Browse Source

[svn r20607] add remove_XSS in forum see FS#4169

Carlos Vargas 16 years ago
parent
commit
064bad1da6
2 changed files with 34 additions and 36 deletions
  1. 3 2
      main/forum/editpost.php
  2. 31 34
      main/forum/forumfunction.inc.php

+ 3 - 2
main/forum/editpost.php

@@ -255,11 +255,12 @@ echo '</table>';
 
 // the form for the reply
 $values=show_edit_post_form($current_post, $current_thread, $current_forum, isset($_SESSION['formelements'])?$_SESSION['formelements']:'');
+
 if (!empty($values) and isset($_POST['SubmitPost'])) {
 	store_edit_post($values);
 
 	$option_chek=isset($values['thread_qualify_gradebook'])?$values['thread_qualify_gradebook']:null;// values 1 or 0
-		if ( 1== $option_chek ) {
+	if ( 1== $option_chek ) {
 			$id=$values['thread_id'];
 			$title_gradebook=$values['calification_notebook_title'];
 			$value_calification=$values['numeric_calification'];
@@ -267,7 +268,7 @@ if (!empty($values) and isset($_POST['SubmitPost'])) {
 			$description="";
 			$session_id=api_get_session_id();
 			$link_id=is_resource_in_course_gradebook(api_get_course_id(),5,$id,$session_id);
-			if ( $link_id==false ) {
+			if ($link_id==false) {
 				add_resource_to_course_gradebook(api_get_course_id(), 5, $id, $title_gradebook,$weight_calification,$value_calification,$description,time(),1,api_get_session_id());	
 			} else {
 				api_sql_query('UPDATE '.$table_link.' SET weight='.$weight_calification.' WHERE id='.$link_id.'');

+ 31 - 34
main/forum/forumfunction.inc.php

@@ -158,9 +158,9 @@ function show_add_forumcategory_form($inputvalues=array()) {
 	// settting the form elements
 	$form->addElement('header', '', get_lang('AddForumCategory'));
 	$form->addElement('text', 'forum_category_title', get_lang('Title'),'class="input_titles"');	
-	$form->applyFilter('forum_category_title', 'html_filter');	
+	//$form->applyFilter('forum_category_title', 'html_filter');	
 	$form->addElement('html_editor', 'forum_category_comment', get_lang('Comment'));
-	$form->applyFilter('forum_category_comment', 'html_filter');	
+	//$form->applyFilter('forum_category_comment', 'html_filter');	
 	$form->addElement('style_submit_button', 'SubmitForumCategory', get_lang('CreateCategory'), 'class="add"');
 
 	// setting the rules
@@ -197,12 +197,9 @@ function show_add_forum_form($inputvalues=array()) {
 	$form = new FormValidator('forumcategory', 'post', 'index.php?gradebook='.$gradebook.'');
 
 	// the header for the form
-	if (!empty($inputvalues))
-	{
+	if (!empty($inputvalues)) {
 		$form_title = get_lang('EditForum');
-	}
-	else 
-	{
+	} else {
 		$form_title = get_lang('AddForum');
 	}
 	$session_header = isset($_SESSION['session_name']) ? ' ('.$_SESSION['session_name'].') ' : '';
@@ -215,10 +212,10 @@ function show_add_forum_form($inputvalues=array()) {
 	}
 	// The title of the forum
 	$form->addElement('text', 'forum_title', get_lang('Title'),'class="input_titles"');
-	$form->applyFilter('forum_title', 'html_filter');
+	//$form->applyFilter('forum_title', 'html_filter');
 	// The comment of the forum
 	$form->addElement('html_editor', 'forum_comment', get_lang('Comment'));
-	$form->applyFilter('forum_comment', 'html_filter');
+	//$form->applyFilter('forum_comment', 'html_filter');
 	// dropdown list: Forum Categories
 	$forum_categories=get_forum_categories();
 	foreach ($forum_categories as $key=>$value) {
@@ -394,7 +391,7 @@ function show_add_forum_form($inputvalues=array()) {
 	if( $form->validate() ) {
 		$check = Security::check_token('post');	
 		if ($check) {
-			$values = $form->exportValues();
+			$values = $form->exportValues();		
 	   		$return_message = store_forum($values);
 	   		Display :: display_confirmation_message($return_message);
 		}
@@ -455,9 +452,9 @@ function show_edit_forumcategory_form($inputvalues=array()) {
 	$form->addElement('header', '', get_lang('EditForumCategory'));
 	$form->addElement('hidden', 'forum_category_id');
 	$form->addElement('text', 'forum_category_title', get_lang('Title'),'class="input_titles"');
-	$form->applyFilter('forum_category_title', 'html_filter');
+	//$form->applyFilter('forum_category_title', 'html_filter');
 	$form->addElement('html_editor', 'forum_category_comment', get_lang('Comment'));
-	$form->applyFilter('forum_category_comment', 'html_filter');	
+	//$form->applyFilter('forum_category_comment', 'html_filter');	
 	$form->addElement('style_submit_button', 'SubmitEditForumCategory',get_lang('ModifyCategory'), 'class="save"');
 	global $charset;
 	// setting the default values
@@ -508,16 +505,16 @@ function store_forumcategory($values) {
 	$row=Database::fetch_array($result);
 	$new_max=$row['sort_max']+1;
 	
-	$clean_cat_title=Security::remove_XSS(Database::escape_string($values['forum_category_title']));
+	$clean_cat_title=Database::escape_string(Security::remove_XSS($values['forum_category_title']));
 
 	if (isset($values['forum_category_id'])) { // storing an edit
-		$sql="UPDATE ".$table_categories." SET cat_title='".$clean_cat_title."', cat_comment='".Database::escape_string($values['forum_category_comment'])."' WHERE cat_id='".Database::escape_string($values['forum_category_id'])."'";
+		$sql="UPDATE ".$table_categories." SET cat_title='".$clean_cat_title."', cat_comment='".Database::escape_string(Security::remove_XSS(stripslashes(api_html_entity_decode($values['forum_category_comment'])),COURSEMANAGER))."' WHERE cat_id='".Database::escape_string($values['forum_category_id'])."'";
 		api_sql_query($sql,__FILE__,__LINE__);
 		$last_id=Database::get_last_insert_id();
 		api_item_property_update($_course, TOOL_FORUM_CATEGORY, $values['forum_category_id'],"ForumCategoryAdded", api_get_user_id());
 		$return_message=get_lang('ForumCategoryEdited');
 	} else {
-		$sql="INSERT INTO ".$table_categories." (cat_title, cat_comment, cat_order) VALUES ('".$clean_cat_title."','".Database::escape_string($values['forum_category_comment'])."','".Database::escape_string($new_max)."')";
+		$sql="INSERT INTO ".$table_categories." (cat_title, cat_comment, cat_order) VALUES ('".$clean_cat_title."','".Database::escape_string(Security::remove_XSS(stripslashes(api_html_entity_decode($values['forum_category_comment'])),COURSEMANAGER))."','".Database::escape_string($new_max)."')";
 		api_sql_query($sql,__FILE__,__LINE__);
 		$last_id=Database::get_last_insert_id();
 		api_item_property_update($_course, TOOL_FORUM_CATEGORY, $last_id,"ForumCategoryAdded", api_get_user_id());
@@ -555,7 +552,7 @@ function store_forum($values) {
 	
 	$session_id = isset($_SESSION['id_session']) ? $_SESSION['id_session'] : 0;
 	
-	$clean_title=Security::remove_XSS(Database::escape_string(htmlspecialchars($values['forum_title'])));
+	$clean_title=Database::escape_string(Security::remove_XSS($values['forum_title']));
 
 	// forum images
 	
@@ -615,7 +612,7 @@ function store_forum($values) {
 		$sql="UPDATE ".$table_forums." SET
 				forum_title='".$clean_title."',
 				".$sql_image."		
-				forum_comment='".Database::escape_string($values['forum_comment'])."',
+				forum_comment='".Database::escape_string(Security::remove_XSS(stripslashes(api_html_entity_decode($values['forum_comment'])),COURSEMANAGER))."',
 				forum_category='".Database::escape_string($values['forum_category'])."',
 				allow_anonymous='".Database::escape_string(isset($values['allow_anonymous_group']['allow_anonymous'])?$values['allow_anonymous_group']['allow_anonymous']:null)."',
 				allow_edit='".Database::escape_string($values['students_can_edit_group']['students_can_edit'])."',
@@ -634,12 +631,13 @@ function store_forum($values) {
 			$new_file_name=isset($new_file_name)?$new_file_name:'';
 			$sql_image="'".$new_file_name."', ";
 		}
-			
+$b=$values['forum_comment'];
+
 		$sql="INSERT INTO ".$table_forums."
 			(forum_title, forum_image, forum_comment, forum_category, allow_anonymous, allow_edit, approval_direct_post, allow_attachments, allow_new_threads, default_view, forum_of_group, forum_group_public_private, forum_order, session_id)
-			VALUES ('".$clean_title."',
+			VALUES ('".Security::remove_XSS($clean_title)."',
 				".$sql_image."	
-				'".Database::escape_string(isset($values['forum_comment'])?$values['forum_comment']:null)."',
+				'".Database::escape_string(isset($values['forum_comment'])?Security::remove_XSS(stripslashes(api_html_entity_decode($values['forum_comment'])),COURSEMANAGER):null)."',
 				'".Database::escape_string(isset($values['forum_category'])?$values['forum_category']:null)."',
 				'".Database::escape_string(isset($values['allow_anonymous_group']['allow_anonymous'])?$values['allow_anonymous_group']['allow_anonymous']:null)."',
 				'".Database::escape_string(isset($values['students_can_edit_group']['students_can_edit'])?$values['students_can_edit_group']['students_can_edit']:null)."',
@@ -1753,7 +1751,7 @@ function store_thread($values) {
 			$visible=1;
 		}
 		
-		$clean_post_title=Security::remove_XSS(Database::escape_string(htmlspecialchars($values['post_title'])));
+		$clean_post_title=Database::escape_string(Security::remove_XSS($values['post_title']));
 		
 		// We first store an entry in the forum_thread table because the thread_id is used in the forum_post table
 		$sql="INSERT INTO $table_threads (thread_title, forum_id, thread_poster_id, thread_poster_name, thread_date, thread_sticky,thread_title_qualify,thread_qualify_max,thread_weight,session_id)
@@ -1800,7 +1798,7 @@ function store_thread($values) {
 		// We now store the content in the table_post table
 		$sql="INSERT INTO $table_posts (post_title, post_text, thread_id, forum_id, poster_id, poster_name, post_date, post_notification, post_parent_id, visible)
 				VALUES ('".$clean_post_title."',
-				'".Database::escape_string($values['post_text'])."',
+				'".Database::escape_string(Security::remove_XSS(stripslashes(api_html_entity_decode($values['post_text'])),COURSEMANAGER))."',
 				'".Database::escape_string($last_thread_id)."',
 				'".Database::escape_string($values['forum_id'])."',
 				'".Database::escape_string($_user['user_id'])."',
@@ -1921,9 +1919,9 @@ function show_add_post_form($action='', $id='', $form_values='') {
 	}
 
 	$form->addElement('text', 'post_title', get_lang('Title'),'class="input_titles"');
-	$form->applyFilter('post_title', 'html_filter');	
+	//$form->applyFilter('post_title', 'html_filter');	
 	$form->addElement('html_editor', 'post_text', get_lang('Text'));
-	$form->applyFilter('post_text', 'html_filter');	
+	//$form->applyFilter('post_text', 'html_filter');	
 	
 	$form->addElement('html', '<div class="row"><div class="label"></div><div class="formw">');
 	$form->addElement('html','<a href="javascript://" onclick="return advanced_parameters()"><span id="img_plus_and_minus"><img src="../img/div_show.gif" alt="" /> '.get_lang('AdvancedParameters').'</span></a>','');
@@ -2237,8 +2235,8 @@ function store_reply($values) {
 	if ($upload_ok) {
 		// We first store an entry in the forum_post table
 		$sql="INSERT INTO $table_posts (post_title, post_text, thread_id, forum_id, poster_id, post_date, post_notification, post_parent_id, visible)
-				VALUES ('".Database::escape_string($values['post_title'])."',
-						'".Database::escape_string(isset($values['post_text']) ? $values['post_text'] : null)."',
+				VALUES ('".Database::escape_string(Security::remove_XSS($values['post_title']))."',
+						'".Database::escape_string(isset($values['post_text']) ? Security::remove_XSS(stripslashes(api_html_entity_decode($values['post_text'])),COURSEMANAGER) : null)."',
 						'".Database::escape_string($values['thread_id'])."',
 						'".Database::escape_string($values['forum_id'])."',
 						'".Database::escape_string($_user['user_id'])."',
@@ -2352,7 +2350,7 @@ function show_edit_post_form($current_post, $current_thread, $current_forum, $fo
 	$form->addElement('text', 'post_title', get_lang('Title'),'class="input_titles"');	
 	$form->applyFilter('post_title', 'html_filter');
 	$form->addElement('html_editor', 'post_text', get_lang('Text'));
-	$form->applyFilter('post_text', 'html_filter');	
+	//$form->applyFilter('post_text', 'html_filter');	
 		
 	$form->addElement('html', '<div class="row"><div class="label"></div><div class="formw">');
 	$form->addElement('HTML','<a href="javascript://" onclick="return advanced_parameters()"><span id="img_plus_and_minus"><img src="../img/div_show.gif" alt="" />'.get_lang('AdvancedParameters').'</span></a>','');
@@ -2420,8 +2418,8 @@ function show_edit_post_form($current_post, $current_thread, $current_forum, $fo
 	}
 
 	if (!empty($form_values)) {
-		$defaults['post_title']=Security::remove_XSS($form_values['post_title']);
-		$defaults['post_text']=Security::remove_XSS($form_values['post_text']);
+		//$defaults['post_title']=Security::remove_XSS($form_values['post_title']);
+		//$defaults['post_text']=Security::remove_XSS($form_values['post_text']);
 		$defaults['post_notification']=Security::remove_XSS($form_values['post_notification']);
 		$defaults['thread_sticky']=Security::remove_XSS($form_values['thread_sticky']);
 	}
@@ -2470,10 +2468,9 @@ function store_edit_post($values) {
 		
 		api_sql_query($sql,__FILE__, __LINE__);
 	//}
-
 	// update the post_title and the post_text
-	$sql="UPDATE $table_posts SET post_title='".Database::escape_string($values['post_title'])."',
-				post_text='".Database::escape_string($values['post_text'])."',
+	$sql="UPDATE $table_posts SET post_title='".Database::escape_string(Security::remove_XSS($values['post_title']))."',
+				post_text='".Database::escape_string(Security::remove_XSS(stripslashes(api_html_entity_decode($values['post_text'])),COURSEMANAGER))."',
 				post_notification='".Database::escape_string(isset($values['post_notification'])?$values['post_notification']:null)."'
 				WHERE post_id='".Database::escape_string($values['post_id'])."'";
 				//error_log($sql);
@@ -3165,11 +3162,11 @@ function prepare4display($input='') {
 			}
 			$counter = 0;
 			foreach ($search_terms as $key=>$search_term) {
-				$input = str_replace(trim(html_entity_decode($search_term)),'<span style="background-color: '.$highlightcolors[$counter].'">'.trim(html_entity_decode($search_term)).'</span>',$input);
+				$input = str_replace(trim(api_html_entity_decode($search_term)),'<span style="background-color: '.$highlightcolors[$counter].'">'.trim(html_entity_decode($search_term)).'</span>',$input);
 				$counter++;
 			}
 		}
-		return html_entity_decode(stripslashes($input));
+		return api_html_entity_decode(stripslashes($input));
 	} else {
 		/*foreach ($input as $key=>$value)
 		{