Merge remote-tracking branch 'remotes/origin/develop' into configImportExport

# Conflicts:
#	lam/lib/selfService.inc
This commit is contained in:
Roland Gruber 2020-06-14 21:36:48 +02:00
commit 01844a0d05
58 changed files with 548 additions and 209 deletions

3
.github/FUNDING.yml vendored Normal file
View File

@ -0,0 +1,3 @@
github: [LDAPAccountManager]

9
SECURITY.md Normal file
View File

@ -0,0 +1,9 @@
# Security Policy
## Supported Versions
Security updates are always created based on the latest release.
## Reporting a Vulnerability
Please report all security issues to post@rolandgruber.de. Reports will be answered within 48h.

View File

@ -70,7 +70,8 @@ export VERSION=`./getVersion`
# remove files which are not in the final release
rm -r lam/po
rm -r lam/tests
rm lam/lib/3rdParty/tcpdf/fonts/*.ttf
rm -f lam/lib/3rdParty/tcpdf/fonts/*.ttf
rm -r lam/templates/lib/extra/ckeditor/plugins/*/dev
find . -name .svnignore -exec rm {} \;
find . -name .gitignore -exec rm {} \;
mv lam ldap-account-manager-$VERSION

View File

@ -1,3 +1,9 @@
ldap-account-manager (7.3.DEV-1) unstable; urgency=medium
* new upstream release
-- Roland Gruber <post@rolandgruber.de> Tue, 02 Jun 2020 09:12:46 +0200
ldap-account-manager (7.2-1) unstable; urgency=medium
* new upstream release

View File

@ -966,9 +966,8 @@ lib/3rdParty/composer/ramsey B 2018 Be
lib/3rdParty/composer/spomky-labs B 2018 Spomky-Labs
lib/3rdParty/composer/symfony B 2019 Fabien Potencier
lib/3rdParty/composer/web-auth B 2018 Spomky-Labs
lib/3rdParty/tcpdf D 2018 Nicola Asuni - Tecnick.com LTD
lib/3rdParty/tcpdf/fonts/DejaVu*.ttf A Public Domain, Bitstream, Inc., Tavmjong Bah
lib/3rdParty/tcpdf/fonts/DejaVu*.z A Public Domain, Bitstream, Inc., Tavmjong Bah
lib/3rdParty/tcpdf D 2020 Nicola Asuni - Tecnick.com LTD
lib/3rdParty/tcpdf/fonts/dejavu*.z A Public Domain, Bitstream, Inc., Tavmjong Bah
lib/3rdParty/phpseclib B 2019 TerraFrost and other contributors
lib/3rdParty/Monolog B 2011 Jordi Boggiano
lib/3rdParty/Psr B 2012 PHP Framework Interoperability Group

View File

@ -8,6 +8,11 @@ LAM_SKIP_PRECONFIGURE=false
LDAP_DOMAIN=my-domain.com
# LDAP base DN to overwrite value generated by LDAP_DOMAIN
LDAP_BASE_DN=dc=my-domain,dc=com
# LDAP users DN to overwrite value provided by LDAP_BASE_DN
LDAP_USERS_DN=ou=people,dc=my-domain,dc=com
# LDAP groups DN to overwrite value provided by LDAP_BASE_DN
LDAP_GROUPS_DN=ou=groups,dc=my-domain,dc=com
# LDAP server URL
LDAP_SERVER=ldap://ldap:389
# LDAP admin user (set as login user for LAM)
@ -17,6 +22,9 @@ LAM_LANG=en_US
# LAM configuration master password and password for server profile "lam"
LAM_PASSWORD=lam
# deactivate TLS certificate checks, activate for development only
LAM_DISABLE_TLS_CHECK=false
#
# docker-compose only, LDAP server setup
#

View File

@ -3,9 +3,7 @@ services:
ldap-account-manager:
build:
context: .
args:
- LAM_RELEASE=7.2
image: ldapaccountmanager/lam:latest
image: ldapaccountmanager/lam:7.2
restart: unless-stopped
ports:
- "8080:80"

View File

@ -23,6 +23,11 @@
set -eu # unset variables are errors & non-zero return values exit the whole script
[ "$DEBUG" ] && set -x
if [ "$LAM_DISABLE_TLS_CHECK" == "true" ]; then
ln -s /etc/ldap/ldap.conf /etc/ldap.conf
echo "TLS_REQCERT never" >> /etc/ldap/ldap.conf
fi
LAM_SKIP_PRECONFIGURE="${LAM_SKIP_PRECONFIGURE:-false}"
if [ "$LAM_SKIP_PRECONFIGURE" != "true" ]; then
@ -32,8 +37,10 @@ if [ "$LAM_SKIP_PRECONFIGURE" != "true" ]; then
LDAP_SERVER="${LDAP_SERVER:-ldap://ldap:389}"
LDAP_DOMAIN="${LDAP_DOMAIN:-my-domain.com}"
LDAP_BASE_DN="${LDAP_BASE_DN:-dc=${LDAP_DOMAIN//\./,dc=}}"
LDAP_USERS_DN="${LDAP_USERS_DN:-${LDAP_BASE_DN}}"
LDAP_GROUPS_DN="${LDAP_GROUPS_DN:-${LDAP_BASE_DN}}"
LDAP_ADMIN_USER="${LDAP_USER:-cn=admin,${LDAP_BASE_DN}}"
sed -i -f- /etc/ldap-account-manager/config.cfg <<- EOF
s|^password:.*|password: ${LAM_PASSWORD_SSHA}|;
EOF
@ -45,8 +52,8 @@ EOF
s|^Passwd:.*|Passwd: ${LAM_PASSWORD_SSHA}|;
s|^treesuffix:.*|treesuffix: ${LDAP_BASE_DN}|;
s|^defaultLanguage:.*|defaultLanguage: ${LAM_LANG}.utf8|;
s|^.*suffix_user:.*|types: suffix_user: ${LDAP_BASE_DN}|;
s|^.*suffix_group:.*|types: suffix_group: ${LDAP_BASE_DN}|;
s|^.*suffix_user:.*|types: suffix_user: ${LDAP_USERS_DN}|;
s|^.*suffix_group:.*|types: suffix_group: ${LDAP_GROUPS_DN}|;
EOF
fi

View File

@ -1,3 +1,6 @@
September 2020
- PHP 7.4 compatibility
01.05.2020 7.2
- Unix: allow to create group with same name during user creation
- LAM Pro:
@ -11,7 +14,7 @@
17.03.2020 7.1
- PHP 7 required
- Webauthn/FIDO2 support for 2-factor-authentication (requires PHP 7.2)
- WebAuthn/FIDO2 support for 2-factor-authentication (requires PHP 7.2)
- IMAP: changed library to support latest TLS versions
- Personal: support display name (hidden by default in server profile)
- Windows users: support allowed workstations, more profile options

10
lam/composer.lock generated
View File

@ -773,16 +773,16 @@
},
{
"name": "phpmailer/phpmailer",
"version": "v6.1.5",
"version": "v6.1.6",
"source": {
"type": "git",
"url": "https://github.com/PHPMailer/PHPMailer.git",
"reference": "a8bf068f64a580302026e484ee29511f661b2ad3"
"reference": "c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/a8bf068f64a580302026e484ee29511f661b2ad3",
"reference": "a8bf068f64a580302026e484ee29511f661b2ad3",
"url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3",
"reference": "c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3",
"shasum": ""
},
"require": {
@ -831,7 +831,7 @@
}
],
"description": "PHPMailer is a full-featured email creation and transfer class for PHP",
"time": "2020-03-14T14:23:48+00:00"
"time": "2020-05-27T12:24:03+00:00"
},
{
"name": "psr/http-client",

View File

@ -965,9 +965,8 @@ lib/3rdParty/composer/ramsey B 2018 Be
lib/3rdParty/composer/spomky-labs B 2018 Spomky-Labs
lib/3rdParty/composer/symfony B 2019 Fabien Potencier
lib/3rdParty/composer/web-auth B 2018 Spomky-Labs
lib/3rdParty/tcpdf D 2018 Nicola Asuni - Tecnick.com LTD
lib/3rdParty/tcpdf/fonts/DejaVu*.ttf A Public Domain, Bitstream, Inc., Tavmjong Bah
lib/3rdParty/tcpdf/fonts/DejaVu*.z A Public Domain, Bitstream, Inc., Tavmjong Bah
lib/3rdParty/tcpdf D 2020 Nicola Asuni - Tecnick.com LTD
lib/3rdParty/tcpdf/fonts/dejavu*.z A Public Domain, Bitstream, Inc., Tavmjong Bah
lib/3rdParty/phpseclib B 2019 TerraFrost and other contributors
lib/3rdParty/Monolog B 2011 Jordi Boggiano
lib/3rdParty/Psr B 2012 PHP Framework Interoperability Group

View File

@ -526,16 +526,16 @@ class WebauthnProvider extends BaseProvider {
*/
public function addCustomInput(&$row, $userDn) {
if (version_compare(phpversion(), '7.2.0') < 0) {
$row->add(new htmlStatusMessage('ERROR', 'Webauthn requires PHP 7.2.'), 12);
$row->add(new htmlStatusMessage('ERROR', 'WebAuthn requires PHP 7.2.'), 12);
return;
}
if (!extension_loaded('PDO')) {
$row->add(new htmlStatusMessage('ERROR', 'Webauthn requires the PDO extension for PHP.'), 12);
$row->add(new htmlStatusMessage('ERROR', 'WebAuthn requires the PDO extension for PHP.'), 12);
return;
}
$pdoDrivers = \PDO::getAvailableDrivers();
if (!in_array('sqlite', $pdoDrivers)) {
$row->add(new htmlStatusMessage('ERROR', 'Webauthn requires the sqlite PDO driver for PHP.'), 12);
$row->add(new htmlStatusMessage('ERROR', 'WebAuthn requires the sqlite PDO driver for PHP.'), 12);
return;
}
include_once __DIR__ . '/webauthn.inc';
@ -567,7 +567,7 @@ class WebauthnProvider extends BaseProvider {
}
$errorMessageDiv = new htmlDiv('generic-webauthn-error', new htmlOutputText(''));
$errorMessageDiv->addDataAttribute('button', _('Ok'));
$errorMessageDiv->addDataAttribute('title', _('Webauthn failed'));
$errorMessageDiv->addDataAttribute('title', _('WebAuthn failed'));
$row->add($errorMessageDiv, 12);
$row->add(new htmlJavaScript('window.lam.webauthn.start(\'' . $pathPrefix . '\', ' . $selfServiceParam . ');'), 0);
}

View File

@ -808,17 +808,17 @@
},
{
"name": "phpmailer/phpmailer",
"version": "v6.1.5",
"version_normalized": "6.1.5.0",
"version": "v6.1.6",
"version_normalized": "6.1.6.0",
"source": {
"type": "git",
"url": "https://github.com/PHPMailer/PHPMailer.git",
"reference": "a8bf068f64a580302026e484ee29511f661b2ad3"
"reference": "c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/a8bf068f64a580302026e484ee29511f661b2ad3",
"reference": "a8bf068f64a580302026e484ee29511f661b2ad3",
"url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3",
"reference": "c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3",
"shasum": ""
},
"require": {
@ -839,7 +839,7 @@
"stevenmaguire/oauth2-microsoft": "Needed for Microsoft XOAUTH2 authentication",
"symfony/polyfill-mbstring": "To support UTF-8 if the Mbstring PHP extension is not enabled (^1.2)"
},
"time": "2020-03-14T14:23:48+00:00",
"time": "2020-05-27T12:24:03+00:00",
"type": "library",
"installation-source": "dist",
"autoload": {

View File

@ -2,6 +2,8 @@
Please disclose any vulnerabilities found responsibly - report any security problems found to the maintainers privately.
PHPMailer versions 6.1.5 and earlier contain an output escaping bug that occurs in `Content-Type` and `Content-Disposition` when filenames passed into `addAttachment` and other methods that accept attachment names contain double quote characters, in contravention of RFC822 3.4.1. No specific vulnerability has been found relating to this, but it could allow file attachments to bypass attachment filters that are based on matching filename extensions. Recorded as [CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625). Reported by Elar Lang of Clarified Security.
PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing `phar://` paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. Recorded as [CVE-2018-19296](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19296). See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.
PHPMailer versions prior to 5.2.24 (released July 26th 2017) have an XSS vulnerability in one of the code examples, [CVE-2017-11503](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11503). The `code_generator.phps` example did not filter user input prior to output. This file is distributed with a `.phps` extension, so it it not normally executable unless it is explicitly renamed, and the file is not included when PHPMailer is loaded through composer, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.

View File

@ -1 +1 @@
6.1.5
6.1.6

View File

@ -19,6 +19,12 @@
"name": "Brent R. Matzelle"
}
],
"funding": [
{
"url": "https://github.com/synchro",
"type": "github"
}
],
"require": {
"php": ">=5.5.0",
"ext-ctype": "*",

View File

@ -745,7 +745,7 @@ class PHPMailer
*
* @var string
*/
const VERSION = '6.1.5';
const VERSION = '6.1.6';
/**
* Error severity: message only, continue processing.
@ -2086,6 +2086,7 @@ class PHPMailer
'se' => 'sv',
'rs' => 'sr',
'tg' => 'tl',
'am' => 'hy',
];
if (isset($renamed_langcodes[$langcode])) {
@ -2606,7 +2607,7 @@ class PHPMailer
$altBodyEncoding = static::ENCODING_QUOTED_PRINTABLE;
}
//Use this as a preamble in all multipart message types
$mimepre = 'This is a multi-part message in MIME format.' . static::$LE . static::$LE;
$mimepre = 'This is a multi-part message in MIME format.' . static::$LE . static::$LE;
switch ($this->message_type) {
case 'inline':
$body .= $mimepre;
@ -3063,9 +3064,9 @@ class PHPMailer
//Only include a filename property if we have one
if (!empty($name)) {
$mime[] = sprintf(
'Content-Type: %s; name="%s"%s',
'Content-Type: %s; name=%s%s',
$type,
$this->encodeHeader($this->secureHeader($name)),
static::quotedString($this->encodeHeader($this->secureHeader($name))),
static::$LE
);
} else {
@ -3085,24 +3086,14 @@ class PHPMailer
$mime[] = 'Content-ID: <' . $this->encodeHeader($this->secureHeader($cid)) . '>' . static::$LE;
}
// If a filename contains any of these chars, it should be quoted,
// but not otherwise: RFC2183 & RFC2045 5.1
// Fixes a warning in IETF's msglint MIME checker
// Allow for bypassing the Content-Disposition header totally
// Allow for bypassing the Content-Disposition header
if (!empty($disposition)) {
$encoded_name = $this->encodeHeader($this->secureHeader($name));
if (preg_match('/[ ()<>@,;:"\/\[\]?=]/', $encoded_name)) {
$mime[] = sprintf(
'Content-Disposition: %s; filename="%s"%s',
$disposition,
$encoded_name,
static::$LE . static::$LE
);
} elseif (!empty($encoded_name)) {
if (!empty($encoded_name)) {
$mime[] = sprintf(
'Content-Disposition: %s; filename=%s%s',
$disposition,
$encoded_name,
static::quotedString($encoded_name),
static::$LE . static::$LE
);
} else {
@ -3162,6 +3153,7 @@ class PHPMailer
if ($this->exceptions) {
throw $exc;
}
return '';
}
}
@ -4726,6 +4718,28 @@ class PHPMailer
return (bool) preg_match('/^(.{' . (self::MAX_LINE_LENGTH + strlen(static::$LE)) . ',})/m', $str);
}
/**
* If a string contains any "special" characters, double-quote the name,
* and escape any double quotes with a backslash.
*
* @param string $str
*
* @return string
*
* @see RFC822 3.4.1
*/
public static function quotedString($str)
{
if (preg_match('/[ ()<>@,;:"\/\[\]?=]/', $str)) {
//If the string contains any of these chars, it must be double-quoted
//and any double quotes must be escaped with a backslash
return '"' . str_replace('"', '\\"', $str) . '"';
}
//Return the string untouched, it doesn't need quoting
return $str;
}
/**
* Allows for public read access to 'to' property.
* Before the send() call, queued addresses (i.e. with IDN) are not yet included.

View File

@ -45,7 +45,7 @@ class POP3
*
* @var string
*/
const VERSION = '6.1.5';
const VERSION = '6.1.6';
/**
* Default POP3 port number.

View File

@ -34,7 +34,7 @@ class SMTP
*
* @var string
*/
const VERSION = '6.1.5';
const VERSION = '6.1.6';
/**
* SMTP line break constant.
@ -1168,7 +1168,7 @@ class SMTP
//Must pass vars in here as params are by reference
if (!stream_select($selR, $selW, $selW, $this->Timelimit)) {
$this->edebug(
'SMTP -> get_lines(): timed-out (' . $this->Timeout . ' sec)',
'SMTP -> get_lines(): select timed-out in (' . $this->Timelimit . ' sec)',
self::DEBUG_LOWLEVEL
);
break;
@ -1187,7 +1187,7 @@ class SMTP
$info = stream_get_meta_data($this->smtp_conn);
if ($info['timed_out']) {
$this->edebug(
'SMTP -> get_lines(): timed-out (' . $this->Timeout . ' sec)',
'SMTP -> get_lines(): stream timed-out (' . $this->Timeout . ' sec)',
self::DEBUG_LOWLEVEL
);
break;

View File

@ -6,7 +6,7 @@
* **category** Library
* **author** Nicola Asuni <info@tecnick.com>
* **copyright** 2002-2018 Nicola Asuni - Tecnick.com LTD
* **copyright** 2002-2020 Nicola Asuni - Tecnick.com LTD
* **license** http://www.gnu.org/copyleft/lesser.html GNU-LGPL v3 (see LICENSE.TXT)
* **link** http://www.tcpdf.org
* **source** https://github.com/tecnickcom/TCPDF

1
lam/lib/3rdParty/tcpdf/VERSION vendored Normal file
View File

@ -0,0 +1 @@
6.3.5

View File

@ -1,6 +1,6 @@
{
"name": "tecnickcom/tcpdf",
"version": "6.2.26",
"version": "6.3.5",
"homepage": "http://www.tcpdf.org/",
"type": "library",
"description": "TCPDF is a PHP class for generating PDF documents and barcodes.",
@ -13,7 +13,7 @@
"pdf417",
"barcodes"
],
"license": "LGPL-3.0",
"license": "LGPL-3.0-only",
"authors": [
{
"name": "Nicola Asuni",

View File

@ -63,7 +63,7 @@
* Default images directory.
* By default it is automatically set but you can also set it as a fixed string to improve performances.
*/
define ('K_PATH_IMAGES', '');
//define ('K_PATH_IMAGES', '');
/**
* Deafult image logo used be the default Header() method.

Binary file not shown.

Binary file not shown.

Binary file not shown.

File diff suppressed because one or more lines are too long

Binary file not shown.

Binary file not shown.

File diff suppressed because one or more lines are too long

Binary file not shown.

View File

@ -629,7 +629,7 @@ class Datamatrix {
if ($numch[ENC_C40] == $numch[ENC_X12]) {
$k = ($pos + $charscount + 1);
while ($k < $data_length) {
$tmpchr = ord($data{$k});
$tmpchr = ord($data[$k]);
if ($this->isCharMode($tmpchr, ENC_X12)) {
return ENC_X12;
} elseif (!($this->isCharMode($tmpchr, ENC_X12) OR $this->isCharMode($tmpchr, ENC_C40))) {

View File

@ -878,7 +878,7 @@ class PDF417 {
$txtarr = array(); // array of characters and sub-mode switching characters
$codelen = strlen($code);
for ($i = 0; $i < $codelen; ++$i) {
$chval = ord($code{$i});
$chval = ord($code[$i]);
if (($k = array_search($chval, $this->textsubmodes[$submode])) !== false) {
// we are on the same sub-mode
$txtarr[] = $k;
@ -888,7 +888,7 @@ class PDF417 {
// search new sub-mode
if (($s != $submode) AND (($k = array_search($chval, $this->textsubmodes[$s])) !== false)) {
// $s is the new submode
if (((($i + 1) == $codelen) OR ((($i + 1) < $codelen) AND (array_search(ord($code{($i + 1)}), $this->textsubmodes[$submode]) !== false))) AND (($s == 3) OR (($s == 0) AND ($submode == 1)))) {
if (((($i + 1) == $codelen) OR ((($i + 1) < $codelen) AND (array_search(ord($code[($i + 1)]), $this->textsubmodes[$submode]) !== false))) AND (($s == 3) OR (($s == 0) AND ($submode == 1)))) {
// shift (temporary change only for this char)
if ($s == 3) {
// shift to puntuaction
@ -952,7 +952,7 @@ class PDF417 {
$cw = array_merge($cw, $cw6);
} else {
for ($i = 0; $i < $sublen; ++$i) {
$cw[] = ord($code{$i});
$cw[] = ord($code[$i]);
}
}
$code = $rest;

View File

@ -1686,7 +1686,7 @@ class QRcode {
/**
* Append data to an input object.
* The data is copied and appended to the input object.
* @param $items (array) input items
* @param $items (arrray) input items
* @param $mode (int) encoding mode.
* @param $size (int) size of data (byte).
* @param $data (array) array of input data.

BIN
lam/lib/3rdParty/tcpdf/include/sRGB.icc vendored Normal file

Binary file not shown.

View File

@ -358,7 +358,7 @@ class TCPDF_COLORS {
$color_code = self::$webcolor[$color];
} else {
// spot color
$returncolor = self::getSpotColor($color, $spotc);
$returncolor = self::getSpotColor($hcolor, $spotc);
if ($returncolor === false) {
$returncolor = $defcol;
}

View File

@ -279,7 +279,7 @@ class TCPDF_FILTERS {
// convert string to binary string
$bitstring = '';
for ($i = 0; $i < $data_length; ++$i) {
$bitstring .= sprintf('%08b', ord($data{$i}));
$bitstring .= sprintf('%08b', ord($data[$i]));
}
// get the number of bits
$data_length = strlen($bitstring);
@ -376,7 +376,7 @@ class TCPDF_FILTERS {
$i = 0;
while($i < $data_length) {
// get current byte value
$byte = ord($data{$i});
$byte = ord($data[$i]);
if ($byte == 128) {
// a length value of 128 denote EOD
break;
@ -389,7 +389,7 @@ class TCPDF_FILTERS {
} else {
// if length is in the range 129 to 255,
// the following single byte shall be copied 257 - length (2 to 128) times during decompression
$decoded .= str_repeat($data{($i + 1)}, (257 - $byte));
$decoded .= str_repeat($data[($i + 1)], (257 - $byte));
// move to next block
$i += 2;
}

View File

@ -1664,6 +1664,7 @@ class TCPDF_FONTS {
* @public static
*/
public static function unichr($c, $unicode=true) {
$c = intval($c);
if (!$unicode) {
return chr($c);
} elseif ($c <= 0x7F) {

View File

@ -311,7 +311,7 @@ class TCPDF_IMAGES {
if ($n > 0) {
$trns = array();
for ($i = 0; $i < $n; ++ $i) {
$trns[] = ord($t{$i});
$trns[] = ord($t[$i]);
}
}
}

View File

@ -1,9 +1,9 @@
<?php
//============================================================+
// File name : tcpdf_static.php
// Version : 1.1.3
// Version : 1.1.4
// Begin : 2002-08-03
// Last Update : 2015-04-28
// Last Update : 2019-11-01
// Author : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - info@tecnick.com
// License : GNU-LGPL v3 (http://www.gnu.org/copyleft/lesser.html)
// -------------------------------------------------------------------
@ -55,7 +55,7 @@ class TCPDF_STATIC {
* Current TCPDF version.
* @private static
*/
private static $tcpdf_version = '6.2.26';
private static $tcpdf_version = '6.3.5';
/**
* String alias for total number of pages.
@ -1829,6 +1829,8 @@ class TCPDF_STATIC {
*/
public static function url_exists($url) {
$crs = curl_init();
// encode query params in URL to get right response form the server
$url = self::encodeUrlQuery($url);
curl_setopt($crs, CURLOPT_URL, $url);
curl_setopt($crs, CURLOPT_NOBODY, true);
curl_setopt($crs, CURLOPT_FAILONERROR, true);
@ -1846,6 +1848,26 @@ class TCPDF_STATIC {
return ($code == 200);
}
/**
* Encode query params in URL
*
* @param string $url
* @return string
* @since 6.3.3 (2019-11-01)
* @public static
*/
public static function encodeUrlQuery($url) {
$urlData = parse_url($url);
if (isset($urlData['query']) && $urlData['query']) {
$urlQueryData = [];
parse_str(urldecode($urlData['query']), $urlQueryData);
$updatedUrl = $urlData['scheme'] . '://' . $urlData['host'] . $urlData['path'] . '?' . http_build_query($urlQueryData);
} else {
$updatedUrl = $url;
}
return $updatedUrl;
}
/**
* Wrapper for file_exists.
* Checks whether a file or directory exists.
@ -1926,10 +1948,10 @@ class TCPDF_STATIC {
$alt = array_unique($alt);
foreach ($alt as $path) {
if (!self::file_exists($path)) {
return false;
continue;
}
$ret = @file_get_contents($path);
if ($ret !== false) {
if ( $ret != false ) {
return $ret;
}
// try to use CURL for URLs

View File

@ -1,13 +1,13 @@
<?php
//============================================================+
// File name : tcpdf.php
// Version : 6.2.26
// Version : 6.3.2
// Begin : 2002-08-03
// Last Update : 2018-09-14
// Last Update : 2019-09-20
// Author : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - info@tecnick.com
// License : GNU-LGPL v3 (http://www.gnu.org/copyleft/lesser.html)
// -------------------------------------------------------------------
// Copyright (C) 2002-2018 Nicola Asuni - Tecnick.com LTD
// Copyright (C) 2002-2019 Nicola Asuni - Tecnick.com LTD
//
// This file is part of TCPDF software library.
//
@ -45,7 +45,7 @@
// * font subsetting;
// * methods to publish some XHTML + CSS code, Javascript and Forms;
// * images, graphic (geometric figures) and transformation methods;
// * supports JPEG, PNG and SVG images natively, all images supported by GD (GD, GD2, GD2PART, GIF, JPEG, PNG, BMP, XBM, XPM) and all images supported via ImagMagick (http://www.imagemagick.org/www/formats.html)
// * supports JPEG, PNG and SVG images natively, all images supported by GD (GD, GD2, GD2PART, GIF, JPEG, PNG, BMP, XBM, XPM) and all images supported via ImageMagick (http://www.imagemagick.org/www/formats.html)
// * 1D and 2D barcodes: CODE 39, ANSI MH10.8M-1983, USD-3, 3 of 9, CODE 93, USS-93, Standard 2 of 5, Interleaved 2 of 5, CODE 128 A/B/C, 2 and 5 Digits UPC-Based Extension, EAN 8, EAN 13, UPC-A, UPC-E, MSI, POSTNET, PLANET, RMS4CC (Royal Mail 4-state Customer Code), CBC (Customer Bar Code), KIX (Klant index - Customer index), Intelligent Mail Barcode, Onecode, USPS-B-3200, CODABAR, CODE 11, PHARMACODE, PHARMACODE TWO-TRACKS, Datamatrix, QR-Code, PDF417;
// * JPEG and PNG ICC profiles, Grayscale, RGB, CMYK, Spot Colors and Transparencies;
// * automatic page header and footer management;
@ -80,7 +80,7 @@
* <li>font subsetting;</li>
* <li>methods to publish some XHTML + CSS code, Javascript and Forms;</li>
* <li>images, graphic (geometric figures) and transformation methods;
* <li>supports JPEG, PNG and SVG images natively, all images supported by GD (GD, GD2, GD2PART, GIF, JPEG, PNG, BMP, XBM, XPM) and all images supported via ImagMagick (http://www.imagemagick.org/www/formats.html)</li>
* <li>supports JPEG, PNG and SVG images natively, all images supported by GD (GD, GD2, GD2PART, GIF, JPEG, PNG, BMP, XBM, XPM) and all images supported via ImageMagick (http://www.imagemagick.org/www/formats.html)</li>
* <li>1D and 2D barcodes: CODE 39, ANSI MH10.8M-1983, USD-3, 3 of 9, CODE 93, USS-93, Standard 2 of 5, Interleaved 2 of 5, CODE 128 A/B/C, 2 and 5 Digits UPC-Based Extension, EAN 8, EAN 13, UPC-A, UPC-E, MSI, POSTNET, PLANET, RMS4CC (Royal Mail 4-state Customer Code), CBC (Customer Bar Code), KIX (Klant index - Customer index), Intelligent Mail Barcode, Onecode, USPS-B-3200, CODABAR, CODE 11, PHARMACODE, PHARMACODE TWO-TRACKS, Datamatrix, QR-Code, PDF417;</li>
* <li>JPEG and PNG ICC profiles, Grayscale, RGB, CMYK, Spot Colors and Transparencies;</li>
* <li>automatic page header and footer management;</li>
@ -104,7 +104,7 @@
* Tools to encode your unicode fonts are on fonts/utils directory.</p>
* @package com.tecnick.tcpdf
* @author Nicola Asuni
* @version 6.2.26
* @version 6.3.2
*/
// TCPDF configuration
@ -128,7 +128,7 @@ require_once(dirname(__FILE__).'/include/tcpdf_static.php');
* TCPDF project (http://www.tcpdf.org) has been originally derived in 2002 from the Public Domain FPDF class by Olivier Plathey (http://www.fpdf.org), but now is almost entirely rewritten.<br>
* @package com.tecnick.tcpdf
* @brief PHP class for generating PDF documents without requiring external extensions.
* @version 6.2.26
* @version 6.3.2
* @author Nicola Asuni - info@tecnick.com
* @IgnoreAnnotation("protected")
* @IgnoreAnnotation("public")
@ -1760,6 +1760,13 @@ class TCPDF {
*/
protected $pdfa_mode = false;
/**
* version of PDF/A mode (1 - 3).
* @protected
* @since 6.2.26 (2019-03-12)
*/
protected $pdfa_version = 1;
/**
* Document creation date-time
* @protected
@ -1781,6 +1788,13 @@ class TCPDF {
*/
protected $custom_xmp = '';
/**
* Custom XMP RDF data.
* @protected
* @since 6.3.0 (2019-09-19)
*/
protected $custom_xmp_rdf = '';
/**
* Overprint mode array.
* (Check the "Entries in a Graphics State Parameter Dictionary" on PDF 32000-1:2008).
@ -1834,7 +1848,7 @@ class TCPDF {
* @param $unicode (boolean) TRUE means that the input text is unicode (default = true)
* @param $encoding (string) Charset encoding (used only when converting back html entities); default is UTF-8.
* @param $diskcache (boolean) DEPRECATED FEATURE
* @param $pdfa (boolean) If TRUE set the document to PDF/A mode.
* @param $pdfa (integer) If not false, set the document to PDF/A mode and the good version (1 or 3).
* @public
* @see getPageSizeFromFormat(), setPageFormat()
*/
@ -1850,8 +1864,14 @@ class TCPDF {
$this->font_obj_ids = array();
$this->page_obj_id = array();
$this->form_obj_id = array();
// set pdf/a mode
$this->pdfa_mode = $pdfa;
if ($pdfa != false) {
$this->pdfa_mode = true;
$this->pdfa_version = $pdfa; // 1 or 3
} else
$this->pdfa_mode = false;
$this->force_srgb = false;
// set language direction
$this->rtl = false;
@ -1960,7 +1980,7 @@ class TCPDF {
// set default JPEG quality
$this->jpeg_quality = 75;
// initialize some settings
TCPDF_FONTS::utf8Bidi(array(''), '', false, $this->isunicode, $this->CurrentFont);
TCPDF_FONTS::utf8Bidi(array(), '', false, $this->isunicode, $this->CurrentFont);
// set default font
$this->SetFont($this->FontFamily, $this->FontStyle, $this->FontSizePt);
$this->setHeaderFont(array($this->FontFamily, $this->FontStyle, $this->FontSizePt));
@ -1986,6 +2006,7 @@ class TCPDF {
$this->default_graphic_vars = $this->getGraphicVars();
$this->header_xobj_autoreset = false;
$this->custom_xmp = '';
$this->custom_xmp_rdf = '';
// Call cleanup method after script execution finishes or exit() is called.
// NOTE: This will not be executed if the process is killed with a SIGTERM or SIGKILL signal.
register_shutdown_function(array($this, '_destroy'), true);
@ -2828,10 +2849,13 @@ class TCPDF {
* @since 1.4
*/
public function SetCompression($compress=true) {
$this->compress = false;
if (function_exists('gzcompress')) {
$this->compress = $compress ? true : false;
} else {
$this->compress = false;
if ($compress) {
if ( !$this->pdfa_mode) {
$this->compress = true;
}
}
}
}
@ -4691,14 +4715,14 @@ class TCPDF {
* Defines the page and position a link points to.
* @param $link (int) The link identifier returned by AddLink()
* @param $y (float) Ordinate of target position; -1 indicates the current position. The default value is 0 (top of page)
* @param $page (int) Number of target page; -1 indicates the current page (default value). If you prefix a page number with the * character, then this page will not be changed when adding/deleting/moving pages.
* @param $page (int|string) Number of target page; -1 indicates the current page (default value). If you prefix a page number with the * character, then this page will not be changed when adding/deleting/moving pages.
* @public
* @since 1.5
* @see AddLink()
*/
public function SetLink($link, $y=0, $page=-1) {
$fixed = false;
if (!empty($page) AND ($page[0] == '*')) {
if (!empty($page) AND (substr($page, 0, 1) == '*')) {
$page = intval(substr($page, 1));
// this page number will not be changed when moving/add/deleting pages
$fixed = true;
@ -4807,7 +4831,7 @@ class TCPDF {
$this->PageAnnots[$page] = array();
}
$this->PageAnnots[$page][] = array('n' => ++$this->n, 'x' => $x, 'y' => $y, 'w' => $w, 'h' => $h, 'txt' => $text, 'opt' => $opt, 'numspaces' => $spaces);
if (!$this->pdfa_mode) {
if (!$this->pdfa_mode || ($this->pdfa_mode && $this->pdfa_version == 3)) {
if ((($opt['Subtype'] == 'FileAttachment') OR ($opt['Subtype'] == 'Sound')) AND (!TCPDF_STATIC::empty_string($opt['FS']))
AND (@TCPDF_STATIC::file_exists($opt['FS']) OR TCPDF_STATIC::isValidURL($opt['FS']))
AND (!isset($this->embeddedfiles[basename($opt['FS'])]))) {
@ -4833,8 +4857,8 @@ class TCPDF {
* @see Annotation()
*/
protected function _putEmbeddedFiles() {
if ($this->pdfa_mode) {
// embedded files are not allowed in PDF/A mode
if ($this->pdfa_mode && $this->pdfa_version != 3) {
// embedded files are not allowed in PDF/A mode version 1 and 2
return;
}
reset($this->embeddedfiles);
@ -4847,7 +4871,10 @@ class TCPDF {
$this->efnames[$filename] = $filedata['f'].' 0 R';
// embedded file specification object
$out = $this->_getobj($filedata['f'])."\n";
$out .= '<</Type /Filespec /F '.$this->_datastring($filename, $filedata['f']).' /EF <</F '.$filedata['n'].' 0 R>> >>';
$out .= '<</Type /Filespec /F '.$this->_datastring($filename, $filedata['f']);
$out .= ' /UF '.$this->_datastring($filename, $filedata['f']);
$out .= ' /AFRelationship /Source';
$out .= ' /EF <</F '.$filedata['n'].' 0 R>> >>';
$out .= "\n".'endobj';
$this->_out($out);
// embedded file object
@ -4856,6 +4883,11 @@ class TCPDF {
$data = gzcompress($data);
$filter = ' /Filter /FlateDecode';
}
if ($this->pdfa_version == 3) {
$filter = ' /Subtype /text#2Fxml';
}
$stream = $this->_getrawstream($data, $filedata['n']);
$out = $this->_getobj($filedata['n'])."\n";
$out .= '<< /Type /EmbeddedFile'.$filter.' /Length '.strlen($stream).' /Params <</Size '.$rawsize.'>> >>';
@ -6219,12 +6251,12 @@ class TCPDF {
* $this->setPage($page);
* if ($page == $start_page) {
* // first page
* $height = $this->h - $start_y - $this->bMargin;
* $height += $this->h - $start_y - $this->bMargin;
* } elseif ($page == $end_page) {
* // last page
* $height = $end_y - $this->tMargin;
* $height += $end_y - $this->tMargin;
* } else {
* $height = $this->h - $this->tMargin - $this->bMargin;
* $height += $this->h - $this->tMargin - $this->bMargin;
* }
* }
* }
@ -7133,31 +7165,20 @@ class TCPDF {
$info['i'] = $this->setImageBuffer($file, $info);
}
// set alignment
$this->img_rb_x = $x + $w;
$this->img_rb_y = $y + $h;
// set alignment
if ($this->rtl) {
if ($palign == 'L') {
$ximg = $this->lMargin;
} elseif ($palign == 'C') {
$ximg = ($this->w + $this->lMargin - $this->rMargin - $w) / 2;
} elseif ($palign == 'R') {
$ximg = $this->w - $this->rMargin - $w;
} else {
$ximg = $x - $w;
}
$this->img_rb_x = $ximg;
if ($palign == 'L') {
$ximg = $this->lMargin;
} elseif ($palign == 'C') {
$ximg = ($this->w + $this->lMargin - $this->rMargin - $w) / 2;
} elseif ($palign == 'R') {
$ximg = $this->w - $this->rMargin - $w;
} else {
if ($palign == 'L') {
$ximg = $this->lMargin;
} elseif ($palign == 'C') {
$ximg = ($this->w + $this->lMargin - $this->rMargin - $w) / 2;
} elseif ($palign == 'R') {
$ximg = $this->w - $this->rMargin - $w;
} else {
$ximg = $x;
}
$this->img_rb_x = $ximg + $w;
$ximg = $x;
}
if ($ismask OR $hidden) {
// image is not displayed
return $info['i'];
@ -7737,6 +7758,7 @@ class TCPDF {
return '';
}
protected static $cleaned_ids = array();
/**
* Unset all class variables except the following critical variables.
* @param $destroyall (boolean) if true destroys all class variables, otherwise preserves critical variables.
@ -7749,11 +7771,26 @@ class TCPDF {
if (isset($this->internal_encoding) AND !empty($this->internal_encoding)) {
mb_internal_encoding($this->internal_encoding);
}
if (isset(self::$cleaned_ids[$this->file_id])) {
$destroyall = false;
}
if ($destroyall AND !$preserve_objcopy) {
self::$cleaned_ids[$this->file_id] = true;
// remove all temporary files
$tmpfiles = glob(K_PATH_CACHE.'__tcpdf_'.$this->file_id.'_*');
if (!empty($tmpfiles)) {
array_map('unlink', $tmpfiles);
if ($handle = @opendir(K_PATH_CACHE)) {
while ( false !== ( $file_name = readdir( $handle ) ) ) {
if (strpos($file_name, '__tcpdf_'.$this->file_id.'_') === 0) {
unlink(K_PATH_CACHE.$file_name);
}
}
closedir($handle);
}
if (isset($this->imagekeys)) {
foreach($this->imagekeys as $file) {
if (strpos($file, K_PATH_CACHE) === 0) {
@unlink($file);
}
}
}
}
$preserve = array(
@ -7763,6 +7800,7 @@ class TCPDF {
'bufferlen',
'buffer',
'cached_files',
'imagekeys',
'sign',
'signature_data',
'signature_max_length',
@ -8368,7 +8406,7 @@ class TCPDF {
if (is_string($pl['txt']) && !empty($pl['txt'])) {
if ($pl['txt'][0] == '#') {
// internal destination
$annots .= ' /Dest /'.TCPDF_STATIC::encodeNameObject(substr($pl['txt'], 1));
$annots .= ' /A <</S /GoTo /D '.TCPDF_STATIC::encodeNameObject(substr($pl['txt'], 1)).'>>';
} elseif ($pl['txt'][0] == '%') {
// embedded PDF file
$filename = basename(substr($pl['txt'], 1));
@ -8380,7 +8418,7 @@ class TCPDF {
$annots .= ' /A << /S /JavaScript /JS '.$this->_textstring($jsa, $annot_obj_id).'>>';
} else {
$parsedUrl = parse_url($pl['txt']);
if (empty($parsedUrl['scheme']) AND (strtolower(substr($parsedUrl['path'], -4)) == '.pdf')) {
if (empty($parsedUrl['scheme']) AND (!empty($parsedUrl['path']) && strtolower(substr($parsedUrl['path'], -4)) == '.pdf')) {
// relative link to a PDF file
$dest = '[0 /Fit]'; // default page 0
if (!empty($parsedUrl['fragment'])) {
@ -8487,8 +8525,8 @@ class TCPDF {
break;
}
case 'fileattachment': {
if ($this->pdfa_mode) {
// embedded files are not allowed in PDF/A mode
if ($this->pdfa_mode && $this->pdfa_version != 3) {
// embedded files are not allowed in PDF/A mode version 1 and 2
break;
}
if (!isset($pl['opt']['fs'])) {
@ -9500,6 +9538,17 @@ class TCPDF {
$this->custom_xmp = $xmp;
}
/**
* Set additional XMP data to be added on the default XMP data just before the end of "rdf:RDF" tag.
* IMPORTANT: This data is added as-is without controls, so you have to validate your data before using this method!
* @param $xmp (string) Custom XMP RDF data.
* @since 6.3.0 (2019-09-19)
* @public
*/
public function setExtraXMPRDF($xmp) {
$this->custom_xmp_rdf = $xmp;
}
/**
* Put XMP data object and return ID.
* @return (int) The object ID.
@ -9569,7 +9618,7 @@ class TCPDF {
$xmp .= "\t\t".'</rdf:Description>'."\n";
if ($this->pdfa_mode) {
$xmp .= "\t\t".'<rdf:Description rdf:about="" xmlns:pdfaid="http://www.aiim.org/pdfa/ns/id/">'."\n";
$xmp .= "\t\t\t".'<pdfaid:part>1</pdfaid:part>'."\n";
$xmp .= "\t\t\t".'<pdfaid:part>'.$this->pdfa_version.'</pdfaid:part>'."\n";
$xmp .= "\t\t\t".'<pdfaid:conformance>B</pdfaid:conformance>'."\n";
$xmp .= "\t\t".'</rdf:Description>'."\n";
}
@ -9581,6 +9630,16 @@ class TCPDF {
$xmp .= "\t\t\t\t\t\t".'<pdfaSchema:namespaceURI>http://ns.adobe.com/pdf/1.3/</pdfaSchema:namespaceURI>'."\n";
$xmp .= "\t\t\t\t\t\t".'<pdfaSchema:prefix>pdf</pdfaSchema:prefix>'."\n";
$xmp .= "\t\t\t\t\t\t".'<pdfaSchema:schema>Adobe PDF Schema</pdfaSchema:schema>'."\n";
$xmp .= "\t\t\t\t\t\t".'<pdfaSchema:property>'."\n";
$xmp .= "\t\t\t\t\t\t\t".'<rdf:Seq>'."\n";
$xmp .= "\t\t\t\t\t\t\t\t".'<rdf:li rdf:parseType="Resource">'."\n";
$xmp .= "\t\t\t\t\t\t\t\t\t".'<pdfaProperty:category>internal</pdfaProperty:category>'."\n";
$xmp .= "\t\t\t\t\t\t\t\t\t".'<pdfaProperty:description>Adobe PDF Schema</pdfaProperty:description>'."\n";
$xmp .= "\t\t\t\t\t\t\t\t\t".'<pdfaProperty:name>InstanceID</pdfaProperty:name>'."\n";
$xmp .= "\t\t\t\t\t\t\t\t\t".'<pdfaProperty:valueType>URI</pdfaProperty:valueType>'."\n";
$xmp .= "\t\t\t\t\t\t\t\t".'</rdf:li>'."\n";
$xmp .= "\t\t\t\t\t\t\t".'</rdf:Seq>'."\n";
$xmp .= "\t\t\t\t\t\t".'</pdfaSchema:property>'."\n";
$xmp .= "\t\t\t\t\t".'</rdf:li>'."\n";
$xmp .= "\t\t\t\t\t".'<rdf:li rdf:parseType="Resource">'."\n";
$xmp .= "\t\t\t\t\t\t".'<pdfaSchema:namespaceURI>http://ns.adobe.com/xap/1.0/mm/</pdfaSchema:namespaceURI>'."\n";
@ -9627,6 +9686,7 @@ class TCPDF {
$xmp .= "\t\t\t\t".'</rdf:Bag>'."\n";
$xmp .= "\t\t\t".'</pdfaExtension:schemas>'."\n";
$xmp .= "\t\t".'</rdf:Description>'."\n";
$xmp .= $this->custom_xmp_rdf;
$xmp .= "\t".'</rdf:RDF>'."\n";
$xmp .= $this->custom_xmp;
$xmp .= '</x:xmpmeta>'."\n";
@ -12221,7 +12281,7 @@ class TCPDF {
$x = $this->w;
}
$fixed = false;
if (!empty($page) AND ($page[0] == '*')) {
if (!empty($page) AND (substr($page, 0, 1) == '*')) {
$page = intval(substr($page, 1));
// this page number will not be changed when moving/add/deleting pages
$fixed = true;
@ -12324,7 +12384,8 @@ class TCPDF {
$x = $this->w;
}
$fixed = false;
if (!empty($page) AND ($page[0] == '*')) {
$pageAsString = (string) $page;
if ($pageAsString && $pageAsString[0] == '*') {
$page = intval(substr($page, 1));
// this page number will not be changed when moving/add/deleting pages
$fixed = true;
@ -13988,7 +14049,7 @@ class TCPDF {
* @since 3.1.000 (2008-06-09)
*/
public function setPDFVersion($version='1.7') {
if ($this->pdfa_mode) {
if ($this->pdfa_mode && $this->pdfa_version == 1 ) {
// PDF/A mode
$this->PDFVersion = '1.4';
} else {
@ -15502,8 +15563,7 @@ class TCPDF {
* <li>int $style['module_height'] height of a single module in points</li>
* <li>array $style['fgcolor'] color array for bars and text</li>
* <li>mixed $style['bgcolor'] color array for background or false for transparent</li>
* <li>string $style['position'] barcode position on the page: L = left margin; C = center; R = right margin; S = stretch</li><li>$style['module_width'] width of a single module in points</li>
* <li>$style['module_height'] height of a single module in points</li></ul>
* <li>string $style['position'] barcode position on the page: L = left margin; C = center; R = right margin; S = stretch</li>
* @param $align (string) Indicates the alignment of the pointer next to barcode insertion relative to barcode height. The value can be:<ul><li>T: top-right for LTR or top-left for RTL</li><li>M: middle-right for LTR or middle-left for RTL</li><li>B: bottom-right for LTR or bottom-left for RTL</li><li>N: next line</li></ul>
* @param $distort (boolean) if true distort the barcode to fit width and height, otherwise preserve aspect ratio
* @author Nicola Asuni