Skip to content

Commit

Permalink
9.0
Browse files Browse the repository at this point in the history
  • Loading branch information
gruberroland committed Dec 4, 2024
1 parent 385dcf4 commit f06e243
Show file tree
Hide file tree
Showing 11 changed files with 993 additions and 777 deletions.
18 changes: 18 additions & 0 deletions lam/lib/3rdParty/tcpdf/CHANGELOG.TXT
Original file line number Diff line number Diff line change
@@ -1,3 +1,21 @@
6.7.7 (2024-10-26)
- Update regular expression to avoid ReDoS (CVE-2024-22641)
- [PHP 8.4] Fix: Curl CURLOPT_BINARYTRANSFER deprecated #675
- SVG detection fix for inline data images #646
- Fix count svg #647
- Since the version 6.7.4, the "0" is considered like empty string and not displayed
- Fixed handling of transparency in PDF/A mode in addExtGState method
- Encrypt /DA string when document is encrypted
- Improve quality of generated seed, avoid potential security pitfall
- Try to use random_bytes() first if it's available
- Do not include the server parameters in the generated seed, as they might contain sensitive data
- Fix bug on _getannotsrefs when there are empty signature appearances but not other annot on a page
- Fix SVG coordinate parser that caused drawing artifacts
- Remove usage of xml_set_object() function

6.7.6 (2024-10-06)
- Forbid access to parent folder in HTML images.

6.7.5 (2024-04-20)
- Update GitHub actions
- fix: CSV-2024-22640 (#712)
Expand Down
2 changes: 1 addition & 1 deletion lam/lib/3rdParty/tcpdf/VERSION
Original file line number Diff line number Diff line change
@@ -1 +1 @@
6.7.5
6.7.7
2 changes: 1 addition & 1 deletion lam/lib/3rdParty/tcpdf/composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
"barcodes"
],
"homepage": "http://www.tcpdf.org/",
"version": "6.7.5",
"version": "6.7.7",
"license": "LGPL-3.0-or-later",
"authors": [
{
Expand Down
10 changes: 6 additions & 4 deletions lam/lib/3rdParty/tcpdf/include/tcpdf_static.php
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ class TCPDF_STATIC {
* Current TCPDF version.
* @private static
*/
private static $tcpdf_version = '6.7.5';
private static $tcpdf_version = '6.7.7';

/**
* String alias for total number of pages.
Expand Down Expand Up @@ -379,15 +379,18 @@ public static function getRandomSeed($seed='') {
if (function_exists('posix_getpid')) {
$rnd .= posix_getpid();
}
if (function_exists('openssl_random_pseudo_bytes') AND (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN')) {

if (function_exists('random_bytes')) {
$rnd .= random_bytes(512);
} elseif (function_exists('openssl_random_pseudo_bytes') AND (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN')) {
// this is not used on windows systems because it is very slow for a know bug
$rnd .= openssl_random_pseudo_bytes(512);
} else {
for ($i = 0; $i < 23; ++$i) {
$rnd .= uniqid('', true);
}
}
return $rnd.$seed.__FILE__.serialize($_SERVER).microtime(true);
return $rnd.$seed.__FILE__.microtime(true);
}

/**
Expand Down Expand Up @@ -1958,7 +1961,6 @@ public static function fileGetContents($file) {
// try to get remote file data using cURL
$crs = curl_init();
curl_setopt($crs, CURLOPT_URL, $path);
curl_setopt($crs, CURLOPT_BINARYTRANSFER, true);
curl_setopt($crs, CURLOPT_FAILONERROR, true);
curl_setopt($crs, CURLOPT_RETURNTRANSFER, true);
if ((ini_get('open_basedir') == '') && (!ini_get('safe_mode'))) {
Expand Down
88 changes: 45 additions & 43 deletions lam/lib/3rdParty/tcpdf/tcpdf.php
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
<?php
//============================================================+
// File name : tcpdf.php
// Version : 6.7.5
// Version : 6.7.7
// Begin : 2002-08-03
// Last Update : 2024-03-18
// Last Update : 2024-10-26
// Author : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - [email protected]
// License : GNU-LGPL v3 (http://www.gnu.org/copyleft/lesser.html)
// -------------------------------------------------------------------
Expand Down Expand Up @@ -128,7 +128,7 @@
* TCPDF project (http://www.tcpdf.org) has been originally derived in 2002 from the Public Domain FPDF class by Olivier Plathey (http://www.fpdf.org), but now is almost entirely rewritten.<br>
* @package com.tecnick.tcpdf
* @brief PHP class for generating PDF documents without requiring external extensions.
* @version 6.7.5
* @version 6.7.7
* @author Nicola Asuni - [email protected]
* @IgnoreAnnotation("protected")
* @IgnoreAnnotation("public")
Expand Down Expand Up @@ -8164,7 +8164,7 @@ protected function _putpages() {
* @since 5.0.010 (2010-05-17)
*/
protected function _getannotsrefs($n) {
if (!(isset($this->PageAnnots[$n]) OR ($this->sign AND isset($this->signature_data['cert_type'])))) {
if (!(isset($this->PageAnnots[$n]) OR count($this->empty_signature_appearance)>0 OR ($this->sign AND isset($this->signature_data['cert_type'])))) {
return '';
}
$out = ' /Annots [';
Expand Down Expand Up @@ -8532,7 +8532,7 @@ protected function _putannotsobjs() {
}
case 'freetext': {
if (isset($pl['opt']['da']) AND !empty($pl['opt']['da'])) {
$annots .= ' /DA ('.$pl['opt']['da'].')';
$annots .= ' /DA '.$this->_datastring($pl['opt']['da']);
}
if (isset($pl['opt']['q']) AND ($pl['opt']['q'] >= 0) AND ($pl['opt']['q'] <= 2)) {
$annots .= ' /Q '.intval($pl['opt']['q']);
Expand Down Expand Up @@ -8789,7 +8789,7 @@ protected function _putannotsobjs() {
$annots .= ' /AA << '.$pl['opt']['aa'].' >>';
}
if (isset($pl['opt']['da']) AND !empty($pl['opt']['da'])) {
$annots .= ' /DA ('.$pl['opt']['da'].')';
$annots .= ' /DA '.$this->_datastring($pl['opt']['da']);
}
if (isset($pl['opt']['q']) AND ($pl['opt']['q'] >= 0) AND ($pl['opt']['q'] <= 2)) {
$annots .= ' /Q '.intval($pl['opt']['q']);
Expand Down Expand Up @@ -9939,7 +9939,7 @@ protected function _putcatalog() {
$out .= ' >> >>';
}
$font = $this->getFontBuffer((($this->pdfa_mode) ? 'pdfa' : '') .'helvetica');
$out .= ' /DA (/F'.$font['i'].' 0 Tf 0 g)';
$out .= ' /DA ' . $this->_datastring('/F'.$font['i'].' 0 Tf 0 g');
$out .= ' /Q '.(($this->rtl)?'2':'0');
//$out .= ' /XFA ';
$out .= ' >>';
Expand Down Expand Up @@ -11046,7 +11046,7 @@ public function setProtection($permissions=array('print', 'modify', 'copy', 'ann
$this->encryptdata['V'] = 4;
$this->encryptdata['Length'] = 128;
$this->encryptdata['CF']['CFM'] = 'AESV2';
$this->encryptdata['CF']['Length'] = 128;
$this->encryptdata['CF']['Length'] = 16;
if ($this->encryptdata['pubkey']) {
$this->encryptdata['SubFilter'] = 'adbe.pkcs7.s5';
$this->encryptdata['Recipients'] = array();
Expand All @@ -11057,7 +11057,7 @@ public function setProtection($permissions=array('print', 'modify', 'copy', 'ann
$this->encryptdata['V'] = 5;
$this->encryptdata['Length'] = 256;
$this->encryptdata['CF']['CFM'] = 'AESV3';
$this->encryptdata['CF']['Length'] = 256;
$this->encryptdata['CF']['Length'] = 32;
if ($this->encryptdata['pubkey']) {
$this->encryptdata['SubFilter'] = 'adbe.pkcs7.s5';
$this->encryptdata['Recipients'] = array();
Expand Down Expand Up @@ -13936,8 +13936,8 @@ public function setVisibility($v) {
* @since 3.0.000 (2008-03-27)
*/
protected function addExtGState($parms) {
if ($this->pdfa_mode || $this->pdfa_version >= 2) {
// transparencies are not allowed in PDF/A mode
if (($this->pdfa_mode && $this->pdfa_version < 2) || ($this->state != 2)) {
// transparency is not allowed in PDF/A-1 mode
return;
}
// check if this ExtGState already exist
Expand Down Expand Up @@ -16440,7 +16440,7 @@ protected function getHtmlDomArray($html) {
)
);

if(empty($html)) {
if($html === '' || $html === null) {
return $dom;
}
// array of CSS styles ( selector => properties).
Expand Down Expand Up @@ -19010,29 +19010,29 @@ protected function openHTMLTagHandler($dom, $key, $cell) {
$this->setLineWidth($hrHeight);

$lineStyle = array();
if (isset($tag['fgcolor'])) {
$lineStyle['color'] = $tag['fgcolor'];
}
if (isset($tag['fgcolor'])) {
$lineStyle['color'] = $tag['fgcolor'];
}

if (isset($tag['fgcolor'])) {
$lineStyle['color'] = $tag['fgcolor'];
}
if (isset($tag['fgcolor'])) {
$lineStyle['color'] = $tag['fgcolor'];
}

if (isset($tag['style']['cap'])) {
$lineStyle['cap'] = $tag['style']['cap'];
}
if (isset($tag['style']['cap'])) {
$lineStyle['cap'] = $tag['style']['cap'];
}

if (isset($tag['style']['join'])) {
$lineStyle['join'] = $tag['style']['join'];
}
if (isset($tag['style']['join'])) {
$lineStyle['join'] = $tag['style']['join'];
}

if (isset($tag['style']['dash'])) {
$lineStyle['dash'] = $tag['style']['dash'];
}
if (isset($tag['style']['dash'])) {
$lineStyle['dash'] = $tag['style']['dash'];
}

if (isset($tag['style']['phase'])) {
$lineStyle['phase'] = $tag['style']['phase'];
}
if (isset($tag['style']['phase'])) {
$lineStyle['phase'] = $tag['style']['phase'];
}

$lineStyle = array_filter($lineStyle);

Expand All @@ -19055,15 +19055,18 @@ protected function openHTMLTagHandler($dom, $key, $cell) {
if ($imgsrc[0] === '@') {
// data stream
$imgsrc = '@'.base64_decode(substr($imgsrc, 1));
$type = '';
$type = preg_match('/<svg([^\>]*)>/si', $imgsrc) ? 'svg' : '';
} else if (preg_match('@^data:image/([^;]*);base64,(.*)@', $imgsrc, $reg)) {
$imgsrc = '@'.base64_decode($reg[2]);
$type = $reg[1];
} elseif (strpos($imgsrc, '../') !== false) {
// accessing parent folders is not allowed
break;
} elseif ( $this->allowLocalFiles && substr($imgsrc, 0, 7) === 'file://') {
// get image type from a local file path
$imgsrc = substr($imgsrc, 7);
$type = TCPDF_IMAGES::getImageFileType($imgsrc);
} else {
// get image type from a local file path
$imgsrc = substr($imgsrc, 7);
$type = TCPDF_IMAGES::getImageFileType($imgsrc);
} else {
if (($imgsrc[0] === '/') AND !empty($_SERVER['DOCUMENT_ROOT']) AND ($_SERVER['DOCUMENT_ROOT'] != '/')) {
// fix image path
$findroot = strpos($imgsrc, $_SERVER['DOCUMENT_ROOT']);
Expand Down Expand Up @@ -23170,14 +23173,12 @@ public function ImageSVG($file, $x=null, $y=null, $w=0, $h=0, $link='', $align='
$this->_out(sprintf('%F %F %F %F %F %F cm', $svgscale_x, 0, 0, $svgscale_y, ($e + $svgoffset_x), ($f + $svgoffset_y)));
// creates a new XML parser to be used by the other XML functions
$parser = xml_parser_create('UTF-8');
// the following function allows to use parser inside object
xml_set_object($parser, $this);
// disable case-folding for this XML parser
xml_parser_set_option($parser, XML_OPTION_CASE_FOLDING, 0);
// sets the element handler functions for the XML parser
xml_set_element_handler($parser, 'startSVGElementHandler', 'endSVGElementHandler');
xml_set_element_handler($parser, [$this, 'startSVGElementHandler'], [$this, 'endSVGElementHandler']);
// sets the character data handler function for the XML parser
xml_set_character_data_handler($parser, 'segSVGContentHandler');
xml_set_character_data_handler($parser, [$this, 'segSVGContentHandler']);
// start parsing an XML document
if (!xml_parse($parser, $svgdata)) {
$error_message = sprintf('SVG Error: %s at line %d', xml_error_string(xml_get_error_code($parser)), xml_get_current_line_number($parser));
Expand Down Expand Up @@ -23327,7 +23328,7 @@ protected function setSVGStyles($svgstyle, $prevsvgstyle, $x=0, $y=0, $w=1, $h=1
$text_color = TCPDF_COLORS::convertHTMLColorToDec($svgstyle['text-color'], $this->spot_colors);
$this->setTextColorArray($text_color);
// clip
if (preg_match('/rect\(([a-z0-9\-\.]*)[\s]*([a-z0-9\-\.]*)[\s]*([a-z0-9\-\.]*)[\s]*([a-z0-9\-\.]*)\)/si', $svgstyle['clip'], $regs)) {
if (preg_match('/rect\(([a-z0-9\-\.]*+)[\s]*+([a-z0-9\-\.]*+)[\s]*+([a-z0-9\-\.]*+)[\s]*+([a-z0-9\-\.]*+)\)/si', $svgstyle['clip'], $regs)) {
$top = (isset($regs[1])?$this->getHTMLUnitToUnits($regs[1], 0, $this->svgunit, false):0);
$right = (isset($regs[2])?$this->getHTMLUnitToUnits($regs[2], 0, $this->svgunit, false):0);
$bottom = (isset($regs[3])?$this->getHTMLUnitToUnits($regs[3], 0, $this->svgunit, false):0);
Expand Down Expand Up @@ -23444,8 +23445,8 @@ protected function setSVGStyles($svgstyle, $prevsvgstyle, $x=0, $y=0, $w=1, $h=1
$cy -= $h;
}
$this->_out(sprintf('%F 0 0 %F %F %F cm', ($w * $this->k), ($h * $this->k), ($x * $this->k), ($cy * $this->k)));
if (count($gradient['stops']) > 1) {
$this->Gradient($gradient['type'], $gradient['coords'], $gradient['stops'], array(), false);
if ((is_array($gradient['stops']) || $gradient['stops'] instanceof Countable) && count($gradient['stops']) > 1) {
$this->Gradient($gradient['type'], $gradient['coords'], $gradient['stops']);
}
} elseif ($svgstyle['fill'] != 'none') {
$fill_color = TCPDF_COLORS::convertHTMLColorToDec($svgstyle['fill'], $this->spot_colors);
Expand Down Expand Up @@ -23639,7 +23640,8 @@ protected function SVGPath($d, $style='') {
$params = array();
if (isset($val[2])) {
// get curve parameters
$rawparams = preg_split('/([\,\s]+)/si', trim($val[2]));
preg_match_all('/-?\d*\.?\d+/', trim($val[2]), $matches);
$rawparams = $matches[0];
$params = array();
foreach ($rawparams as $ck => $cp) {
$params[$ck] = $this->getHTMLUnitToUnits($cp, 0, $this->svgunit, false);
Expand Down
Loading

0 comments on commit f06e243

Please sign in to comment.