{"action":"created","issue":{"url":"https://api.github.com/repos/textpattern/textpattern/issues/807","repository_url":"https://api.github.com/repos/textpattern/textpattern","labels_url":"https://api.github.com/repos/textpattern/textpattern/issues/807/labels{/name}","comments_url":"https://api.github.com/repos/textpattern/textpattern/issues/807/comments","events_url":"https://api.github.com/repos/textpattern/textpattern/issues/807/events","html_url":"https://github.com/textpattern/textpattern/issues/807","id":183937870,"number":807,"title":"RPC bug in 4.6+","user":{"login":"makss","id":2004844,"avatar_url":"https://avatars.githubusercontent.com/u/2004844?v=3","gravatar_id":"","url":"https://api.github.com/users/makss","html_url":"https://github.com/makss","followers_url":"https://api.github.com/users/makss/followers","following_url":"https://api.github.com/users/makss/following{/other_user}","gists_url":"https://api.github.com/users/makss/gists{/gist_id}","starred_url":"https://api.github.com/users/makss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/makss/subscriptions","organizations_url":"https://api.github.com/users/makss/orgs","repos_url":"https://api.github.com/users/makss/repos","events_url":"https://api.github.com/users/makss/events{/privacy}","received_events_url":"https://api.github.com/users/makss/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"Bloke","id":21252,"avatar_url":"https://avatars.githubusercontent.com/u/21252?v=3","gravatar_id":"","url":"https://api.github.com/users/Bloke","html_url":"https://github.com/Bloke","followers_url":"https://api.github.com/users/Bloke/followers","following_url":"https://api.github.com/users/Bloke/following{/other_user}","gists_url":"https://api.github.com/users/Bloke/gists{/gist_id}","starred_url":"https://api.github.com/users/Bloke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bloke/subscriptions","organizations_url":"https://api.github.com/users/Bloke/orgs","repos_url":"https://api.github.com/users/Bloke/repos","events_url":"https://api.github.com/users/Bloke/events{/privacy}","received_events_url":"https://api.github.com/users/Bloke/received_events","type":"User","site_admin":false},"assignees":[{"login":"Bloke","id":21252,"avatar_url":"https://avatars.githubusercontent.com/u/21252?v=3","gravatar_id":"","url":"https://api.github.com/users/Bloke","html_url":"https://github.com/Bloke","followers_url":"https://api.github.com/users/Bloke/followers","following_url":"https://api.github.com/users/Bloke/following{/other_user}","gists_url":"https://api.github.com/users/Bloke/gists{/gist_id}","starred_url":"https://api.github.com/users/Bloke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bloke/subscriptions","organizations_url":"https://api.github.com/users/Bloke/orgs","repos_url":"https://api.github.com/users/Bloke/repos","events_url":"https://api.github.com/users/Bloke/events{/privacy}","received_events_url":"https://api.github.com/users/Bloke/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/textpattern/textpattern/milestones/2","html_url":"https://github.com/textpattern/textpattern/milestones/v4.7","labels_url":"https://api.github.com/repos/textpattern/textpattern/milestones/2/labels","id":813574,"number":2,"title":"v4.7","description":"","creator":{"login":"philwareham","id":413665,"avatar_url":"https://avatars.githubusercontent.com/u/413665?v=3","gravatar_id":"","url":"https://api.github.com/users/philwareham","html_url":"https://github.com/philwareham","followers_url":"https://api.github.com/users/philwareham/followers","following_url":"https://api.github.com/users/philwareham/following{/other_user}","gists_url":"https://api.github.com/users/philwareham/gists{/gist_id}","starred_url":"https://api.github.com/users/philwareham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philwareham/subscriptions","organizations_url":"https://api.github.com/users/philwareham/orgs","repos_url":"https://api.github.com/users/philwareham/repos","events_url":"https://api.github.com/users/philwareham/events{/privacy}","received_events_url":"https://api.github.com/users/philwareham/received_events","type":"User","site_admin":false},"open_issues":26,"closed_issues":18,"state":"open","created_at":"2014-10-04T13:55:37Z","updated_at":"2016-11-30T14:01:11Z","due_on":null,"closed_at":null},"comments":12,"created_at":"2016-10-19T11:39:17Z","updated_at":"2016-12-06T16:28:08Z","closed_at":null,"body":"Forum [Report](http://forum.textpattern.com/viewtopic.php?id=47351)\n\nNeed Trace initialization to RPC server.  Like that:\nfile: `rpc/index.php`\n\n```\ndefine('txpinterface', 'xmlrpc');\n\nrequire_once txpath.'/config.php';\ninclude_once txpath.'/lib/class.trace.php';\n$trace = new Trace();\n```\n"},"comment":{"url":"https://api.github.com/repos/textpattern/textpattern/issues/comments/265196833","html_url":"https://github.com/textpattern/textpattern/issues/807#issuecomment-265196833","issue_url":"https://api.github.com/repos/textpattern/textpattern/issues/807","id":265196833,"user":{"login":"Bloke","id":21252,"avatar_url":"https://avatars.githubusercontent.com/u/21252?v=3","gravatar_id":"","url":"https://api.github.com/users/Bloke","html_url":"https://github.com/Bloke","followers_url":"https://api.github.com/users/Bloke/followers","following_url":"https://api.github.com/users/Bloke/following{/other_user}","gists_url":"https://api.github.com/users/Bloke/gists{/gist_id}","starred_url":"https://api.github.com/users/Bloke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bloke/subscriptions","organizations_url":"https://api.github.com/users/Bloke/orgs","repos_url":"https://api.github.com/users/Bloke/repos","events_url":"https://api.github.com/users/Bloke/events{/privacy}","received_events_url":"https://api.github.com/users/Bloke/received_events","type":"User","site_admin":false},"created_at":"2016-12-06T16:28:08Z","updated_at":"2016-12-06T16:28:08Z","body":"Well I now know why [/Textpattern/Security/Filter](https://github.com/textpattern/textpattern/blob/dev/textpattern/vendors/Textpattern/Security/Filter.php) is unused. The place we need to use it (as follows) is right at the top of both `index.php` files:\r\n\r\n```\r\n$maxUrlLen = get_pref('max_url_len', 1000);\r\nTxp::get('\\Textpattern\\Security\\Filter')->registerGlobals()->setMaxRequestUriLength($maxUrlLen);\r\n```\r\n\r\nUnfortunately, at that point, neither `txplib_misc.php` nor `txplib_db.php` are loaded (hence, no DB access, and no `get_pref()`) nor is the autoloader registered, so no access to `Txp::get`.\r\n\r\nIn order to use it, we'd have to defer its use:\r\n\r\n* For the public side, to roughly where `bombShelter()` is called in `textpattern\\publish.php`.\r\n* For the admin side, to after the libraries are included (currently around line 98+).\r\n\r\nCan we wait that long to unset potentially harmful globals or long URLs injected by malicious scripts? Is this a verifiable/demonstrable attack vector? Or could some stuff be refactored to safely start the autoloader and include the relevant minimal library files earlier -- certainly for the public side?"}}
{"actor":{"display_login":"Bloke"}}