From e3a2640704421280dd2edfc7dd4a31bfc773d20d Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Fri, 28 Aug 2026 18:06:57 -0600 Subject: [PATCH] Fix endsWith. Closes #6904 --- app/Http/Controllers/AdminInviteController.php | 5 +++-- app/Http/Controllers/Api/ApiV1Dot1Controller.php | 8 +++++--- app/Http/Controllers/AppRegisterController.php | 2 +- app/Http/Controllers/CuratedRegisterController.php | 14 +++++++++----- app/Http/Controllers/RemoteAuthController.php | 5 +++-- app/Rules/PixelfedUsername.php | 3 ++- 6 files changed, 23 insertions(+), 14 deletions(-) diff --git a/app/Http/Controllers/AdminInviteController.php b/app/Http/Controllers/AdminInviteController.php index 5368f8192..8b25ff9de 100644 --- a/app/Http/Controllers/AdminInviteController.php +++ b/app/Http/Controllers/AdminInviteController.php @@ -14,6 +14,7 @@ use Illuminate\Http\Request; use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Hash; use Illuminate\Support\Facades\Validator; +use Illuminate\Support\Str; use Purify; class AdminInviteController extends Controller @@ -73,7 +74,7 @@ class AdminInviteController extends Controller $underscore = substr_count($value, '_'); $period = substr_count($value, '.'); - if (str_ends_with($value, ['.php', '.js', '.css'])) { + if (Str::endsWith($value, ['.php', '.js', '.css'])) { return $fail('Username is invalid.'); } @@ -161,7 +162,7 @@ class AdminInviteController extends Controller $underscore = substr_count($value, '_'); $period = substr_count($value, '.'); - if (str_ends_with($value, ['.php', '.js', '.css'])) { + if (Str::endsWith($value, ['.php', '.js', '.css'])) { return $fail('Username is invalid.'); } diff --git a/app/Http/Controllers/Api/ApiV1Dot1Controller.php b/app/Http/Controllers/Api/ApiV1Dot1Controller.php index a69cfa6db..ae2ab2c93 100644 --- a/app/Http/Controllers/Api/ApiV1Dot1Controller.php +++ b/app/Http/Controllers/Api/ApiV1Dot1Controller.php @@ -223,7 +223,8 @@ class ApiV1Dot1Controller extends Controller $avatar = $user->profile->avatar; - if ($avatar->media_path == 'public/avatars/default.png' || + if ( + $avatar->media_path == 'public/avatars/default.png' || $avatar->media_path == 'public/avatars/default.jpg' ) { return AccountService::get($user->profile_id); @@ -551,7 +552,7 @@ class ApiV1Dot1Controller extends Controller $underscore = substr_count($value, '_'); $period = substr_count($value, '.'); - if (str_ends_with($value, ['.php', '.js', '.css'])) { + if (Str::endsWith($value, ['.php', '.js', '.css'])) { return $fail('Username is invalid.'); } @@ -804,7 +805,8 @@ class ApiV1Dot1Controller extends Controller 'lat' => $place->lat, 'long' => $place->long, ], - 'posts' => $posts]; + 'posts' => $posts, + ]; } public function moderatePost(Request $request, $id) diff --git a/app/Http/Controllers/AppRegisterController.php b/app/Http/Controllers/AppRegisterController.php index fef9f6621..60b89ca67 100644 --- a/app/Http/Controllers/AppRegisterController.php +++ b/app/Http/Controllers/AppRegisterController.php @@ -308,7 +308,7 @@ class AppRegisterController extends Controller $underscore = substr_count($value, '_'); $period = substr_count($value, '.'); - if (str_ends_with($value, ['.php', '.js', '.css'])) { + if (Str::endsWith($value, ['.php', '.js', '.css'])) { return $fail('Username is invalid.'); } diff --git a/app/Http/Controllers/CuratedRegisterController.php b/app/Http/Controllers/CuratedRegisterController.php index f86526985..ed6b8d096 100644 --- a/app/Http/Controllers/CuratedRegisterController.php +++ b/app/Http/Controllers/CuratedRegisterController.php @@ -63,8 +63,10 @@ class CuratedRegisterController extends Controller $this->preCheck(true); abort_unless( $request->session()->has('cur-reg-con.email-confirmed') && - $request->session()->has('cur-reg-con.cr-id') && - $request->session()->has('cur-reg-con.ac-id'), 404); + $request->session()->has('cur-reg-con.cr-id') && + $request->session()->has('cur-reg-con.ac-id'), + 404 + ); $crid = $request->session()->get('cur-reg-con.cr-id'); $arid = $request->session()->get('cur-reg-con.ac-id'); $showCaptcha = config('instance.curated_registration.captcha_enabled'); @@ -85,8 +87,10 @@ class CuratedRegisterController extends Controller $request->session()->increment('cur-reg-con-attempt'); abort_unless( $request->session()->has('cur-reg-con.email-confirmed') && - $request->session()->has('cur-reg-con.cr-id') && - $request->session()->has('cur-reg-con.ac-id'), 404); + $request->session()->has('cur-reg-con.cr-id') && + $request->session()->has('cur-reg-con.ac-id'), + 404 + ); $attempts = $request->session()->get('cur-reg-con-attempt'); $messages = []; $rules = [ @@ -362,7 +366,7 @@ class CuratedRegisterController extends Controller $underscore = substr_count($value, '_'); $period = substr_count($value, '.'); - if (str_ends_with($value, ['.php', '.js', '.css'])) { + if (Str::endsWith($value, ['.php', '.js', '.css'])) { return $fail('Username is invalid.'); } diff --git a/app/Http/Controllers/RemoteAuthController.php b/app/Http/Controllers/RemoteAuthController.php index d65ccd320..e65e86637 100644 --- a/app/Http/Controllers/RemoteAuthController.php +++ b/app/Http/Controllers/RemoteAuthController.php @@ -66,7 +66,8 @@ class RemoteAuthController extends Controller return response()->json($res); } - if (config('remote-auth.mastodon.domains.custom') && + if ( + config('remote-auth.mastodon.domains.custom') && ! config('remote-auth.mastodon.domains.only_default') && strlen(config('remote-auth.mastodon.domains.custom')) > 3 && strpos(config('remote-auth.mastodon.domains.custom'), '.') > -1 @@ -472,7 +473,7 @@ class RemoteAuthController extends Controller $underscore = substr_count($value, '_'); $period = substr_count($value, '.'); - if (str_ends_with($value, ['.php', '.js', '.css'])) { + if (Str::endsWith($value, ['.php', '.js', '.css'])) { return $fail('Username is invalid.'); } diff --git a/app/Rules/PixelfedUsername.php b/app/Rules/PixelfedUsername.php index 0a4f37628..2575eeef3 100644 --- a/app/Rules/PixelfedUsername.php +++ b/app/Rules/PixelfedUsername.php @@ -5,6 +5,7 @@ namespace App\Rules; use App\Util\Lexer\RestrictedNames; use Closure; use Illuminate\Contracts\Validation\ValidationRule; +use Illuminate\Support\Str; use Illuminate\Translation\PotentiallyTranslatedString; class PixelfedUsername implements ValidationRule @@ -20,7 +21,7 @@ class PixelfedUsername implements ValidationRule $underscore = substr_count($value, '_'); $period = substr_count($value, '.'); - if (str_ends_with($value, ['.php', '.js', '.css'])) { + if (Str::endsWith($value, ['.php', '.js', '.css'])) { $fail('Username is invalid.'); return;