Browse Source

Task #1297 - "Forums" tool, adding/editing posts: Adding Security::remove_XSS() in some places.

Ivan Tcholakov 14 years ago
parent
commit
c158efda95
2 changed files with 13 additions and 13 deletions
  1. 9 9
      main/forum/editpost.php
  2. 4 4
      main/forum/forumfunction.inc.php

+ 9 - 9
main/forum/editpost.php

@@ -114,10 +114,10 @@ if ($origin == 'group') {
 
 /* Resource Linker */
 
-if (isset($_POST['add_resources']) AND $_POST['add_resources']==get_lang('Resources')) {
-    $_SESSION['formelements']=$_POST;
-    $_SESSION['origin']=$_SERVER['REQUEST_URI'];
-    $_SESSION['breadcrumbs']=$interbreadcrumb;
+if (isset($_POST['add_resources']) AND $_POST['add_resources'] == get_lang('Resources')) {
+    $_SESSION['formelements'] = $_POST;
+    $_SESSION['origin'] = $_SERVER['REQUEST_URI'];
+    $_SESSION['breadcrumbs'] = $interbreadcrumb;
     header('Location: ../resourcelinker/resourcelinker.php');
 }
 $table_link = Database :: get_main_table(TABLE_MAIN_GRADEBOOK_LINK);
@@ -177,11 +177,11 @@ if ($origin != 'learnpath') {
     echo '<div class="actions">';
     echo '<span style="float:right;">'.search_link().'</span>';
     if ($origin == 'group') {
-        echo '<a href="../group/group_space.php?'.api_get_cidreq().'&amp;gidReq='.Security::remove_XSS($_GET['gidReq']).'&amp;gradebook='.$gradebook.'">'.Display::return_icon('back.png',get_lang('BackTo').' '.get_lang('Groups'),'','32').'</a>';
+        echo '<a href="../group/group_space.php?'.api_get_cidreq().'&amp;gidReq='.Security::remove_XSS($_GET['gidReq']).'&amp;gradebook='.$gradebook.'">'.Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('Groups'), '', '32').'</a>';
     } else {
-        echo '<a href="index.php?gradebook='.$gradebook.'">'.Display::return_icon('back.png',get_lang('BackToForumOverview'),'','32' ).'</a>';
+        echo '<a href="index.php?gradebook='.$gradebook.'">'.Display::return_icon('back.png', get_lang('BackToForumOverview'), '', '32').'</a>';
     }
-    echo '<a href="viewforum.php?forum='.Security::remove_XSS($_GET['forum']).'&amp;gidReq='.Security::remove_XSS($_GET['gidReq']).'&amp;origin='.$origin.'">'.Display::return_icon('forum.png',get_lang('BackToForum'),'','32').'</a>';
+    echo '<a href="viewforum.php?forum='.Security::remove_XSS($_GET['forum']).'&amp;gidReq='.Security::remove_XSS($_GET['gidReq']).'&amp;origin='.$origin.'">'.Display::return_icon('forum.png', get_lang('BackToForum'), '', '32').'</a>';
     echo '</div>';
 }
 
@@ -205,12 +205,12 @@ if (!empty($values) and isset($_POST['SubmitPost'])) {
     $option_chek = isset($values['thread_qualify_gradebook']) ? $values['thread_qualify_gradebook'] : null; // values 1 or 0
     if (1 == $option_chek) {
         $id = $values['thread_id'];
-        $title_gradebook = stripslashes($values['calification_notebook_title']);
+        $title_gradebook = Security::remove_XSS(stripslashes($values['calification_notebook_title']));
         $value_calification = $values['numeric_calification'];
         $weight_calification = $values['weight_calification'];
         $description = '';
         $session_id = api_get_session_id();
-        $link_id = is_resource_in_course_gradebook(api_get_course_id(), 5, $id,$session_id);
+        $link_id = is_resource_in_course_gradebook(api_get_course_id(), 5, $id, $session_id);
         if (!$link_id) {
             add_resource_to_course_gradebook(api_get_course_id(), 5, $id, $title_gradebook, $weight_calification, $value_calification, $description, time(), 1, api_get_session_id());
         } else {

+ 4 - 4
main/forum/forumfunction.inc.php

@@ -2503,12 +2503,12 @@ function store_edit_post($values) {
     $table_threads 	= Database :: get_course_table(TABLE_FORUM_THREAD);
     $table_posts 	= Database :: get_course_table(TABLE_FORUM_POST);
 
-    $gradebook=Security::remove_XSS($_GET['gradebook']);
+    $gradebook = Security::remove_XSS($_GET['gradebook']);
     // First we check if the change affects the thread and if so we commit the changes (sticky and post_title=thread_title are relevant).
     //if (array_key_exists('is_first_post_of_thread',$values)  AND $values['is_first_post_of_thread']=='1') {
     $sql = "UPDATE $table_threads SET thread_title='".Database::escape_string(stripslashes($values['post_title']))."',
                 thread_sticky='".Database::escape_string(isset($values['thread_sticky']) ? $values['thread_sticky'] : null)."'," .
-                "thread_title_qualify='".Database::escape_string(stripslashes($values['calification_notebook_title']))."'," .
+                "thread_title_qualify='".Database::escape_string(Security::remove_XSS(stripslashes($values['calification_notebook_title'])))."'," .
                 "thread_qualify_max='".Database::escape_string($values['numeric_calification'])."',".
                 "thread_weight='".Database::escape_string($values['weight_calification'])."'".
                 " WHERE thread_id='".Database::escape_string($values['thread_id'])."'";
@@ -2516,8 +2516,8 @@ function store_edit_post($values) {
     Database::query($sql);
     //}
     // Update the post_title and the post_text.
-    $sql = "UPDATE $table_posts SET post_title='".Database::escape_string(stripslashes($values['post_title']))."',
-                post_text='".Database::escape_string(stripslashes($values['post_text']))."',
+    $sql = "UPDATE $table_posts SET post_title='".Database::escape_string(Security::remove_XSS(stripslashes($values['post_title'])))."',
+                post_text='".Database::escape_string(Security::remove_XSS(stripslashes($values['post_text'])))."',
                 post_notification='".Database::escape_string(isset($values['post_notification'])?$values['post_notification']:null)."'
                 WHERE post_id='".Database::escape_string($values['post_id'])."'";
     Database::query($sql);