Merge branch 'development' of https://github.com/PrestaShop/PrestaShop into development

admin-dev/ajaxfilemanager/ajax_file_upload.php

@@ -22,26 +22,18 @@
 								
 	$upload->setInvalidFileExt(explode(",", CONFIG_UPLOAD_INVALID_EXTS));
 	if(CONFIG_SYS_VIEW_ONLY || !CONFIG_OPTIONS_UPLOAD)
-	{
 		$error = SYS_DISABLED;
-	}
 	elseif(empty($_GET['folder']) || !isUnderRoot($_GET['folder']))
-	{
 		$error = ERR_FOLDER_PATH_NOT_ALLOWED;
-	}else	if(!$upload->isFileUploaded('file'))
+	elseif (!$upload->isFileUploaded('file'))
-	{
 		$error = ERR_FILE_NOT_UPLOADED;
-	}else if(!$upload->moveUploadedFile($_GET['folder']))
+	elseif (!$upload->isPermittedFileExt(explode(",", CONFIG_UPLOAD_VALID_EXTS)))
-	{
-		$error = ERR_FILE_MOVE_FAILED;
-	}	
-	elseif(!$upload->isPermittedFileExt(explode(",", CONFIG_UPLOAD_VALID_EXTS)))
-	{		
 		$error = ERR_FILE_TYPE_NOT_ALLOWED;
-	}elseif(defined('CONFIG_UPLOAD_MAXSIZE') && CONFIG_UPLOAD_MAXSIZE && $upload->isSizeTooBig(CONFIG_UPLOAD_MAXSIZE))
+	elseif (defined('CONFIG_UPLOAD_MAXSIZE') && CONFIG_UPLOAD_MAXSIZE && $upload->isSizeTooBig(CONFIG_UPLOAD_MAXSIZE))	
-	{		
 		 $error = sprintf(ERROR_FILE_TOO_BID, transformFileSize(CONFIG_UPLOAD_MAXSIZE));
-	}else
+	elseif (!$upload->moveUploadedFile($_GET['folder']))
+		$error = ERR_FILE_MOVE_FAILED;
+	else
 	{
 							include_once(CLASS_FILE);
 							$path = $upload->getFilePath();

admin-dev/ajaxfilemanager/ajax_get_file_listing.php

@@ -24,7 +24,8 @@
 		if(!empty($_GET['search']))
 		{
 			include_once(CLASS_SEARCH);
-			
+			if (!preg_match('/^'.Tools::pRegexp(realpath(dirname(__FILE__).'/'.$_GET['search_folder']), '/').'/i', _PS_ROOT_DIR_.'/img/cms'))
+				exit;
 			$search  = new Search($_GET['search_folder']);
 			$search->addSearchKeyword('recursive', @$_GET['search_recursively']);
 			$search->addSearchKeyword('mtime_from', @$_GET['search_mtime_from']);

classes/Logger.php

@@ -62,7 +62,7 @@ class	LoggerCore extends ObjectModel
 		'fields' => array(
 			'severity' => 		array('type' => self::TYPE_INT, 'validate' => 'isInt', 'required' => true),
 			'error_code' => 	array('type' => self::TYPE_INT, 'validate' => 'isUnsignedInt'),
-			'message' => 		array('type' => self::TYPE_STRING, 'validate' => 'isMessage', 'required' => true),
+			'message' => 		array('type' => self::TYPE_STRING, 'validate' => 'isString', 'required' => true),
 			'object_id' => 		array('type' => self::TYPE_INT, 'validate' => 'isUnsignedInt'),
 			'id_employee' => 		array('type' => self::TYPE_INT, 'validate' => 'isUnsignedInt'),
 			'object_type' =>	array('type' => self::TYPE_STRING, 'validate' => 'isName'),

modules/blocksharefb/blocksharefb.php

@@ -19,7 +19,8 @@
 * needs please refer to http://www.prestashop.com for more information.
 *
 *  @author PrestaShop SA <contact@prestashop.com>
-*  @copyright  2007-2013 PrestaShop SA␍
+*  @copyright  2007-2013 PrestaShop SA
+
 *  @license    http://opensource.org/licenses/afl-3.0.php  Academic Free License (AFL 3.0)
 *  International Registered Trademark & Property of PrestaShop SA
 */
@@ -63,7 +64,7 @@ class blocksharefb extends Module
 
 		if (isset($id_product) && $id_product != '')
 		{		
-			$product_infos = new Product((int)$id_product, true, $cookie->id_lang);
+			$product_infos = $this->context->controller->getProduct();
 			$smarty->assign(array(
 				'product_link' => urlencode($link->getProductLink($product_infos)),
 				'product_title' => urlencode($product_infos->name),

modules/productcomments/productcomments.php

@@ -705,7 +705,7 @@ class ProductComments extends Module
 
 		$this->context->smarty->assign(array(
 			'id_product_comment_form' => (int)Tools::getValue('id_product'),
-			'product' => new Product((int)Tools::getValue('id_product'), false, $this->context->language->id),
+			'product' => $this->context->controller->getProduct(),
 			'secure_key' => $this->secure_key,
 			'logged' => (int)$this->context->customer->isLogged(true),
 			'allow_guests' => (int)Configuration::get('PRODUCT_COMMENTS_ALLOW_GUESTS'),