#2462 Macros: checking for safe macros

inc/classes/BxDolService.php

@@ -95,11 +95,11 @@ class BxDolService extends BxDol
             $s = bx_replace_markers($s, $aMarkers);
 
         if (!preg_match("/^([a-zA-Z0-9_\:]+)(.*)$/", $s, $aMatches))
-            return '<b></b>';
+            return _t('_sys_macros_malformed');
 
         $a = explode(":", $aMatches[1]);
         if (!isset($a[0]) || !isset($a[1]))
-            return '';
+            return _t('_sys_macros_malformed');
 
         $aParams = array();
         if (!empty($aMatches[2]))
@@ -107,6 +107,9 @@ class BxDolService extends BxDol
         if (!$aParams)
             $aParams = array();
 
+        if (!self::call($a[0], 'is_safe_service', array($a[1])))
+            return _t('_sys_macros_unsafe');
+
         return self::call($a[0], $a[1], $aParams, isset($a[3]) ? $a[3] : 'Module', isset($a[4]) && 'ignore_cache' == $a[4] ? true : false);
     }
 

modules/base/general/classes/BxBaseModGeneralModule.php

@@ -71,6 +71,40 @@ class BxBaseModGeneralModule extends BxDolModule
     }
 
     // ====== SERVICE METHODS
+
+    public function serviceIsSafeService($s)
+    {
+        $sService = bx_gen_method_name($s);
+        $aSafeServices = $this->serviceGetSafeServices();
+        return in_array($sService, $aSafeServices);
+    }
+
+    public function serviceGetSafeServices()
+    {
+        return array(
+            'ModuleIcon',
+            'GetCreatePostForm',
+            'GetLink',
+            'GetSearchResultUnit',
+            'MyEntriesActions',
+            'Browse',
+            'BrowseFeatured',
+            'BrowseFavorite',
+            'EntityEdit',
+            'EntityDelete',
+            'EntityTextBlock',
+            'EntityInfo',
+            'EntityInfoFull',
+            'EntityInfoExtended',
+            'EntityLocation',
+            'EntityComments',
+            'EntityAttachments',
+            'EntityAllActions',
+            'EntityActions',
+            'EntitySocialSharing',
+        );
+    }
+
     public function serviceGetCreatePostForm($aParams = array())
     {
     	$aParams = array_merge($this->_aFormParams, $aParams);
@@ -2072,4 +2106,4 @@ class BxBaseModGeneralModule extends BxDolModule
 	}
 }
 
-/** @} */
+/** @} */

modules/boonex/english/data/langs/system/en.xml

@@ -2325,6 +2325,8 @@ If it is not enabled then please consider implement this optimization, since it
 	<string name="_sys_location_determining"><![CDATA[Determining location...]]></string>
 	<string name="_sys_location_geolocation_not_supported_by_browser"><![CDATA[Geolocation is not supported by this browser]]></string>
 	<string name="_sys_location_undefined"><![CDATA[Location off]]></string>
+    <string name="_sys_macros_malformed"><![CDATA[Error: malformed macros]]></string>
+    <string name="_sys_macros_unsafe"><![CDATA[Error: unsafe macros]]></string> 
 	<string name="_sys_menu_item_title_about"><![CDATA[About]]></string>
         <string name="_sys_menu_item_title_copyright"><![CDATA[Copyright]]></string>
 	<string name="_sys_menu_item_title_privacy"><![CDATA[Privacy]]></string>

modules/boonex/russian/data/langs/system/ru.xml

@@ -2263,6 +2263,8 @@
 	<string name="_sys_location_determining"><![CDATA[Определение местоположения...]]></string>
 	<string name="_sys_location_geolocation_not_supported_by_browser"><![CDATA[Геолокация не поддерживается этим браузером]]></string>
 	<string name="_sys_location_undefined"><![CDATA[Отключить местоположение]]></string>
+    <string name="_sys_macros_malformed"><![CDATA[Ошибка: некорректный макрос]]></string>
+    <string name="_sys_macros_unsafe"><![CDATA[Ошибка: небезопасный макрос]]></string>
 	<string name="_sys_menu_item_title_about"><![CDATA[О нас]]></string>
         <string name="_sys_menu_item_title_copyright"><![CDATA[Копирайт]]></string>
 	<string name="_sys_menu_item_title_privacy"><![CDATA[Конфиденциальность]]></string>