浏览代码

Adding addslashes to launch_data key see #6681

Julio Montoya 11 年之前
父节点
当前提交
312e281986
共有 2 个文件被更改,包括 8 次插入5 次删除
  1. 6 3
      main/newscorm/scorm.class.php
  2. 2 2
      main/newscorm/scorm_api.php

+ 6 - 3
main/newscorm/scorm.class.php

@@ -400,12 +400,13 @@ class scorm extends learnpath
 
                 $prereq = Database::escape_string($item['prerequisites']);
                 $item['datafromlms'] = Database::escape_string($item['datafromlms']);
+                $item['parameters'] = Database::escape_string($item['parameters']);
 
-                $sql_item = "INSERT INTO $new_lp_item (c_id, lp_id,item_type,ref,title, path,min_score,max_score, $field_add parent_item_id,previous_item_id,next_item_id, prerequisite,display_order,launch_data, parameters)
+                $sql = "INSERT INTO $new_lp_item (c_id, lp_id,item_type,ref,title, path,min_score,max_score, $field_add parent_item_id,previous_item_id,next_item_id, prerequisite,display_order,launch_data, parameters)
                         VALUES ($course_id, $lp_id, '$type', '$identifier', '$title', '$path' , 0, $max_score, $value_add $parent, $previous, 0, '$prereq', ".$item['rel_order'] .", '".$item['datafromlms']."', '".$item['parameters']."' )";
 
-                Database::query($sql_item);
-                if ($this->debug > 1) { error_log('New LP - In import_manifest(), inserting item : '.$sql_item.' : '.Database::error(), 0); }
+                Database::query($sql);
+                if ($this->debug > 1) { error_log('New LP - In import_manifest(), inserting item : '.$sql.' : '.Database::error(), 0); }
                 $item_id = Database::insert_id();
                 // Now update previous item to change next_item_id.
                 $upd = "UPDATE $new_lp_item SET next_item_id = $item_id WHERE c_id = $course_id AND id = $previous";
@@ -529,10 +530,12 @@ class scorm extends learnpath
         $manifest_list = array();
 
         // The following loop should be stopped as soon as we found the right imsmanifest.xml (how to recognize it?).
+        $realFileSize = 0;
         foreach ($zipContentArray as $thisContent) {
             $thisContent['filename'];
             //error_log('Looking at  '.$thisContent['filename'], 0);
             if (preg_match('~.(php.*|phtml)$~i', $thisContent['filename'])) {
+                $file = $thisContent['filename'];
                 $this->set_error_msg("File $file contains a PHP script");
                 //return api_failure::set_failure('php_file_in_zip_file');
             } elseif (stristr($thisContent['filename'], 'imsmanifest.xml')) {

+ 2 - 2
main/newscorm/scorm_api.php

@@ -154,7 +154,7 @@ olms.suspend_data = '<?php echo $oItem->get_suspend_data();?>';
 olms.lesson_location = '<?php echo $oItem->get_lesson_location();?>';
 olms.total_time = '<?php echo $oItem->get_scorm_time('js');?>';
 olms.mastery_score = '<?php echo $oItem->get_mastery_score();?>';
-olms.launch_data = '<?php echo $oItem->get_launch_data();?>';
+olms.launch_data = '<?php echo addslashes($oItem->get_launch_data()); ?>';
 olms.max_time_allowed = '<?php echo $oItem->get_max_time_allowed();?>';
 olms.interactions = new Array(<?php echo $oItem->get_interactions_js_array();?>);
 olms.item_objectives = new Array();
@@ -180,7 +180,7 @@ olms.lms_lp_type = '<?php echo $oLP->get_type();?>';
 olms.lms_item_type = '<?php echo $oItem->get_type();?>';
 olms.lms_item_credit = '<?php echo $oItem->get_credit();?>';
 olms.lms_item_lesson_mode = '<?php echo $oItem->get_lesson_mode();?>';
-olms.lms_item_launch_data = '<?php echo $oItem->get_launch_data();?>';
+olms.lms_item_launch_data = '<?php echo addslashes($oItem->get_launch_data());?>';
 olms.lms_item_core_exit = '<?php echo $oItem->get_core_exit();?>';
 olms.lms_course_id = '<?php echo $oLP->get_course_int_id(); ?>';
 olms.lms_course_code = '<?php echo $oLP->getCourseCode(); ?>';