $protocol;
if (!in_array(mb_strtolower($protocol), array("http://", "https://", "ftp://", "ftps://"))) {
//On Windows local file, an abs path can begin also with a '\' or a drive letter and colon
//drive: followed by a relative path would be a drive specific default folder.
@ -153,22 +151,22 @@ function build_url($protocol, $host, $base_path, $url) {
$ret = preg_replace('/\?(.*)$/', "", $ret);
return $ret;
}
// Protocol relative urls (e.g. "//example.org/style.css")
if (strpos($url, '//') === 0) {
$ret .= substr($url, 2);
//remote urls with backslash in html/css are not really correct, but lets be genereous
if ( $url[0] === '/' || $url[0] === '\\' ) {
} elseif ($url[0] === '/' || $url[0] === '\\') {
// Absolute path
$ret .= $host . $url;
}
else {
} else {
// Relative path
//$base_path = $base_path !== "" ? rtrim($base_path, "/\\") . "/" : "";
$ret .= $host . $base_path . $url;
}
return $ret;
}
/**
* parse a full url or pathname and return an array(protocol, host, path,
* file + query + fragment)
@ -183,6 +181,9 @@ function explode_url($url) {
$file = "";
$arr = parse_url($url);
if ( isset($arr["scheme"])) {
$arr["scheme"] == mb_strtolower($arr["scheme"]);
}
// Exclude windows drive letters...
if ( isset($arr["scheme"]) && $arr["scheme"] !== "file" && strlen($arr["scheme"]) > 1 ) {
@ -229,7 +230,7 @@ function explode_url($url) {
}
else {
$i = mb_strpos($url, "file://");
$i = mb_stripos($url, "file://");
if ( $i !== false ) {
$url = mb_substr($url, $i + 7);
}
@ -400,6 +401,12 @@ if (!extension_loaded('mbstring')) {
}
}
if (!function_exists('mb_stripos')) {
function mb_stripos($haystack, $needle, $offset = 0) {
return stripos($haystack, $needle, $offset);
}
}
if (!function_exists('mb_strrpos')) {
function mb_strrpos($haystack, $needle, $offset = 0) {
return strrpos($haystack, $needle, $offset);
@ -748,7 +755,7 @@ function imagecreatefrombmp($filename) {
* @param string $filename
* @return array The same format as getimagesize($filename)
*/
function dompdf_getimagesize($filename) {
function dompdf_getimagesize($filename, $context = null) {
static $cache = array();
if ( isset($cache[$filename]) ) {
@ -758,7 +765,7 @@ function dompdf_getimagesize($filename) {
list($width, $height, $type) = getimagesize($filename);
if ( $width == null || $height == null ) {
$data = file_get_contents($filename, null, null, 0, 26);
$data = file_get_contents($filename, null, $context, 0, 26);
if ( substr($data, 0, 2) === "BM" ) {
$meta = unpack('vtype/Vfilesize/Vreserved/Voffset/Vheadersize/Vwidth/Vheight', $data);
@ -1005,31 +1012,6 @@ else {
}
}
if ( function_exists("curl_init") ) {
function DOMPDF_fetch_url($url, &$headers = null) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
$data = curl_exec($ch);
$raw_headers = substr($data, 0, curl_getinfo($ch, CURLINFO_HEADER_SIZE));
$headers = preg_split("/[\n\r]+/", trim($raw_headers));
$data = substr($data, curl_getinfo($ch, CURLINFO_HEADER_SIZE));
curl_close($ch);
return $data;
}
}
else {
function DOMPDF_fetch_url($url, &$headers = null) {
$data = file_get_contents($url);
$headers = $http_response_header;
return $data;
}
}
/**
* Affect null to the unused objects

View File

@ -553,7 +553,7 @@ class GD_Adapter implements Canvas {
* @internal param string $img_type the type (e.g. extension) of the image
*/
function image($img_url, $x, $y, $w, $h, $resolution = "normal") {
$img_type = Image_Cache::detect_type($img_url);
$img_type = Image_Cache::detect_type($img_url, $this->_dompdf->get_http_context());
$img_ext = Image_Cache::type_to_ext($img_type);
if ( !$img_ext ) {

View File

@ -45,6 +45,7 @@ class Image_Cache {
* @return array An array with two elements: The local path to the image and the image extension
*/
static function resolve_url($url, $protocol, $host, $base_path, DOMPDF $dompdf) {
$protocol = mb_strtolower($protocol);
$parsed_url = explode_url($url);
$message = null;
@ -84,7 +85,7 @@ class Image_Cache {
}
else {
set_error_handler("record_warnings");
$image = file_get_contents($full_url);
$image = file_get_contents($full_url, null, $dompdf->get_http_context());
restore_error_handler();
}
@ -118,7 +119,7 @@ class Image_Cache {
// Check is the file is an image
else {
list($width, $height, $type) = dompdf_getimagesize($resolved_url);
list($width, $height, $type) = dompdf_getimagesize($resolved_url, $dompdf->get_http_context());
// Known image type
if ( $width && $height && in_array($type, array(IMAGETYPE_GIF, IMAGETYPE_PNG, IMAGETYPE_JPEG, IMAGETYPE_BMP)) ) {
@ -138,7 +139,8 @@ class Image_Cache {
catch(DOMPDF_Image_Exception $e) {
$resolved_url = self::$broken_image;
$type = IMAGETYPE_PNG;
$message = $e->getMessage()." \n $url";
$message = "Image not found or type unknown";
$_dompdf_warnings[] = $e->getMessage()." :: $url";
}
return array($resolved_url, $type, $message);
@ -159,8 +161,8 @@ class Image_Cache {
self::$_cache = array();
}
static function detect_type($file) {
list(, , $type) = dompdf_getimagesize($file);
static function detect_type($file, $context = null) {
list(, , $type) = dompdf_getimagesize($file, $context);
return $type;
}

View File

@ -41,7 +41,7 @@ class Image_Frame_Reflower extends Frame_Reflower {
function get_min_max_width() {
if (DEBUGPNG) {
// Determine the image's size. Time consuming. Only when really needed?
list($img_width, $img_height) = dompdf_getimagesize($this->_frame->get_image_url());
list($img_width, $img_height) = dompdf_getimagesize($this->_frame->get_image_url(), $this->get_dompdf()->get_http_context());
print "get_min_max_width() ".
$this->_frame->get_style()->width.' '.
$this->_frame->get_style()->height.';'.
@ -104,7 +104,7 @@ class Image_Frame_Reflower extends Frame_Reflower {
if ($width == 0 || $height == 0) {
// Determine the image's size. Time consuming. Only when really needed!
list($img_width, $img_height) = dompdf_getimagesize($this->_frame->get_image_url());
list($img_width, $img_height) = dompdf_getimagesize($this->_frame->get_image_url(), $this->get_dompdf()->get_http_context());
// don't treat 0 as error. Can be downscaled or can be catched elsewhere if image not readable.
// Resample according to px per inch

View File

@ -48,7 +48,7 @@ class List_Bullet_Image_Frame_Decorator extends Frame_Decorator {
$frame->get_node()->setAttribute("src", $url);
$this->_img = new Image_Frame_Decorator($frame, $dompdf);
parent::__construct($this->_img, $dompdf);
list($width, $height) = dompdf_getimagesize($this->_img->get_image_url());
list($width, $height) = dompdf_getimagesize($this->_img->get_image_url(), $dompdf->get_http_context());
// Resample the bullet image to be consistent with 'auto' sized images
// See also Image_Frame_Reflower::get_min_max_width

View File

@ -141,7 +141,7 @@ class List_Bullet_Renderer extends Abstract_Renderer {
// Tested php ver: value measured in px, suffix "px" not in value: rtrim unnecessary.
//$w = $frame->get_width();
//$h = $frame->get_height();
list($width, $height) = dompdf_getimagesize($img);
list($width, $height) = dompdf_getimagesize($img, $this->_dompdf->get_http_context());
$dpi = $this->_dompdf->get_option("dpi");
$w = ((float)rtrim($width, "px") * 72) / $dpi;
$h = ((float)rtrim($height, "px") * 72) / $dpi;

View File

@ -770,7 +770,7 @@ class PDFLib_Adapter implements Canvas {
$w = (int)$w;
$h = (int)$h;
$img_type = Image_Cache::detect_type($img_url);
$img_type = Image_Cache::detect_type($img_url, $this->_dompdf->get_http_context());
$img_ext = Image_Cache::type_to_ext($img_type);
if ( !isset($this->_imgs[$img_url]) ) {

View File

@ -1250,7 +1250,7 @@ class Stylesheet {
"path" => build_url($this->_protocol, $this->_base_host, $this->_base_path, $src[2][$i]),
);
if ( !$source["local"] && in_array($source["format"], array("", "woff", "opentype", "truetype")) ) {
if ( !$source["local"] && in_array($source["format"], array("", "truetype")) ) {
$valid_sources[] = $source;
}
@ -1268,7 +1268,7 @@ class Stylesheet {
"style" => $descriptors->font_style,
);
Font_Metrics::register_font($style, $valid_sources[0]["path"]);
Font_Metrics::register_font($style, $valid_sources[0]["path"], $this->_dompdf->get_http_context());
}
/**

View File

@ -749,7 +749,7 @@ end
EOT;
$res = "<</Length " . mb_strlen($stream, '8bit') . " >>\n";
$res .= "stream\n" . $stream . "endstream";
$res .= "stream\n" . $stream . "\nendstream";
$this->objects[$toUnicodeId]['c'] = $res;
@ -1875,7 +1875,7 @@ EOT;
$tmp = 'o_'.$v['t'];
$cont = $this->$tmp($k, 'out');
$content.= $cont;
$xref[] = $pos;
$xref[] = $pos+1; //+1 to account for \n at the start of each object
$pos+= mb_strlen($cont, '8bit');
}
@ -2426,7 +2426,7 @@ EOT;
$flags+= pow(2, 5); // assume non-sybolic
$list = array(
'Ascent' => 'Ascender',
'CapHeight' => 'CapHeight',
'CapHeight' => 'Ascender', //FIXME: php-font-lib is not grabbing this value, so we'll fake it and use the Ascender value // 'CapHeight'
'MissingWidth' => 'MissingWidth',
'Descent' => 'Descender',
'FontBBox' => 'FontBBox',