From f73be8dba4594b680a26e947a42bf713eb2c0ba3 Mon Sep 17 00:00:00 2001 From: David Date: Fri, 2 Feb 2018 10:52:55 +0100 Subject: [PATCH 1/3] New landing XSS vulnerabilities fix --- themes/site/authentication.tpl | 8 +-- themes/site_mobile/authentication.tpl | 23 +++---- themes/site_mobile/css/style.css | 62 ++++++++++++++++--- themes/site_mobile/lang/fr.php | 2 +- .../modules/invite/authentication.tpl | 6 +- 5 files changed, 73 insertions(+), 28 deletions(-) diff --git a/themes/site/authentication.tpl b/themes/site/authentication.tpl index 4fbddeb5..9f962f61 100755 --- a/themes/site/authentication.tpl +++ b/themes/site/authentication.tpl @@ -332,17 +332,17 @@ $(function(){ldelim}

*}

- + *

- + *

- + *

@@ -393,7 +393,7 @@ $(function(){ldelim}

- + {l s='DNI / NIF / NIE'} *

diff --git a/themes/site_mobile/authentication.tpl b/themes/site_mobile/authentication.tpl index 5eda4640..9b818399 100755 --- a/themes/site_mobile/authentication.tpl +++ b/themes/site_mobile/authentication.tpl @@ -371,20 +371,20 @@ $(document).ready(function() {

*}

- - + {**} +

- - + {**} +

- - + {**} +

- - + {**} + {*{l s='(5 characters min.)'}*}

{*

@@ -429,7 +429,7 @@ $(document).ready(function() {

- + {l s='DNI / NIF / NIE'} *

@@ -451,7 +451,7 @@ $(document).ready(function() {

*} {/if} -
+
@@ -459,7 +459,8 @@ $(document).ready(function() { *{l s='Required field'}
- + {**} +
{$HOOK_CREATE_ACCOUNT_FORM_BOTTOM} diff --git a/themes/site_mobile/css/style.css b/themes/site_mobile/css/style.css index 6f40bdd2..9caf675b 100755 --- a/themes/site_mobile/css/style.css +++ b/themes/site_mobile/css/style.css @@ -2252,7 +2252,7 @@ body#module-advsendtoafriend-sendtoafriend-form p.submit{ overflow: auto; } body#module-advsendtoafriend-sendtoafriend-form input#submitAddtoafriend, -body#authentication input#submitAccount, +body#authentication button#submitAccount, body#identity .submit input[type=submit], body#module-invite-invite-program input#revive, body#module-invite-invite-program input[type=submit], @@ -2265,7 +2265,7 @@ body#module-invite-invite-program input[type=submit], border:0px none; position:relative; right:0px; - border-radius:0px !important; + border-radius:0px; background: #565485 } body#addresses .footer_links a{ @@ -3226,13 +3226,16 @@ body#module-invite-invite-program #idTab1 p.bold.message{ border-bottom:2px solid #e36ea2; padding:10px; } -body#authentication #columns .content #center_column #account-creation_form p.checkbox, body#password p.checkbox, body#identity p.checkbox, body#order p.checkbox, body#module-invite-invite-program #idTab1 p.checkbox{ display: table-row; } +body#authentication #columns .content #center_column #account-creation_form p.checkbox{ + display: block; + margin: 17px 0; +} body#authentication #columns .content #center_column #account-creation_form p.checkbox span, body#password p.checkbox span, body#identity p.checkbox span, @@ -3386,17 +3389,19 @@ body#authentication #columns .content #center_column #account-creation_form .acc body#authentication #columns .content #center_column #account-creation_form{ font-size:14px; } -body#authentication #columns .content #center_column #account-creation_form p.checkbox .input, -body#authentication #columns .content #center_column #account-creation_form p.checkbox .condition{ +body#authentication #columns .content #center_column #account-creation_form p.checkbox .input{ padding-top:10px; +} +body#authentication #columns .content #center_column #account-creation_form p.checkbox .condition{ + + } body#authentication span.required_info{ - display: block; - color:#e36ea2; - padding-bottom:20px; + display: none; } body#authentication form#account-creation_form .cart_navigation div.gradient{ - float:right; + text-align: center; + width: 60%; } body#discount table.discount tr{ @@ -5366,3 +5371,42 @@ body#order-detail table#order-product tbody tr.item tr.title span.quantity{ right: 0; z-index: 8; } + +#authentication #account-creation_container{ + width: 80%; + margin: 0 auto; +} + +#authentication #account-creation_container input[type=email], +#authentication #account-creation_container input[type=text], +#authentication #account-creation_container input[type=password]{ + background: #f0f0f0; + border: none; + font-family: Century Gothic,CenturyGothic,AppleGothic,sans-serif; +} + +#authentication #account-creation_container input::placeholder +{ + color: #a6a6a6; +} + +#authentication #account-creation_container p.text, +#authentication #account-creation_container p.password{ + border-bottom: 1px solid #565385; + margin-bottom: 12px; + padding-bottom: 1px; +} +#authentication #account-creation_container p.checkbox .condition label{ + color: #565385; + font-family: Century Gothic,CenturyGothic,AppleGothic,sans-serif; + text-align: justify; + text-justify: inter-word; + font-size: smaller; +} + +body#authentication .gradient button#submitAccount{ + background:#e36ea2; + -webkit-border-radius: 5px; + -moz-border-radius: 5px; + border-radius: 5px; +} diff --git a/themes/site_mobile/lang/fr.php b/themes/site_mobile/lang/fr.php index 11aef0ac..9f1d070c 100755 --- a/themes/site_mobile/lang/fr.php +++ b/themes/site_mobile/lang/fr.php @@ -97,7 +97,7 @@ $_LANG['authentication_a0bfb8e59e6c13fc8d990781f77694fe'] = 'Continuer'; $_LANG['authentication_6335a00a08fde0fbb8f6d6630cdadd92'] = 'Inscrivez-vous, c\'est gratuit !'; $_LANG['authentication_1e884e3078d9978e216a027ecd57fb34'] = 'E-mail'; $_LANG['authentication_bf2957630c4209f61a388a08c2154915'] = '(5 caractères min.)'; -$_LANG['authentication_0ba7583639a274c434bbe6ef797115a4'] = 'S\'inscrire'; +$_LANG['authentication_0ba7583639a274c434bbe6ef797115a4'] = 'Je crée mon compte'; $_LANG['authentication_59e7ac55563a4f1fff63c9179e6c8937'] = 'Veuillez accepter nos conditions d\'utilisation pour continuer'; $_LANG['best-sales_3cb29f0ccc5fd220a97df89dafe46290'] = 'Meilleures ventes'; $_LANG['best-sales_32af07c9205de16855c50c3d20a51698'] = 'Pas de meilleure vente pour le moment.'; diff --git a/themes/site_mobile/modules/invite/authentication.tpl b/themes/site_mobile/modules/invite/authentication.tpl index f07eb29e..d3b065b4 100755 --- a/themes/site_mobile/modules/invite/authentication.tpl +++ b/themes/site_mobile/modules/invite/authentication.tpl @@ -1,7 +1,7 @@ {if isset($tag_auth)}{$tag_auth}{/if} \ No newline at end of file From 674d095cf09448a5528614fbd6d9ae31dbdb5a0e Mon Sep 17 00:00:00 2001 From: David Date: Fri, 16 Feb 2018 15:52:35 +0100 Subject: [PATCH 2/3] Added file field in admin form Finished page integration --- modules/landingpages/AdminLandingPages.php | 10 +++--- modules/landingpages/landingpages.php | 32 +++++++++++++------ themes/site_mobile/authentication.tpl | 3 +- themes/site_mobile/css/style.css | 17 ++++++++++ themes/site_mobile/lang/fr.php | 1 + .../modules/landingpages/authentication.tpl | 22 +++++++++++++ 6 files changed, 70 insertions(+), 15 deletions(-) create mode 100644 themes/site_mobile/modules/landingpages/authentication.tpl diff --git a/modules/landingpages/AdminLandingPages.php b/modules/landingpages/AdminLandingPages.php index 51db667a..29105157 100755 --- a/modules/landingpages/AdminLandingPages.php +++ b/modules/landingpages/AdminLandingPages.php @@ -343,7 +343,8 @@ class AdminLandingPages extends AdminTab {

'.$this->l('Size:').' '.$this->l('img1 size').'

'; if($this->curlp && file_exists(_PS_ROOT_DIR_.'/modules/landingpages/img/'.$this->curlp['id_landing_page'].'_1_'.$language['id_lang'].'.jpg')) { - echo '

'.$this->l('Preview').'

'; + echo '
+

'.$this->l('Preview').'

'; } echo '
'; @@ -352,14 +353,15 @@ class AdminLandingPages extends AdminTab { echo '
'; - echo ' - {/if} diff --git a/themes/site_mobile/css/style.css b/themes/site_mobile/css/style.css index 9caf675b..6490e147 100755 --- a/themes/site_mobile/css/style.css +++ b/themes/site_mobile/css/style.css @@ -5404,9 +5404,26 @@ body#order-detail table#order-product tbody tr.item tr.title span.quantity{ font-size: smaller; } +#authentication #account-creation_container div.already_member { + text-align: center; +} + +#authentication #account-creation_container div.already_member a, +#authentication #account-creation_container div.already_member a:hover{ + color: #565385; + font-family: Century Gothic,CenturyGothic,AppleGothic,sans-serif; + margin: 20px 0; + display: block; + text-decoration: underline; + font-size: 15px; + +} + body#authentication .gradient button#submitAccount{ background:#e36ea2; -webkit-border-radius: 5px; -moz-border-radius: 5px; border-radius: 5px; + text-transform: uppercase; + font-weight: bold; } diff --git a/themes/site_mobile/lang/fr.php b/themes/site_mobile/lang/fr.php index 9f1d070c..13710ac2 100755 --- a/themes/site_mobile/lang/fr.php +++ b/themes/site_mobile/lang/fr.php @@ -99,6 +99,7 @@ $_LANG['authentication_1e884e3078d9978e216a027ecd57fb34'] = 'E-mail'; $_LANG['authentication_bf2957630c4209f61a388a08c2154915'] = '(5 caractères min.)'; $_LANG['authentication_0ba7583639a274c434bbe6ef797115a4'] = 'Je crée mon compte'; $_LANG['authentication_59e7ac55563a4f1fff63c9179e6c8937'] = 'Veuillez accepter nos conditions d\'utilisation pour continuer'; +$_LANG['authentication_925cc1fa40ed38377bcb2b77b5315d9c'] = 'Je suis déjà membre'; $_LANG['best-sales_3cb29f0ccc5fd220a97df89dafe46290'] = 'Meilleures ventes'; $_LANG['best-sales_32af07c9205de16855c50c3d20a51698'] = 'Pas de meilleure vente pour le moment.'; $_LANG['breadcrumb_c75dacb862a2bb03903ade08898c9146'] = 'Vous êtes ici :'; diff --git a/themes/site_mobile/modules/landingpages/authentication.tpl b/themes/site_mobile/modules/landingpages/authentication.tpl new file mode 100644 index 00000000..a59aac00 --- /dev/null +++ b/themes/site_mobile/modules/landingpages/authentication.tpl @@ -0,0 +1,22 @@ + + From b4894392cd78e437013069b8779db65233e7da9f Mon Sep 17 00:00:00 2001 From: David Date: Mon, 19 Feb 2018 10:57:58 +0100 Subject: [PATCH 3/3] Remaining png extensions in the code have been removed --- modules/landingpages/AdminLandingPages.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/landingpages/AdminLandingPages.php b/modules/landingpages/AdminLandingPages.php index 29105157..0c84f4fa 100755 --- a/modules/landingpages/AdminLandingPages.php +++ b/modules/landingpages/AdminLandingPages.php @@ -41,7 +41,7 @@ class AdminLandingPages extends AdminTab { } if(isset($_FILES['img2_'.$language['id_lang']]) && $_FILES['img2_'.$language['id_lang']]['name'] != '') { - if(!copy($_FILES['img2_'.$language['id_lang']]['tmp_name'], _PS_ROOT_DIR_.'/modules/landingpages/img/'.$id_landing_page.'_2_'.$language['id_lang'].'.png')) { + if(!copy($_FILES['img2_'.$language['id_lang']]['tmp_name'], _PS_ROOT_DIR_.'/modules/landingpages/img/'.$id_landing_page.'_2_'.$language['id_lang'].'.jpg')) { $this->_errors[] = $this->l('An error occured during the image upload.'); } } @@ -93,7 +93,7 @@ class AdminLandingPages extends AdminTab { } if(isset($_FILES['img2_'.$language['id_lang']]) && $_FILES['img2_'.$language['id_lang']]['name'] != '') { - if(!copy($_FILES['img2_'.$language['id_lang']]['tmp_name'], _PS_ROOT_DIR_.'/modules/landingpages/img/'.$id_landing_page.'_2_'.$language['id_lang'].'.png')) { + if(!copy($_FILES['img2_'.$language['id_lang']]['tmp_name'], _PS_ROOT_DIR_.'/modules/landingpages/img/'.$id_landing_page.'_2_'.$language['id_lang'].'.jpg')) { $this->_errors[] = $this->l('An error occured during the image upload.'); } } @@ -359,9 +359,9 @@ class AdminLandingPages extends AdminTab { echo '

'.$this->l('Size:').' '.$this->l('img2 size').'

'; - if($this->curlp && file_exists(_PS_ROOT_DIR_.'/modules/landingpages/img/'.$this->curlp['id_landing_page'].'_2_'.$language['id_lang'].'.png')) { + if($this->curlp && file_exists(_PS_ROOT_DIR_.'/modules/landingpages/img/'.$this->curlp['id_landing_page'].'_2_'.$language['id_lang'].'.jpg')) { echo '
-

'.$this->l('Preview').'

'; +

'.$this->l('Preview').'

'; } echo '
';