In the method match() a variable is executed as function:
/**
* Determines whether we get a keyword filter match.
*/
protected function match($match_func, $field, array $word_list) {
foreach ($word_list as $word) {
if ($match_func == "matchRegex") {
if ($this->$match_func($field, $word) !== FALSE) {
return TRUE;
}
}
elseif ($match_func($field, $word) !== FALSE) {
return TRUE;
}
}
return FALSE;
}
I'm not sure, but I think this could be a security issue. The function to call can be changed in the config YML file:
34cc0f9f-516e-4f63-8dd5-8e204bc7bc4b:
words: ''
word_boundaries: false
exact: false
case_sensitive: false
invert: false
word_list:
- ''
regex: false
function: mb_stripos
plugin: keyword_filter
source: titel
weight: 1
label: 'Keyword filter'
uuid: 34cc0f9f-516e-4f63-8dd5-8e204bc7bc4b
See function: mb_stripos
Looking at the code, I think there's no need to save the function to call. The function to call is now determined in ::validateConfigurationForm():
$setting_function = 'matchRegex';
...
elseif (!$word_boundaries && $case_sensitive) {
$setting_function = $is_multibyte ? 'mb_strpos' : 'strpos';
}
elseif (!$word_boundaries && !$case_sensitive) {
$setting_function = $is_multibyte ? 'mb_stripos' : 'stripos';
}
I think this check can also be done in ::tamper().
Remove the configuration for "function" and determine which function to call in ::tamper().
Perhaps a switch statement can be used in ::tamper()? Something like this:
switch (TRUE) {
case !$word_boundaries && $case_sensitive && $is_multibyte:
if (mb_strpos($field, $word) !== FALSE) {
return TRUE;
}
break;
}
::validateConfigurationForm()::tamper()Other issues for this plugin:
#3184133: Warning: mb_stripos(): Empty delimiter in Drupal\tamper\Plugin\Tamper\KeywordFilter->match() (line 234 of /var/www/html/modules/tamper/src/Plugin/Tamper/KeywordFilter.php) →
#3184182: Keyword filter: place plugin in "filter" category →
Active
1.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Issue #3184186 by megachriz: Keyword filter: removed settings 'regex'...
Automatically closed - issue fixed for 2 weeks with no activity.