Skip to content

Commit 8b25f35

Browse files
Merge remote-tracking branch 'upstream/main' into main
2 parents 119f396 + ed27e28 commit 8b25f35

7 files changed

Lines changed: 38 additions & 121 deletions

File tree

.github/workflows/tests.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,16 @@ jobs:
2222
strategy:
2323
fail-fast: false
2424
matrix:
25-
php-version: ["7.1", "7.2", "7.3", "7.4", "8.0", "8.1", "8.2"]
25+
php-version: ["7.1", "7.2", "7.3", "7.4", "8.0", "8.1", "8.2", "8.3"]
2626
os: [ubuntu-latest]
2727
experimental: [false]
2828
php-extensions: ["bcmath, curl, imagick, gd"]
2929
coverage-extension: ["none"]
3030
# Add more specific tests
3131
include:
32-
#- { php-version: '8.2', experimental: false, os: macos-latest, php-extensions: 'bcmath, curl, imagick, gd', coverage-extension: 'none' }
33-
- { php-version: '8.3', experimental: false, os: windows-latest, php-extensions: 'bcmath, curl, imagick, gd', coverage-extension: 'none' }
34-
- { php-version: '8.3', experimental: false, os: ubuntu-latest, php-extensions: 'bcmath, curl, imagick, gd', coverage-extension: 'pcov' }
32+
#- { php-version: '8.2', experimental: false, os: macos-latest, php-extensions: 'bcmath, curl, imagick, gd', coverage-extension: 'none' }
33+
- { php-version: '8.2', experimental: false, os: windows-latest, php-extensions: 'bcmath, curl, imagick, gd', coverage-extension: 'none' }
34+
- { php-version: '8.4', experimental: true, os: ubuntu-latest, php-extensions: 'bcmath, curl, imagick, gd', coverage-extension: 'pcov' }
3535
- { php-version: 'nightly', experimental: true, os: ubuntu-latest, php-extensions: 'bcmath, curl, imagick, gd', coverage-extension: 'pcov' }
3636
env:
3737
PDFINFO_BINARY: ${{ (matrix.os == 'ubuntu-latest') && '/usr/bin/pdfinfo' || ((matrix.os == 'macos-latest') && '/usr/local/bin/pdfinfo' || 'C:\ProgramData\Chocolatey\bin\pdfinfo.exe') }}
@@ -113,4 +113,4 @@ jobs:
113113
- name: Install phpstan
114114
run: composer require --dev phpstan/phpstan
115115
- name: Analyse files
116-
run: ./vendor/bin/phpstan --memory-limit=6G
116+
run: ./vendor/bin/phpstan --memory-limit=6G

CHANGELOG.TXT

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
6.9.0 (2025-04-03)
2+
- Fixed Path Traversal security vulnerability reported by Positive Technologies.
3+
4+
6.9.0 (2025-03-30)
5+
- Added PHP 8.4 testing.
6+
- Removed tcpdf_import.php and tcpdf_parser.php files (for a parser check the tc-lib-pdf-parser project instead).
7+
- Fix composer.json.
8+
19
6.8.2 (2025-01-26)
210
- Fix some annotation flags values.
311
- Remove examples from packaging.

VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
6.8.2
1+
6.9.1

composer.json

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"barcodes"
1313
],
1414
"homepage": "http://www.tcpdf.org/",
15-
"version": "6.8.2-p1",
15+
"version": "6.9.1-p1",
1616
"license": "LGPL-3.0-or-later",
1717
"authors": [
1818
{
@@ -30,8 +30,6 @@
3030
"classmap": [
3131
"include",
3232
"tcpdf.php",
33-
"tcpdf_parser.php",
34-
"tcpdf_import.php",
3533
"tcpdf_barcodes_1d.php",
3634
"tcpdf_barcodes_2d.php",
3735
"include/tcpdf_colors.php",
@@ -50,5 +48,10 @@
5048
},
5149
"conflict": {
5250
"fooman/pdfcore-m2": "<22.0.0"
51+
},
52+
"archive": {
53+
"exclude": [
54+
"/examples"
55+
]
5356
}
5457
}

include/tcpdf_static.php

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ class TCPDF_STATIC {
5555
* Current TCPDF version.
5656
* @private static
5757
*/
58-
private static $tcpdf_version = '6.8.2-p1';
58+
private static $tcpdf_version = '6.9.1-p1';
5959

6060
/**
6161
* String alias for total number of pages.
@@ -2648,7 +2648,6 @@ public static function getPageMode($mode='UseNone') {
26482648
return $page_mode;
26492649
}
26502650

2651-
26522651
} // END OF TCPDF_STATIC CLASS
26532652

26542653
//============================================================+

tcpdf.php

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
<?php
22
//============================================================+
33
// File name : tcpdf.php
4-
// Version : 6.8.2
4+
// Version : 6.9.1
55
// Begin : 2002-08-03
6-
// Last Update : 2024-12-23
6+
// Last Update : 2025-04-03
77
// Author : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - info@tecnick.com
88
// License : GNU-LGPL v3 (http://www.gnu.org/copyleft/lesser.html)
99
// -------------------------------------------------------------------
@@ -104,7 +104,7 @@
104104
* Tools to encode your unicode fonts are on fonts/utils directory.</p>
105105
* @package com.tecnick.tcpdf
106106
* @author Nicola Asuni
107-
* @version 6.8.2
107+
* @version 6.9.1
108108
*/
109109

110110
// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
@@ -115,7 +115,7 @@
115115
* TCPDF project (http://www.tcpdf.org) has been originally derived in 2002 from the Public Domain FPDF class by Olivier Plathey (http://www.fpdf.org), but now is almost entirely rewritten.<br>
116116
* @package com.tecnick.tcpdf
117117
* @brief PHP class for generating PDF documents without requiring external extensions.
118-
* @version 6.8.2
118+
* @version 6.9.1
119119
* @author Nicola Asuni - info@tecnick.com
120120
* @IgnoreAnnotation("protected")
121121
* @IgnoreAnnotation("public")
@@ -18922,6 +18922,17 @@ public function writeHTML($html, $ln=true, $fill=false, $reseth=false, $cell=fal
1892218922
unset($dom);
1892318923
}
1892418924

18925+
/**
18926+
* Check if the path is relative.
18927+
* @param string $path path to check
18928+
* @return boolean true if the path is relative
18929+
* @protected
18930+
* @since 6.9.1
18931+
*/
18932+
protected function isRelativePath($path) {
18933+
return (strpos(str_ireplace('%2E', '.', $this->unhtmlentities($path)), '..') !== false);
18934+
}
18935+
1892518936
/**
1892618937
* Process opening tags.
1892718938
* @param array $dom html dom array
@@ -19114,7 +19125,7 @@ protected function openHTMLTagHandler($dom, $key, $cell) {
1911419125
} else if (preg_match('@^data:image/([^;]*);base64,(.*)@', $imgsrc, $reg)) {
1911519126
$imgsrc = '@'.base64_decode($reg[2]);
1911619127
$type = $reg[1];
19117-
} elseif (strpos($imgsrc, '../') !== false) {
19128+
} elseif ($this->isRelativePath($imgsrc)) {
1911819129
// accessing parent folders is not allowed
1911919130
break;
1912019131
} elseif ( $this->allowLocalFiles && substr($imgsrc, 0, 7) === 'file://') {
@@ -24523,7 +24534,7 @@ protected function startSVGElementHandler($parser, $name, $attribs, $ctm=array()
2452324534
$img = '@'.base64_decode(substr($img, strlen($m[0])));
2452424535
} else {
2452524536
// fix image path
24526-
if (strpos($img, '../') !== false) {
24537+
if ($this->isRelativePath($img)) {
2452724538
// accessing parent folders is not allowed
2452824539
break;
2452924540
}

tcpdf_import.php

Lines changed: 0 additions & 104 deletions
This file was deleted.

0 commit comments

Comments
 (0)