CVE-2020-12790

@@ -1,5 +1,16 @@
 # SEOmatic Changelog
 
+## 3.2.49 - 2020.03.24
+### Added
+* Aliases will now auto-suggest in the Site URL Override settings field
+* SEOmatic now will replace any stripped HTML tags with a space, so that the text is more readable
+
+### Fixed
+* The Site URL Override is now parsed for both aliases and environment variables
+
+### Security
+* Ensure that URLs are `urldecode`d before attempting to use a RegEx to strip tags from them
+
 ## 3.2.48 - 2020.03.18
 ### Added
 * Added batching to sitemap generation so that the memory used is fixed, and no longer dependent on how many sitemap entries are being processed

@@ -2,7 +2,7 @@
     "name": "nystudio107/craft-seomatic",
     "description": "SEOmatic facilitates modern SEO best practices & implementation for Craft CMS 3. It is a turnkey SEO system that is comprehensive, powerful, and flexible.",
     "type": "craft-plugin",
-    "version": "3.2.48",
+    "version": "3.2.49",
     "keywords": [
         "craft",
         "cms",

@@ -80,6 +80,7 @@ public static function sanitizeUrl(string $url, bool $checkStatus = true): strin
         $url = UrlHelper::stripQueryString($url);
         // HTML decode the entities, then strip out any tags
         $url = html_entity_decode($url, ENT_NOQUOTES, 'UTF-8');
+        $url = urldecode($url);
         $url = strip_tags($url);
 
         // If this is a >= 400 status code, set the canonical URL to nothing
@@ -647,6 +648,7 @@ public static function getLocalizedUrls(string $uri = null, int $siteId = null):
             $url = UrlHelper::absoluteUrlWithProtocol($url);
 
             $url = $url ?? '';
+            $url = self::sanitizeUrl($url);
             $language = $site->language;
             $ogLanguage = LocalizationHelper::normalizeOgLocaleLanguage($language);
             $hreflangLanguage = $language;

@@ -128,15 +128,30 @@ public static function extractTextFromField($field): string
             $result = self::extractTextFromTags($field);
         } else {
             if (\is_array($field)) {
-                $result = strip_tags((string)$field[0]);
+                $result = self::smartStripTags((string)$field[0]);
             } else {
-                $result = strip_tags((string)$field);
+                $result = self::smartStripTags((string)$field);
             }
         }
 
         return $result;
     }
 
+    /**
+     * Strip HTML tags, but replace them with a space rather than just eliminating them
+     *
+     * @param $str
+     * @return string
+     */
+    public static function smartStripTags($str)
+    {
+        $str = str_replace('<', ' <', $str);
+        $str = strip_tags($str);
+        $str = str_replace('  ', ' ', $str);
+
+        return $str;
+    }
+
     /**
      * Extract concatenated text from all of the tags in the $tagElement and
      * return as a comma-delimited string

@@ -39,6 +39,7 @@ public static function siteUrl(string $path = '', $params = null, string $scheme
     {
         $siteUrl = Seomatic::$settings->siteUrlOverride;
         if (!empty($siteUrl)) {
+            $siteUrl = MetaValue::parseString($siteUrl);
             return rtrim($siteUrl, '/').'/'.ltrim($path, '/');
         }
 

@@ -119,6 +119,7 @@
                 label: "Site URL Override"|t("seomatic"),
                 instructions: "SEOmatic uses the Craft `siteUrl` to generate the external URLs.  If you are using it in a non-standard environment, such as a headless GraphQL or ElementAPI server, you can override what it uses for the `siteUrl` below."|t("seomatic"),
                 suggestEnvVars: true,
+                suggestAliases: true,
                 id: "siteUrlOverride",
                 name: "siteUrlOverride",
                 value: settings.siteUrlOverride,