From c24458a9f047ba68f0ef8ff4307562df6c4f3611 Mon Sep 17 00:00:00 2001
From: Brion Vibber <brion@pobox.com>
Date: Thu, 2 Sep 2010 14:11:52 -0700
Subject: Ticket #2638: allow themes to specify a base theme to load with
 'include' setting in a theme.ini file

---
 lib/themeuploader.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'lib/themeuploader.php')

diff --git a/lib/themeuploader.php b/lib/themeuploader.php
index abf0658d3..b5ef92e7b 100644
--- a/lib/themeuploader.php
+++ b/lib/themeuploader.php
@@ -198,7 +198,7 @@ class ThemeUploader
     protected function validateFile($filename, $ext)
     {
         $this->validateFileOrFolder($filename);
-        $this->validateExtension($ext);
+        $this->validateExtension($filename, $ext);
         // @fixme validate content
     }
 
@@ -216,13 +216,17 @@ class ThemeUploader
         return true;
     }
 
-    protected function validateExtension($ext)
+    protected function validateExtension($base, $ext)
     {
         $allowed = array('css', // CSS may need validation
                          'png', 'gif', 'jpg', 'jpeg',
                          'svg', // SVG images/fonts may need validation
                          'ttf', 'eot', 'woff');
         if (!in_array(strtolower($ext), $allowed)) {
+            if ($ext == 'ini' && $base == 'theme') {
+                // theme.ini exception
+                return true;
+            }
             $msg = sprintf(_("Theme contains file of type '.%s', " .
                              "which is not allowed."),
                            $ext);
-- 
cgit v1.2.3-54-g00ecf


From cbcb9b0080d262a042adedaf632300e86a57e980 Mon Sep 17 00:00:00 2001
From: Brion Vibber <brion@pobox.com>
Date: Thu, 2 Sep 2010 14:24:46 -0700
Subject: Fixes for Mac metadata files mucking up theme zip files

---
 lib/themeuploader.php | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'lib/themeuploader.php')

diff --git a/lib/themeuploader.php b/lib/themeuploader.php
index b5ef92e7b..5a48e884e 100644
--- a/lib/themeuploader.php
+++ b/lib/themeuploader.php
@@ -192,6 +192,15 @@ class ThemeUploader
         if (in_array(strtolower($ext), $skip)) {
             return true;
         }
+        if ($filename == '' || substr($filename, 0, 1) == '.') {
+            // Skip Unix-style hidden files
+            return true;
+        }
+        if ($filename == '__MACOSX') {
+            // Skip awful metadata files Mac OS X slips in for you.
+            // Thanks Apple!
+            return true;
+        }
         return false;
     }
 
@@ -205,11 +214,13 @@ class ThemeUploader
     protected function validateFileOrFolder($name)
     {
         if (!preg_match('/^[a-z0-9_\.-]+$/i', $name)) {
+            common_log(LOG_ERR, "Bad theme filename: $name");
             $msg = _("Theme contains invalid file or folder name. " .
                      "Stick with ASCII letters, digits, underscore, and minus sign.");
             throw new ClientException($msg);
         }
         if (preg_match('/\.(php|cgi|asp|aspx|js|vb)\w/i', $name)) {
+            common_log(LOG_ERR, "Unsafe theme filename: $name");
             $msg = _("Theme contains unsafe file extension names; may be unsafe.");
             throw new ClientException($msg);
         }
-- 
cgit v1.2.3-54-g00ecf