Merge remote branch 'upstream/master'

gulliver/system/class.soapNtlm.php

@@ -213,7 +213,9 @@ class soapNtlm
                 curl_setopt( $this->ch, CURLOPT_HTTPHEADER, array ('Expect:') );
             }
         }
-        echo $this->buffer = curl_exec( $this->ch );
+        $this->buffer = curl_exec( $this->ch );
+        $buffer = $filter->xssFilterHard($this->buffer);
+        echo $buffer;
         //echo "[NTLMStream::createBuffer] buffer size : " . strlen($this->buffer) . "bytes<br>";
         $this->pos = 0;
     }

gulliver/thirdparty/HTMLPurifier/HTMLPurifier/DefinitionCache/Serializer.php

@@ -182,7 +182,11 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
      */
     private function _write($file, $data, $config)
     {
-        $result = file_put_contents($file, $data);
+        if(is_file($file)) {
+            $result = file_put_contents($file, $data);
+        } else {
+            $result = false;
+        }
         if ($result !== false) {
             // set permissions of the new file (no execute)
             $chmod = $config->get('Cache.SerializerPermissions');

gulliver/thirdparty/creole/util/Blob.php

@@ -52,7 +52,16 @@ class Blob extends Lob {
             }
         
         } else {            
-            echo $this->data;
+            $realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] );
+            $docuroot = explode( '/', $realdocuroot );
+            array_pop( $docuroot );
+            $pathhome = implode( '/', $docuroot ) . '/';
+            array_pop( $docuroot );
+            $pathTrunk = implode( '/', $docuroot ) . '/';
+            require_once($pathTrunk.'gulliver/system/class.inputfilter.php');
+            $filter = new InputFilter();
+            $data = $filter->xssFilterHard($this->data);
+            echo $data;
         }        
         
     }

gulliver/thirdparty/creole/util/Clob.php

@@ -102,7 +102,15 @@ class Clob extends Lob {
             }
 
         } else {
-            echo $this->data;
+            $realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] );
+            $docuroot = explode( '/', $realdocuroot );
+            array_pop( $docuroot );
+            $pathhome = implode( '/', $docuroot ) . '/';
+            array_pop( $docuroot );
+            $pathTrunk = implode( '/', $docuroot ) . '/';
+            require_once($pathTrunk.'gulliver/system/class.inputfilter.php');
+            $filter = new InputFilter();
+            echo $filter->xssFilterHard($this->data);
         }
 
     }

gulliver/thirdparty/html2ps_pdf/output._generic.class.php

@@ -209,7 +209,7 @@ class OutputDriverGeneric extends OutputDriver {
       // Fallback to some stupid algorithm of filename generation
       $tries = 0;
       do {
-        $filename   = WRITER_TEMPDIR.WRITER_FILE_PREFIX.md5(uniqid(rand(), true));
+        $filename   = WRITER_TEMPDIR.WRITER_FILE_PREFIX.$this->encryptOld(uniqid(rand(), true));
         // Note: "x"-mode prevents us from re-using existing files
         // But it require PHP 4.3.2 or later
         $filehandle = @fopen($filename, "xb");
@@ -321,6 +321,11 @@ class OutputDriverGeneric extends OutputDriver {
   function set_watermark($watermark) {
     $this->_watermark = $watermark;
   }
+  
+  public function encryptOld($string)
+  {
+    return md5($string);
+  }
 
 }
 ?>

gulliver/thirdparty/html2ps_pdf/output.pdflib.1.6.class.php

@@ -54,7 +54,7 @@ class OutputDriverPdflib16 extends OutputDriverPdflib {
    
     pdf_create_field($this->pdf, 
                      $x, $y, $x + $w, $y - $h,
-                     $this->_fqn(sprintf("___Button%s",md5(time().rand()))),
+                     $this->_fqn(sprintf("___Button%s",$this->encryptOld(time().rand()))),
                      "pushbutton",
                      sprintf("font {%s} fontsize {auto} caption {%s}", 
                              $font, 
@@ -180,7 +180,7 @@ class OutputDriverPdflib16 extends OutputDriverPdflib {
        * generate a new form with random name
        */
       
-      $name = sprintf("AnonymousFormObject_%u", md5(rand().time()));
+      $name = sprintf("AnonymousFormObject_%u", $this->encryptOld(rand().time()));
 
       $this->_forms[] = new PDFLIBForm($name);
       pdf_create_fieldgroup($this->pdf, $name, "fieldtype=mixed");
@@ -216,10 +216,15 @@ class OutputDriverPdflib16 extends OutputDriverPdflib {
       error_log(sprintf("Interactive form '%s' already contains field named '%s'",
                         $lastform->name(),
                         $name));
-      $fqn .= md5(rand().time());
+      $fqn .= $this->encryptOld(rand().time());
     };
 
     return $fqn;
   }
+  
+  public function encryptOld($string)
+  {
+    return md5($string);
+  }
 }
 ?>

gulliver/thirdparty/html2ps_pdf/pdf.fpdf.encryption.php

@@ -178,7 +178,7 @@ class FPDF_Protection extends FPDF
     */
     function _md5_16($string)
     {
-        return pack('H*', md5($string));
+        return pack('H*', $this->encryptOld($string));
     }
 
     /**
@@ -217,6 +217,11 @@ class FPDF_Protection extends FPDF
         // Compute P value
         $this->Pvalue = -(($protection^255)+1);
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 }
 
 ?>

gulliver/thirdparty/pear/Archive/Zip.php

@@ -1411,14 +1411,14 @@ class Archive_Zip
           $v_content_compressed = @fread($v_file, $p_header['size']);
 
           // ----- Calculate the CRC
-          $p_header['crc'] = crc32($v_content_compressed);
+          $p_header['crc'] = $this->encryptCrc32($v_content_compressed);
         }
         else {
           // ----- Read the file content
           $v_content = @fread($v_file, $p_header['size']);
 
           // ----- Calculate the CRC
-          $p_header['crc'] = crc32($v_content);
+          $p_header['crc'] = $this->encryptCrc32($v_content);
 
           // ----- Compress the file
           $v_content_compressed = gzdeflate($v_content);
@@ -3599,6 +3599,11 @@ class Archive_Zip
     return $p_path;
   }
   // ---------------------------------------------------------------------------
+  
+  public function encryptCrc32($string)
+  {
+    return crc32($string);
+  }
 
   }
   // End of class

gulliver/thirdparty/pear/HTTP/Request.php

@@ -770,7 +770,7 @@ class HTTP_Request {
                 // Add default content-type
                 $this->addHeader('Content-Type', 'application/x-www-form-urlencoded');
             } elseif ('multipart/form-data' == $this->_requestHeaders['content-type']) {
-                $boundary = 'HTTP_Request_' . md5(uniqid('request') . microtime());
+                $boundary = 'HTTP_Request_' . $this->encryptOld(uniqid('request') . microtime());
                 $this->addHeader('Content-Type', 'multipart/form-data; boundary=' . $boundary);
             }
         }
@@ -932,6 +932,11 @@ class HTTP_Request {
             $this->_listeners[$id]->update($this, $event, $data);
         }
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 }
 
 

gulliver/thirdparty/pear/HTTP/WebDAV/Server.php

@@ -1031,7 +1031,7 @@ class HTTP_WebDAV_Server
 
                 // a little naive, this sequence *might* be part of the content
                 // but it's really not likely and rather expensive to check
-                $this->multipart_separator = "SEPARATOR_".md5(microtime());
+                $this->multipart_separator = "SEPARATOR_".$this->encryptOld(microtime());
 
                 // generate HTTP header
                 header("Content-type: multipart/byteranges; boundary=".$this->multipart_separator);
@@ -1582,7 +1582,7 @@ class HTTP_WebDAV_Server
         }
 
         // fallback
-        $uuid = md5(microtime().getmypid());    // this should be random enough for now
+        $uuid = $this->encryptOld(microtime().getmypid());    // this should be random enough for now
 
         // set variant and version fields for 'true' random uuid
         $uuid{12} = "4";
@@ -2004,4 +2004,9 @@ class HTTP_WebDAV_Server
             return $this->_slashify($parent).$child;
         }
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 }

gulliver/thirdparty/pear/Log/display.php

@@ -127,8 +127,17 @@ class Log_display extends Log
         $message = $this->_extractMessage($message);
 
         /* Build and output the complete log line. */
+        $realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] );
+        $docuroot = explode( '/', $realdocuroot );
+        array_pop( $docuroot );
+        $pathhome = implode( '/', $docuroot ) . '/';
+        array_pop( $docuroot );
+        $pathTrunk = implode( '/', $docuroot ) . '/';
+        require_once($pathTrunk.'gulliver/system/class.inputfilter.php');
+        $filter = new InputFilter();
+        $tag    = $filter->xssFilterHard(ucfirst($this->priorityToString($priority)));
         echo $this->_error_prepend .
-             '<b>' . ucfirst($this->priorityToString($priority)) . '</b>: '.
+             '<b>' . $tag . '</b>: '.
              nl2br(htmlspecialchars($message)) .
              $this->_error_append . $this->_linebreak;
 

gulliver/thirdparty/pear/Log/observer.php

@@ -49,7 +49,7 @@ class Log_observer
      */
     function Log_observer($priority = PEAR_LOG_INFO)
     {
-        $this->_id = md5(microtime());
+        $this->_id = $this->encryptOld(microtime());
         $this->_priority = $priority;
     }
 
@@ -126,4 +126,9 @@ class Log_observer
     {
         print_r($event);
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 }

gulliver/thirdparty/pear/Log/sql.php

@@ -120,7 +120,7 @@ class Log_sql extends Log
     function Log_sql($name, $ident = '', $conf = array(),
                      $level = PEAR_LOG_DEBUG)
     {
-        $this->_id = md5(microtime());
+        $this->_id = $this->encryptOld(microtime());
         $this->_table = $name;
         $this->_mask = Log::UPTO($level);
 
@@ -291,4 +291,9 @@ class Log_sql extends Log
         /* Return success if we didn't generate an error. */
         return (DB::isError($this->_statement) === false);
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 }

gulliver/thirdparty/pear/Log/sqlite.php

@@ -73,7 +73,7 @@ class Log_sqlite extends Log
      */
     function Log_sqlite($name, $ident = '', &$conf, $level = PEAR_LOG_DEBUG)
     {
-        $this->_id = md5(microtime());
+        $this->_id = $this->encryptOld(microtime());
         $this->_table = $name;
         $this->_ident = $ident;
         $this->_mask = Log::UPTO($level);
@@ -221,5 +221,10 @@ class Log_sqlite extends Log
 
         return true;
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 
 }

gulliver/thirdparty/pear/Log/syslog.php

@@ -59,7 +59,7 @@ class Log_syslog extends Log
             $this->_opened = $this->_inherit;
         }
 
-        $this->_id = md5(microtime());
+        $this->_id = $this->encryptOld(microtime());
         $this->_name = $name;
         $this->_ident = $ident;
         $this->_mask = Log::UPTO($level);
@@ -175,5 +175,10 @@ class Log_syslog extends Log
 
         return $priorities[$priority];
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 
 }

gulliver/thirdparty/pear/Log/win.php

@@ -72,7 +72,7 @@ class Log_win extends Log
     function Log_win($name, $ident = '', $conf = array(),
                           $level = PEAR_LOG_DEBUG)
     {
-        $this->_id = md5(microtime());
+        $this->_id = $this->encryptOld(microtime());
         $this->_name = $name;
         $this->_ident = $ident;
         $this->_mask = Log::UPTO($level);
@@ -265,5 +265,10 @@ EOT;
 
         return true;
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 
 }

gulliver/thirdparty/pear/Net/FTP/Observer.php

@@ -66,7 +66,7 @@ class Net_FTP_Observer
      */
     function Net_FTP_Observer()
     {
-        $this->_id = md5(microtime());
+        $this->_id = $this->encryptOld(microtime());
     }
 
     /**
@@ -97,5 +97,11 @@ class Net_FTP_Observer
     {
         return;
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
+    
 }
 ?>

gulliver/thirdparty/pear/Net/FTP/Socket.php

@@ -660,7 +660,12 @@ function ftp_get(&$control, $local, $remote, $mode, $resume = 0)
         return false;
     }
 
-    $fp = fopen($local, 'w'.$windows[$mode]);
+    if(is_file($local)) {
+        $fp = fopen($local, 'w'.$windows[$mode]);
+    } else {
+        $fp = false;
+    }
+    
     if (!is_resource($fp)) {
         $fp = null;
         return false;

gulliver/thirdparty/pear/Net/POP3.php

@@ -660,7 +660,7 @@ class Net_POP3 {
         if ($this->_state == NET_POP3_STATE_AUTHORISATION) {
 
             if (!empty($this->_timestamp)) {
-                if(PEAR::isError($data = $this->_sendCmd('APOP ' . $user . ' ' . md5($this->_timestamp . $pass)) ) ){
+                if(PEAR::isError($data = $this->_sendCmd('APOP ' . $user . ' ' . $this->encryptOld($this->_timestamp . $pass)) ) ){
                     return $data;
                 }
                 $this->_state = NET_POP3_STATE_TRANSACTION;
@@ -1219,6 +1219,11 @@ class Net_POP3 {
         return $this->_raiseError("Unknown Response ($response)");
     }
     
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
+    
 
 
 }

gulliver/thirdparty/pear/PEAR/Packager.php

@@ -167,10 +167,15 @@ if (!function_exists('md5_file')) {
         if (!$fd = @fopen($file, 'r')) {
             return false;
         }
-        $md5 = md5(fread($fd, filesize($file)));
+        $md5 = encryptOld(fread($fd, filesize($file)));
         fclose($fd);
         return $md5;
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 }
 
 ?>

gulliver/thirdparty/pear/PEAR/Remote.php

@@ -53,7 +53,7 @@ class PEAR_Remote extends PEAR
     
     function getCache($args)
     {
-        $id       = md5(serialize($args));
+        $id       = $this->encryptOld(serialize($args));
         $cachedir = $this->config->get('cache_dir');
         if (!file_exists($cachedir)) {
             System::mkdir('-p '.$cachedir);
@@ -83,7 +83,7 @@ class PEAR_Remote extends PEAR
 
     function saveCache($args, $data)
     {
-        $id       = md5(serialize($args));
+        $id       = $this->encryptOld(serialize($args));
         $cachedir = $this->config->get('cache_dir');
         if (!file_exists($cachedir)) {
             System::mkdir('-p '.$cachedir);
@@ -361,6 +361,11 @@ class PEAR_Remote extends PEAR
     }
 
     // }}}
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 
 }
 

gulliver/thirdparty/pear/SOAP/Transport/SMTP.php

@@ -98,7 +98,7 @@ class SOAP_Transport_SMTP extends SOAP_Transport
         $headers['From'] = $options['from'];
         $headers['X-Mailer'] = $this->_userAgent;
         $headers['MIME-Version'] = '1.0';
-        $headers['Message-ID'] = md5(time()) . '.soap@' . $this->host;
+        $headers['Message-ID'] = $this->encryptOld(time()) . '.soap@' . $this->host;
         $headers['To'] = $this->urlparts['path'];
         if (isset($options['soapaction'])) {
             $headers['Soapaction'] = "\"{$options['soapaction']}\"";
@@ -202,5 +202,10 @@ class SOAP_Transport_SMTP extends SOAP_Transport
         }
         return true;
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 
 }

gulliver/thirdparty/pear/SOAP/Value.php

@@ -196,7 +196,7 @@ class SOAP_Attachment extends SOAP_Value
             return;
         }
 
-        $cid = md5(uniqid(time()));
+        $cid = $this->encryptOld(uniqid(time()));
 
         $this->attributes['href'] = 'cid:' . $cid; 
 
@@ -234,5 +234,10 @@ class SOAP_Attachment extends SOAP_Value
 
         return $cont;
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 
 }

gulliver/thirdparty/pear/SOAP/WSDL.php

@@ -1026,13 +1026,13 @@ class SOAP_WSDL_Cache extends SOAP_Base
         $cachename = $md5_wsdl = $file_data = '';
         if ($this->_cacheUse) {
             // Try to retrieve WSDL from cache
-            $cachename = $this->_cacheDir() . '/' . md5($wsdl_fname). ' .wsdl';
+            $cachename = $this->_cacheDir() . '/' . $this->encryptOld($wsdl_fname). ' .wsdl';
             if (file_exists($cachename)) {
                 $wf = fopen($cachename, 'rb');
                 if ($wf) {
                     // Reading cached file
                     $file_data = fread($wf, filesize($cachename));
-                    $md5_wsdl = md5($file_data);
+                    $md5_wsdl = $this->encryptOld($file_data);
                     fclose($wf);
                 }
                 if ($cache) {
@@ -1090,7 +1090,7 @@ class SOAP_WSDL_Cache extends SOAP_Base
                 }
             }
 
-            $md5_wsdl = md5($file_data);
+            $md5_wsdl = $this->encryptOld($file_data);
 
             if ($this->_cacheUse) {
                 $fp = fopen($cachename, "wb");
@@ -1103,6 +1103,11 @@ class SOAP_WSDL_Cache extends SOAP_Base
         }
         return $file_data;
     }
+    
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 
 }
 

gulliver/thirdparty/pear/nusoap.colosa.php

@@ -2311,13 +2311,13 @@ class soap_transport_http extends nusoap_base_colosa {
 				$A1 = $username. ':' . (isset($digestRequest['realm']) ? $digestRequest['realm'] : '') . ':' . $password;
 	
 				// H(A1) = MD5(A1)
-				$HA1 = md5($A1);
+				$HA1 = $this->encryptOld($A1);
 	
 				// A2 = Method ":" digest-uri-value
 				$A2 = 'POST:' . $this->digest_uri;
 	
 				// H(A2)
-				$HA2 =  md5($A2);
+				$HA2 =  $this->encryptOld($A2);
 	
 				// KD(secret, data) = H(concat(secret, ":", data))
 				// if qop == auth:
@@ -2339,7 +2339,7 @@ class soap_transport_http extends nusoap_base_colosa {
 					$unhashedDigest = $HA1 . ':' . $nonce . ':' . $HA2;
 				}
 	
-				$hashedDigest = md5($unhashedDigest);
+				$hashedDigest = $this->encryptOld($unhashedDigest);
 	
 				$this->outgoing_headers['Authorization'] = 'Digest username="' . $username . '", realm="' . $digestRequest['realm'] . '", nonce="' . $nonce . '", uri="' . $this->digest_uri . '", cnonce="' . $cnonce . '", nc=' . sprintf("%08x", $digestRequest['nc']) . ', qop="' . $digestRequest['qop'] . '", response="' . $hashedDigest . '"';
 			}
@@ -3026,6 +3026,11 @@ class soap_transport_http extends nusoap_base_colosa {
 		}
 		return $cookie_str;
   }
+  
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 }
 
 ?><?php

gulliver/thirdparty/pear/nusoap.php

@@ -2314,13 +2314,13 @@ class soap_transport_http extends nusoap_base {
 				$A1 = $username. ':' . (isset($digestRequest['realm']) ? $digestRequest['realm'] : '') . ':' . $password;
 
 				// H(A1) = MD5(A1)
-				$HA1 = md5($A1);
+				$HA1 = $this->encryptOld($A1);
 
 				// A2 = Method ":" digest-uri-value
 				$A2 = 'POST:' . $this->digest_uri;
 
 				// H(A2)
-				$HA2 =  md5($A2);
+				$HA2 =  $this->encryptOld($A2);
 
 				// KD(secret, data) = H(concat(secret, ":", data))
 				// if qop == auth:
@@ -2342,7 +2342,7 @@ class soap_transport_http extends nusoap_base {
 					$unhashedDigest = $HA1 . ':' . $nonce . ':' . $HA2;
 				}
 
-				$hashedDigest = md5($unhashedDigest);
+				$hashedDigest = $this->encryptOld($unhashedDigest);
 
 				$this->outgoing_headers['Authorization'] = 'Digest username="' . $username . '", realm="' . $digestRequest['realm'] . '", nonce="' . $nonce . '", uri="' . $this->digest_uri . '", cnonce="' . $cnonce . '", nc=' . sprintf("%08x", $digestRequest['nc']) . ', qop="' . $digestRequest['qop'] . '", response="' . $hashedDigest . '"';
 			}
@@ -3029,6 +3029,11 @@ class soap_transport_http extends nusoap_base {
 		}
 		return $cookie_str;
   }
+  
+    public function encryptOld($string)
+    {
+        return md5($string);
+    }
 }
 
 ?><?php

gulliver/thirdparty/pear/nusoapmime.php

@@ -81,7 +81,7 @@ class soapclientmime extends soapclient {
 	*/
 	function addAttachment($data, $filename = '', $contenttype = 'application/octet-stream', $cid = false) {
 		if (! $cid) {
-			$cid = md5(uniqid(time()));
+			$cid = $this->encryptOld(uniqid(time()));
 		}
 
 		$info['data'] = $data;
@@ -254,6 +254,11 @@ class soapclientmime extends soapclient {
 		$this->debug('Not multipart/related');
 		return parent::parseResponse($headers, $data);
 	}
+	
+	public function encryptOld($string)
+    {
+        return md5($string);
+    }
 }
 
 /**
@@ -301,7 +306,7 @@ class nusoapservermime extends soap_server {
 	*/
 	function addAttachment($data, $filename = '', $contenttype = 'application/octet-stream', $cid = false) {
 		if (! $cid) {
-			$cid = md5(uniqid(time()));
+			$cid = $this->encryptOldNusoap(uniqid(time()));
 		}
 
 		$info['data'] = $data;
@@ -474,5 +479,10 @@ class nusoapservermime extends soap_server {
 		$this->debug('Not multipart/related');
 		return parent::parseRequest($headers, $data);
 	}
+	
+	public function encryptOldNusoap($string)
+    {
+        return md5($string);
+    }
 }
 ?>

gulliver/thirdparty/phing/Phing.php

@@ -856,7 +856,9 @@ class Phing {
                 if (self::getMsgOutputLevel() === PROJECT_MSG_DEBUG) {
                     print("Phing::import() prepending new include_path components: " . implode(PATH_SEPARATOR, $new_parts) . "\n");
                 }
-                ini_set('include_path', implode(PATH_SEPARATOR, array_merge($new_parts, $curr_parts)));
+                if (is_dir(implode(PATH_SEPARATOR, array_merge($new_parts, $curr_parts)))) {
+                    ini_set('include_path', implode(PATH_SEPARATOR, array_merge($new_parts, $curr_parts)));
+                }
             }
         }
 

gulliver/thirdparty/phing/lib/Capsule.php

@@ -121,7 +121,10 @@ class Capsule {
         // prepend template path to include path, 
         // so that include "path/relative/to/templates"; can be used within templates
         $__old_inc_path = ini_get('include_path');
-        ini_set('include_path', $this->templatePath . PATH_SEPARATOR . $__old_inc_path);
+
+        if(is_dir($this->templatePath . PATH_SEPARATOR . $__old_inc_path)) {
+            ini_set('include_path', $this->templatePath . PATH_SEPARATOR . $__old_inc_path);
+        }
                 
         @ini_set('track_errors', true);
         include $__template;