718 commits

Author	SHA1	Message	Date
mirek-vl	1a5fa93f2f	Remove X-XSS-Protection from Controller.php	2026-04-11 12:57:54 +02:00
El RIDO	604e61beaa	update DOMpurify library from 3.3.0 to 3.3.2	2026-03-07 09:00:06 +01:00
rugk	1cc811644f	docs: improve JSDoc	2026-02-23 16:00:31 +00:00
rugk	30f80d055b	wipfix: fix JS syntax errors	2026-02-23 15:54:56 +00:00
rugk	5dab2392b9	Merge branch 'master' into xss/jsImprove	2026-02-23 16:48:21 +01:00
Stephan Kristyn	5d22847ef1	ES6 Compat code broke everything. Reverting. E2E testing wth multiple files works	2026-02-12 13:48:49 +01:00
Stephan Kristyn	cfea0fb20e	Now leaving styling to customer if he wants the filename and filesize as a hyperlink or outside the hyperlink	2026-02-11 19:03:34 +01:00
Stephan Kristyn	9ab16674aa	Adding Bootstrap Classname to dynamically created child element	2026-02-10 18:22:17 +01:00
Stephan Kristyn	e2b4b8a7f8	Adding new DOM element, CSS and JS code	2026-02-10 14:36:03 +01:00
El RIDO	ec656a5456	credit Persian translation & enable use of Persian plurals	2026-02-06 19:15:02 +01:00
El RIDO	a1c8966a36	Merge branch 'master' into linter-semicolon-insertion	2026-01-28 07:33:58 +01:00
El RIDO	f6c01a6489	update SRI hash	2026-01-28 07:21:32 +01:00
El RIDO	a4eaa77b82	address semicolon insertion lint ... > Code that uses automatic semicolon insertion inconsistently is hard to read and maintain. See: https://github.com/PrivateBin/PrivateBin/security/quality/rules/js%2Fautomatic-semicolon-insertion	2026-01-25 09:41:52 +01:00
El RIDO	0ed48c455f	address unneeded defensive code lint ... IMHO this check is actually necessary, as we do call the function with an empty argument. So we need a guard there, but we could simplify it a bit, by making the argument an empty array by default. I still kept the check for undefined (line 3249, first check) in case the caller passes us an undefined variable. See: https://github.com/PrivateBin/PrivateBin/security/quality/rules/js%2Funneeded-defensive-code - Copilot suggested to simply remove the if-condition and its else block, which I think is wrong.	2026-01-25 09:26:14 +01:00
woutresseler	33c93f4d40	Update hash for privatebin.js	2026-01-20 13:18:57 +01:00
Ribas160	ed9b3d1aa0	fix: The content format is not reset on create a new or clone document	2025-12-14 09:08:48 +02:00
Ribas160	54d002d26f	fix: Attachment disappears after a "paste" in the message area	2025-12-09 15:43:59 +02:00
El RIDO	52c0846dad	Merge pull request #1734 from PrivateBin/php85 ... Enable PHP 8.5 testing and handle deprecations	2025-12-03 19:10:03 +01:00
El RIDO	4f28c357ae	Merge pull request #1715 from PrivateBin/i18n/soften-html-encoding ... fix: do not encode source JSON translation string resulting in wrong display of special characters like '	2025-12-03 19:07:17 +01:00
El RIDO	eaf8f9f92e	address PHP 8.5 deprecation	2025-12-02 07:07:04 +01:00
El RIDO	aa931c7a5c	enable Swedish translations	2025-12-02 06:40:07 +01:00
rugk	ce06857d2c	chore update SRI hash of main JS file	2025-11-27 21:05:59 +00:00
El RIDO	65a90360b6	apply Scrutinizer fix	2025-11-20 09:23:47 +01:00
El RIDO	348d36d6ee	prefer DirectoryIterator for readability, also test jbo translation, log deletion errors	2025-11-20 09:13:15 +01:00
El RIDO	3146d41609	apply StyleCI recommendation	2025-11-20 08:28:50 +01:00
El RIDO	b4db5f8e57	apply null coalescing operator, strict equality, avoid aliases, prefer empty	2025-11-20 08:19:14 +01:00
El RIDO	fc4a92e6a4	apply Scrutinizer fix	2025-11-19 19:40:05 +01:00
El RIDO	9c5ba6ffc3	apply StyleCI recommendation	2025-11-19 19:26:00 +01:00
El RIDO	69e5fc1b05	apply null coalescing operator	2025-11-19 19:24:17 +01:00
El RIDO	c8643f187e	apply null coalescing operator ... Co-authored-by: Mikhail Romanov <42250412+Ribas160@users.noreply.github.com>	2025-11-19 18:45:35 +01:00
El RIDO	0e2055d54a	remove unnecessary variable	2025-11-19 11:15:28 +01:00
El RIDO	3caf3214f1	apply StyleCI recommendation	2025-11-19 10:02:15 +01:00
El RIDO	528f2f7221	fix PHP 7.4 compatibility	2025-11-19 09:59:54 +01:00
El RIDO	baa79e12e8	apply StyleCI recommendation	2025-11-19 09:57:08 +01:00
El RIDO	3a23117ebf	Refactored translation of exception messages	2025-11-19 09:36:40 +01:00
El RIDO	3e6f1733f9	refactored exceptions in controller ... - added missing exception doc blocks - introduced exception type that translates message during construction - catch explicit exception types where possible	2025-11-19 09:36:39 +01:00
El RIDO	e26bcfa733	apply StyleCI recommendation	2025-11-14 10:21:57 +01:00
El RIDO	d78c33438d	refactor JSON response processing ... - avoid translating JSON error messages twice - separation of concerns, JSON response preparation should not mix handling errors and results, provide two functions instead of one - callers of JSON error method are responsible for translation of errors	2025-11-14 10:04:41 +01:00
rugk	2c4dd2594c	fix: do not encode source JSON translation string resulting in wrong display of special characters like ' ... Fixes #1712 Disclosure: Coded with help of Copiot. (description wrtten by me) So this does indeed loosen the encoding a bit. However, IMHO, it was neither better before though. You could always bypass the encoding for `args{0]` when you just include `<a` (or the other tag) somewhere or so. **One important notice:** This was (due to the exceptions before and afterwards) valid before and also now: Translators **could** (and can) if they have malicious intent, inject/do "XSS attacks". Thus, translations PRs (also from Crowdin) should be reviewed for wild HTML code inside translations. I suppose this is easy to fix, but anyway a valid risk. But IMHO, we should teat the JSON files being part of our source code as a "trusted source". In the end, such an attak is basicaly just ends up being injecting malicious code. I hope such contributors would be detected. References I explicitly checked again to not introduce an XSS here: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html and the PHP doc for he HTML encoding. I feel the safter way obviously would be encoding the _whole_ string _after_ translation (just like you should apply DOMPurify after everything), but as explained it was not done before and would break compatibility. Also, I looked through the sources and I see no risk described by doing it only for the "dangerous" "untrusted" inputs. Only here is a notice that `%s` shall not be used in some contexts, for example to define a tag: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#dangerous-contexts (obviously in such a case, attacks may be possible even with encoding; but again; this is nothing new) The basic "problem" of it all is: We want HTML to be translated/be usable in our translation. If we'd get rid of that, we would get for sure rid of all such XSS attack possibilities. But that woud be a bigger refactoring, so IMHO, this here is fine for a fix for the issue at hand. Ah another point: I think the `is_int` check is harmless, but it's also kinda useless. Maybe it is some kind of obscure performance optimisation. (Yeah ints have nothing to encode as they have nothing that could be used for XSS, but they could also just be passed through that function.)	2025-11-13 10:52:08 +00:00
El RIDO	19ca6d3dab	incrementing version	2025-11-12 08:00:50 +01:00
El RIDO	bddfb173da	Merge branch 'master' into advisory-fix-1	2025-11-12 07:47:43 +01:00
El RIDO	5b85d63942	Merge branch 'master' into advisory-fix-1	2025-11-12 07:18:43 +01:00
El RIDO	e427458cd0	Merge branch 'master' into advisory-fix-1	2025-11-11 22:00:09 +01:00
Ribas160	08b3244314	privatebin.js SRI and CHANGELOG.md updated	2025-11-11 20:13:10 +02:00
El RIDO	2e11b13464	remove dead code	2025-11-11 17:56:49 +01:00
El RIDO	c35fc4f790	use more straight forward in_array check ... kudos @Ribas160 for the suggestion	2025-11-11 17:53:50 +01:00
El RIDO	f456fb576e	ensure template cookie cannot be a path	2025-11-11 17:52:48 +01:00
Ribas160	9c71fbcc70	Use pure JavaScript to create a div element	2025-11-11 17:45:27 +02:00
El RIDO	a371f5cab5	remove dead code	2025-11-11 12:49:37 +01:00
El RIDO	94a854faca	do add the configured template to the available ones, if missing	2025-11-11 10:59:55 +01:00