Explorar el Código

[svn r20413] Fixed vulnerabilities of security in wiki, agenda and project tools - partial FS#4134

Cristian Fasanando hace 16 años
padre
commit
4b02ad32e1
Se han modificado 3 ficheros con 17 adiciones y 11 borrados
  1. 5 2
      main/blog/blog.php
  2. 9 6
      main/calendar/agenda.php
  3. 3 3
      main/wiki/index.php

+ 5 - 2
main/blog/blog.php

@@ -77,12 +77,15 @@ $current_page = $_GET['action'];
 */
 if (!empty($_POST['new_post_submit']) AND !empty($_POST['post_title']))
 {	
-	Blog :: create_post($_POST['post_title'], $_POST['post_full_text'], $_POST['post_file_comment'],$blog_id);
+	$safe_post_title = Security::remove_XSS($_POST['post_title']);
+	$safe_post_file_comment = Security::remove_XSS($_POST['post_file_comment']);
+	Blog :: create_post($safe_post_title, $_POST['post_full_text'], $safe_post_file_comment,$blog_id);
 	$return_message = array('type' => 'confirmation', 'message' => get_lang('BlogAdded'));
 }
 if (!empty($_POST['edit_post_submit']))
 {
-	Blog :: edit_post($_POST['post_id'], $_POST['post_title'], $_POST['post_full_text'], $blog_id);
+	$safe_post_title = Security::remove_XSS($_POST['post_title']);	
+	Blog :: edit_post($_POST['post_id'], $safe_post_title, $_POST['post_full_text'], $blog_id);
 	$return_message = array('type' => 'confirmation', 'message' => get_lang('BlogEdited'));
 }
 if (!empty($_POST['new_comment_submit']))

+ 9 - 6
main/calendar/agenda.php

@@ -1,4 +1,4 @@
-<?php //$Id: agenda.php 20083 2009-04-24 18:54:49Z cfasanando $
+<?php //$Id: agenda.php 20413 2009-05-08 16:23:16Z cfasanando $
 /*
 ==============================================================================
 	Dokeos - elearning and course management software
@@ -299,14 +299,17 @@ if (api_is_allowed_to_edit(false,true) OR (api_get_course_setting('allow_user_ed
 							     	$course_info = api_get_course_info();
 								    $event_start    = (int) $_POST['fyear'].'-'.(int) $_POST['fmonth'].'-'.(int) $_POST['fday'].' '.(int) $_POST['fhour'].':'.(int) $_POST['fminute'].':00';
 					                $event_stop     = (int) $_POST['end_fyear'].'-'.(int) $_POST['end_fmonth'].'-'.(int) $_POST['end_fday'].' '.(int) $_POST['end_fhour'].':'.(int) $_POST['end_fminute'].':00';
-									$id = agenda_add_item($course_info,$_POST['title'],$_POST['content'],$event_start,$event_stop,$_POST['selectedform'],false,$_POST['file_comment']);				
+					                $safe_title = Security::remove_XSS($_POST['title']);
+					                $safe_file_comment = Security::remove_XSS($_POST['file_comment']);
+					                
+									$id = agenda_add_item($course_info,$safe_title,$_POST['content'],$event_start,$event_stop,$_POST['selectedform'],false,$safe_file_comment);				
 					                if(!empty($_POST['repeat']))
 					                {
 					                	$end_y = intval($_POST['repeat_end_year']);
 					                    $end_m = intval($_POST['repeat_end_month']);
 					                    $end_d = intval($_POST['repeat_end_day']);
 					                    $end   = mktime(23, 59, 59, $end_m, $end_d, $end_y);
-					                    $res = agenda_add_repeat_item($course_info,$id,$_POST['repeat_type'],$end,$_POST['selectedform'],$_POST['file_comment']);
+					                    $res = agenda_add_repeat_item($course_info,$id,$_POST['repeat_type'],$end,$_POST['selectedform'],$safe_file_comment);
 					                }                 
 								}			
 								break;
@@ -314,9 +317,9 @@ if (api_is_allowed_to_edit(false,true) OR (api_get_course_setting('allow_user_ed
 								if( ! (api_is_course_coach() && !api_is_element_in_the_session(TOOL_AGENDA, intval($_REQUEST['id']) ) ) )
 								{ // a coach can only delete an element belonging to his session
 									if ($_POST['submit_event'])
-									{		$my_id_attach = (int)$_REQUEST['id_attach'];
-											$my_file_comment = Database::escape_string($_REQUEST['file_comment']);
-											store_edited_agenda_item($my_id_attach,$my_file_comment);						
+									{		$my_id_attach = (int)$_REQUEST['id_attach'];										
+											$safe_file_comment = Security::remove_XSS($_REQUEST['file_comment']);
+											store_edited_agenda_item($my_id_attach,$safe_file_comment);						
 									}				
 								}			
 								break;

+ 3 - 3
main/wiki/index.php

@@ -1027,7 +1027,7 @@ if ($_GET['action']=='links')
 		}		
 				
 		echo '<div id="wikititle">';
-		echo $LinksPagesFrom.': '.$ShowAssignment.' <a href="'.api_get_self().'?cidReq='.$_course[id].'&action=showpage&title='.$page.'&group_id='.Security::remove_XSS($_GET['group_id']).'">'.$row['title'].'</a>';
+		echo $LinksPagesFrom.': '.$ShowAssignment.' <a href="'.api_get_self().'?cidReq='.$_course[id].'&action=showpage&title='.Security::remove_XSS($page).'&group_id='.Security::remove_XSS($_GET['group_id']).'">'.Security::remove_XSS($row['title']).'</a>';
 		echo '</div>';
 		
 		//fix index to title Main page into linksto
@@ -1082,7 +1082,7 @@ if ($_GET['action']=='links')
 			
 				$row = array ();
 				$row[] =$ShowAssignment;
-				$row[] = '<a href="'.api_get_self().'?cidReq='.$_course[id].'&action=showpage&title='.urlencode($obj->reflink).'&group_id='.Security::remove_XSS($_GET['group_id']).'">'.$obj->title.'</a>';
+				$row[] = '<a href="'.api_get_self().'?cidReq='.$_course[id].'&action=showpage&title='.urlencode($obj->reflink).'&group_id='.Security::remove_XSS($_GET['group_id']).'">'.Security::remove_XSS($obj->title).'</a>';
 				$row[] = $obj->user_id <>0 ? '<a href="../user/userInfo.php?uInfo='.$userinfo['user_id'].'">'.$userinfo['lastname'].', '.$userinfo['firstname'].'</a>' : get_lang('Anonymous').' ('.$obj->user_ip.')';	
 				$row[] = $day.' '.$MonthsLong[$month-1].' '.$year.' '.$hours.":".$minutes.":".$seconds;					
 				$rows[] = $row;
@@ -1627,7 +1627,7 @@ if ($_GET['action']=='allpages')
 		
 			$row = array ();
 			$row[] =$ShowAssignment;
-			$row[] = '<a href="'.api_get_self().'?cidReq='.$_course[id].'&action=showpage&title='.urlencode($obj->reflink).'&group_id='.Security::remove_XSS($_GET['group_id']).'">'.$obj->title.'</a>';
+			$row[] = '<a href="'.api_get_self().'?cidReq='.$_course[id].'&action=showpage&title='.urlencode(Security::remove_XSS($obj->reflink)).'&group_id='.Security::remove_XSS($_GET['group_id']).'">'.Security::remove_XSS($obj->title).'</a>';
 			$row[] = $obj->user_id <>0 ? '<a href="../user/userInfo.php?uInfo='.$userinfo['user_id'].'">'.$userinfo['lastname'].', '.$userinfo['firstname'].'</a>' : get_lang('Anonymous').' ('.$obj->user_ip.')';	
 			$row[] = $day.' '.$MonthsLong[$month-1].' '.$year.' '.$hours.":".$minutes.":".$seconds;					
 			$rows[] = $row;