Commit Graph

4736 Commits

Author SHA1 Message Date
Adrien Crivelli bea2d4b30f Security: prevent XXE (XML External Entity) when loading files
Prevent XEE by hiding custom entities by using single quote to
declare a non-UTF-8 encoding.

XML standard, https://www.w3.org/TR/xml/#NT-EncodingDecl, allows single
quote to declare encoding, but we did not support it. Instead, we
incorrectly fell back on the default of UTF-8. That incorrectly kept the
XML as non-UTF-8, and thus prevented our regexp-based custom entity
detection mechanism to work.
2024-07-29 16:22:43 +09:00
oleibman b43947f4c9 Merge pull request #4101 from oleibman/issue4099
Ods Reader Allow Omission of Some Page Settings Tags
2024-07-27 14:51:24 +00:00
oleibman debb1776ef Update CHANGELOG.md 2024-07-27 07:48:40 -07:00
oleibman ab5965affb Merge branch 'master' into issue4099 2024-07-27 07:36:13 -07:00
oleibman 8225096c6f Merge pull request #4098 from oleibman/issue912
Xlsx Reader and Print/Show Gridlines
2024-07-27 14:27:18 +00:00
oleibman bf0281be34 Merge pull request #4096 from oleibman/issue296
Reference to Defined Name Specifying Worksheet Name
2024-07-27 14:25:50 +00:00
oleibman 64b02b0bc1 Merge pull request #4114 from oleibman/issue4112
Addsheet May Leave Active Sheet Uninitialized
2024-07-27 06:27:53 +00:00
oleibman 459f442b9e Additional Test
New test testGifIssue4112 uses the same technique as reported in the original issue, and it would fail on all PhpSpreadsheet releases, not just 2.2.0.
2024-07-26 11:52:35 -07:00
oleibman 1df4b17d55 Scrutinizer Found a Real Problem
My test was imperfect,and Scrutinizer detected it.
2024-07-26 08:53:00 -07:00
oleibman 762d73daf5 Addsheet May Leave Active Sheet Uninitialized
Fix #4112. Direct cause is that `applyStylesFromArray` tries to save and restore `activeSheetIndex`. However, if activeSheetIndex is -1, indicating no active sheet, the restore should not be attempted. Code is changed to test before attempting to restore.

The actual problem, however, is that user specified a sheet number for `addSheet`. That method will set activeSheetIndex most of the time, but this was a gap - when the supplied sheet number (0 in this case) is greater than activeSheetIndex (-1 in this case), it was leaving activeSheetIndex as -1. It is changed to set activeSheetIndex to 0 when activeSheetIndex is negative.
2024-07-26 08:30:52 -07:00
oleibman b406367425 Merge pull request #4110 from oleibman/changelog300prep
Prepare Changelog For Next Release
2024-07-24 14:13:04 +00:00
oleibman b86629ff58 Prepare Changelog For Next Release 2024-07-24 07:08:44 -07:00
oleibman b0993b7e4d Merge pull request #4109 from oleibman/changelog220
Changelog Prep for 2.2.0
2.2.0
2024-07-24 13:21:18 +00:00
oleibman 10823ee00a Changelog Prep for 2.2.0 2024-07-24 01:15:11 -07:00
oleibman 2952cf5526 Ods Reader Allow Omission of Some Page Settings Tags
Fix #4099. Ods Reader was expecting there to always be `header-style` and `footer-style` tags when `page-layout` tag is present, but these need not exist. It seemed like there might be other exposures along this line in `readPageSettingStyles`; rather than waiting for a problem report to show up for each, the code is updated to use `->item(0)` in place of `[0]` when appropriate, and make use of the nullsafe `?->` operator introduced with Php8.
2024-07-18 13:30:58 -07:00
oleibman fcf03b95bf Merge pull request #4094 from oleibman/issue476
Xlsx Writer Rich Text and TYPE_STRING
2024-07-18 00:45:06 +00:00
oleibman 73eeba0f1b Merge branch 'master' into issue476 2024-07-17 17:42:28 -07:00
oleibman d76481f668 Update CHANGELOG.md 2024-07-17 17:41:14 -07:00
oleibman f4ef625fdb Merge pull request #4093 from oleibman/issue460
Ods Boolean Data
2024-07-17 23:29:35 +00:00
oleibman f632732564 Scrutinizer Busy Work 2024-07-17 10:45:56 -07:00
oleibman 2a0090b915 Xlsx Reader and Print/Show Gridlines
Fix #912, opened in Feb. 2019, and closed as stale in Apr. 2019, and which I have re-opened to be closed properly by this PR. Another "better late than never". Original issue says that print options should not affect ShowGridlines, which seems true enough. Aside from that, the existing code isn't quite correct anyhow. Excel looks for 2 attributes, one of which must be explicitly set to true and the other of which must not be explicitly set to false, in order to determine whether PrintGridlines should be set. PhpSpreadsheet is changed to do the same. This could be treated as a BC break for the unusual situation described in the issue, but it seems more like a bug fix to me.
2024-07-17 09:28:35 -07:00
oleibman 1c333d1f3d Reference to Defined Name Specifying Worksheet Name
Fix #296, another entry in our magical history tour (closed as stale in 2018). Excel allows you to use a name defined on another worksheet by prefixing the sheet name, even when the scope of the defined name is its worksheet rather than the entire workbook.
2024-07-15 22:17:09 -07:00
oleibman 88908a8a03 Merge pull request #4089 from oleibman/issue1515minor
Html Writer Minor Fixes
2024-07-12 16:31:53 +00:00
oleibman 6c1a2e5695 Merge branch 'master' into issue1515minor 2024-07-12 09:29:15 -07:00
oleibman ed677fe6e9 Update CHANGELOG.md 2024-07-12 09:28:23 -07:00
oleibman c196847841 Merge pull request #4088 from oleibman/issue64
Changes to INDEX Function
2024-07-12 03:42:58 +00:00
oleibman 59dfd1f20d Merge branch 'master' into issue64 2024-07-11 20:39:49 -07:00
oleibman 9652ffe73a Update CHANGELOG.md 2024-07-11 20:38:22 -07:00
oleibman 6ab27d2931 Xlsx Writer Rich Text and TYPE_STRING
Fix #476. Another in the "better late than never" series, closed as stale in June 2018. Xlsx Writer expects cells containing RichText to have DataType `TYPE_INLINE`; but the spreadsheet associated with the issue has the cell defined as `TYPE_STRING`. Change Writer to handle RichText TYPE_STRING appropriately.
2024-07-11 20:05:16 -07:00
oleibman 18e3c00e40 Performance Improvements for Csv Reader
Fix #460. Another in the "better late than never" series, closed as stale in June 2018. Ods Writer and Ods Reader handle booleans differently; what is worse, neither of them do it correctly. They will now match the behavior of LibreOffice. Reporter said that part of the xml would vary depending on locale; I believe that part is never actually used, but I do emulate that behavior.
2024-07-11 19:48:12 -07:00
oleibman 6c1b00b6f9 Merge pull request #4087 from oleibman/issue804
Ods Xml Reader and Whitespace Text Nodes
2024-07-11 03:17:28 +00:00
oleibman 2c150d5381 Merge branch 'master' into issue804 2024-07-10 20:14:46 -07:00
oleibman f6f155263c Update CHANGELOG.md 2024-07-10 20:13:50 -07:00
oleibman ca41de3b23 Merge pull request #4086 from oleibman/issue4081
Ods Comments With Newlines
2024-07-07 14:32:24 +00:00
oleibman 96f09441ca Merge branch 'master' into issue4081 2024-07-07 07:27:49 -07:00
oleibman 81964f991a Update CHANGELOG.md 2024-07-07 07:26:18 -07:00
oleibman f6823c79e8 More Doc Updates 2024-07-06 20:26:15 -07:00
oleibman 7e3afabba8 Formatting errors 2024-07-06 20:24:43 -07:00
oleibman 3fee2c02e3 Wrong Case in File Name 2024-07-06 20:15:19 -07:00
oleibman 10123c441b Html Writer Minor Fixes
While researching issue #1551, I came across some minor problems.

When a spreadsheet does not have a title, which is often the case for spreadsheets created with Excel (note that this is not the case for spreadsheets created with PhpSpreadsheet), if you try to save it as Html, it throws an exception. It will now use the sheet title of the active sheet as a title in this case.

When writing an Html spreadsheet using `useInlineCss(true)`, gridlines are not handled properly. This is addressed by adding `class=gridlines gridlinesp` to the cell's `td` tag, and by suppressing any border attributes which would be styled as `none #000000`. It would be unusual to turn off gridlines for specific cells, but that can still be accomplished by using `Border::BORDER_NONE` in conjunction with any color other than `#000000` - see new test `testHideSomeGridlines`.
2024-07-06 19:58:19 -07:00
oleibman 6d2d99a5b3 Merge pull request #4080 from oleibman/issue2581
Propagate Errors in Text Functions
2024-07-06 05:51:35 +00:00
oleibman 22bac3eb49 Merge branch 'master' into issue2581 2024-07-05 22:48:45 -07:00
oleibman 61b8aff359 Update CHANGELOG.md 2024-07-05 22:46:55 -07:00
oleibman 06737c1f96 Merge pull request #4073 from oleibman/issue1310
Change Style Without Affecting Current Cell/Sheet, and Invalid Formulas
2024-07-06 05:34:16 +00:00
oleibman 2a7cbaba1d Merge branch 'master' into issue1310 2024-07-05 22:22:01 -07:00
oleibman b8715a5d8a Update CHANGELOG.md 2024-07-05 22:20:57 -07:00
oleibman 070ceef5d0 Changes to INDEX Function
Fix #64 (really!), closed as stale in December 2017, another in our "better late than never" series. Excel's INDEX function doesn't really behave quite as described. If a single row is used as an argument, either in literal form `{item1, item2, item3}` or expressed as a range `A1:A6`, INDEX is happy to evaluate the array as if each entry were a row rather than a single item. PhpSpreadsheet is changed to do likewise.

INDEX also returned `#REF!` when it would normally return an array (which would often be reduced to its leftmost topmost entry later). This code is deleted, invalidating one existing test, and INDEX will now operate like other functions which can return arrays.
2024-07-05 20:57:43 -07:00
oleibman 2897c4de33 Missed One Doc Change 2024-07-04 20:18:25 -07:00
oleibman 7d8bec828b Documentation Updates
Mostly in response to issue #3961, which noted some discrepancies, both positive and negative, between documentation and reality concerning ODS support.
2024-07-04 20:06:17 -07:00
oleibman 1d86675e04 Ods Xml Reader and Whitespace Text Nodes
Fix #804, opened in Dec. 2018, and closed as stale in Feb. 2019, and which I have re-opened to be closed properly by this PR. Better late than never, I suppose. A third party generated an ODS spreadsheet which PhpSpreadsheet could not read. By way of explanation, the xml in the file contained lots of whitespace between tags, which is wonderful for those humans among us who have to analyze it; but PhpSpreadsheet was not prepared for it. It is now.
2024-07-03 19:56:38 -07:00