Browse Source

[svn r20250] style changes - added remove_XSS - (partial FS#4132)

Isaac Flores 16 years ago
parent
commit
e747751190
2 changed files with 24 additions and 23 deletions
  1. 7 6
      main/work/work.lib.php
  2. 17 17
      main/work/work.php

+ 7 - 6
main/work/work.lib.php

@@ -1,4 +1,4 @@
-<?php //$Id: work.lib.php 20227 2009-04-30 16:40:35Z cvargas1 $
+<?php //$Id: work.lib.php 20250 2009-05-01 14:52:02Z iflorespaz $
 /* For licensing terms, see /dokeos_license.txt */
 /* For licensing terms, see /dokeos_license.txt */
 /**
 /**
 *	@package dokeos.work
 *	@package dokeos.work
@@ -6,7 +6,7 @@
 * 	@author Patrick Cool <patrick.cool@UGent.be>, Ghent University - ability for course admins to specify wether uploaded documents are visible or invisible by default.
 * 	@author Patrick Cool <patrick.cool@UGent.be>, Ghent University - ability for course admins to specify wether uploaded documents are visible or invisible by default.
 * 	@author Roan Embrechts, code refactoring and virtual course support
 * 	@author Roan Embrechts, code refactoring and virtual course support
 * 	@author Frederic Vauthier, directories management
 * 	@author Frederic Vauthier, directories management
-* 	@version $Id: work.lib.php 20227 2009-04-30 16:40:35Z cvargas1 $
+* 	@version $Id: work.lib.php 20250 2009-05-01 14:52:02Z iflorespaz $
 */
 */
 /**
 /**
  * Displays action links (for admins, authorized groups members and authorized students)
  * Displays action links (for admins, authorized groups members and authorized students)
@@ -37,7 +37,7 @@ function display_action_links($cur_dir_path, $always_show_tool_options, $always_
 	}
 	}
 	if (! $always_show_tool_options && api_is_allowed_to_edit()) {
 	if (! $always_show_tool_options && api_is_allowed_to_edit()) {
 		// Create dir		
 		// Create dir		
-		$display_output .=	'<a href="'.api_get_self().'?'.api_get_cidreq().'&amp;toolgroup='.$_GET['toolgroup'].'&amp;curdirpath='.$cur_dir_path.'&amp;createdir=1&origin='.$origin.'&gradebook='.$gradebook.'"><img src="../img/folder_new.gif" border="0" alt="'.get_lang('CreateDir').'" title ="'.get_lang('CreateDir').'" /> '.get_lang('CreateAssignment').' </a>';
+		$display_output .=	'<a href="'.api_get_self().'?'.api_get_cidreq().'&amp;toolgroup='.Security::remove_XSS($_GET['toolgroup']).'&amp;curdirpath='.$cur_dir_path.'&amp;createdir=1&origin='.$origin.'&gradebook='.$gradebook.'"><img src="../img/folder_new.gif" border="0" alt="'.get_lang('CreateDir').'" title ="'.get_lang('CreateDir').'" /> '.get_lang('CreateAssignment').' </a>';
 		// Options
 		// Options
 		$display_output .=	"<a href=\"".api_get_self()."?".api_get_cidreq()."&curdirpath=".$cur_dir_path."&amp;origin=".$origin."&amp;display_tool_options=true&amp;origin=".$origin."&amp;gradebook=".$gradebook."\">".Display::return_icon('acces_tool.gif', get_lang("EditToolOptions")).' ' . get_lang("EditToolOptions") . "</a>";							
 		$display_output .=	"<a href=\"".api_get_self()."?".api_get_cidreq()."&curdirpath=".$cur_dir_path."&amp;origin=".$origin."&amp;display_tool_options=true&amp;origin=".$origin."&amp;gradebook=".$gradebook."\">".Display::return_icon('acces_tool.gif', get_lang("EditToolOptions")).' ' . get_lang("EditToolOptions") . "</a>";							
 	}
 	}
@@ -61,7 +61,7 @@ function display_action_links($cur_dir_path, $always_show_tool_options, $always_
 		$sql_result = api_sql_query($sql_query,__FILE__,__LINE__);
 		$sql_result = api_sql_query($sql_query,__FILE__,__LINE__);
 	
 	
 		if ($sql_result) {
 		if ($sql_result) {
-			$columnStatus = mysql_fetch_array($sql_result);
+			$columnStatus = Database::fetch_array($sql_result);
 	
 	
 			if ($columnStatus['Default'] == 1) {
 			if ($columnStatus['Default'] == 1) {
 				$display_output .=	"<a href=\"".api_get_self()."?".api_get_cidreq()."&curdirpath=".$cur_dir_path."&amp;origin=$origin&amp;gradebook=$gradebook&amp;make_invisible=all\">".
 				$display_output .=	"<a href=\"".api_get_self()."?".api_get_cidreq()."&curdirpath=".$cur_dir_path."&amp;origin=$origin&amp;gradebook=$gradebook&amp;make_invisible=all\">".
@@ -405,17 +405,18 @@ function display_student_publications_list($work_dir,$sub_course_dir,$currentCou
 			if(isset($clean_edit_dir) && $clean_edit_dir==$mydir) {	
 			if(isset($clean_edit_dir) && $clean_edit_dir==$mydir) {	
 				if(!empty($row['has_properties'])) {
 				if(!empty($row['has_properties'])) {
 					$sql = api_sql_query('SELECT * FROM '.$work_assigment.' WHERE id = '."'".$row['has_properties']."'".' LIMIT 1',__FILE__,__LINE__);
 					$sql = api_sql_query('SELECT * FROM '.$work_assigment.' WHERE id = '."'".$row['has_properties']."'".' LIMIT 1',__FILE__,__LINE__);
-					$homework = mysql_fetch_array($sql);					
+					$homework = Database::fetch_array($sql);					
 				}
 				}
 			
 			
 				$form_folder = new FormValidator('edit_dir', 'post', api_get_self().'?curdirpath='.$my_sub_dir.'&origin='.$origin.'&gradebook='.$gradebook.'&edit_dir='.$mydir);
 				$form_folder = new FormValidator('edit_dir', 'post', api_get_self().'?curdirpath='.$my_sub_dir.'&origin='.$origin.'&gradebook='.$gradebook.'&edit_dir='.$mydir);
 
 
 				$group_name[] = FormValidator :: createElement('text','dir_name');
 				$group_name[] = FormValidator :: createElement('text','dir_name');
+				
 				//$group_name[] = FormValidator :: createElement('submit','submit_edit_dir',get_lang('Ok'));
 				//$group_name[] = FormValidator :: createElement('submit','submit_edit_dir',get_lang('Ok'));
 				
 				
 				$form_folder -> addGroup($group_name,'my_group',get_lang('Title'));
 				$form_folder -> addGroup($group_name,'my_group',get_lang('Title'));
 				$form_folder -> addGroupRule('my_group',get_lang('ThisFieldIsRequired'),'required');				
 				$form_folder -> addGroupRule('my_group',get_lang('ThisFieldIsRequired'),'required');				
-				$defaults = array('my_group[dir_name]'=>$dir,'description'=>$row['description']);				
+				$defaults = array('my_group[dir_name]'=>html_entity_decode($dir),'description'=>html_entity_decode($row['description']));				
 				$form_folder-> addElement('textarea','description',get_lang('Description'),array('rows'=>5,'cols'=>50));
 				$form_folder-> addElement('textarea','description',get_lang('Description'),array('rows'=>5,'cols'=>50));
 				$qualification_input[] = FormValidator :: createElement('text','qualification');
 				$qualification_input[] = FormValidator :: createElement('text','qualification');
 				
 				

+ 17 - 17
main/work/work.php

@@ -1,4 +1,4 @@
-<?php //$Id: work.php 20227 2009-04-30 16:40:35Z cvargas1 $
+<?php //$Id: work.php 20250 2009-05-01 14:52:02Z iflorespaz $
 /* For licensing terms, see /dokeos_license.txt */
 /* For licensing terms, see /dokeos_license.txt */
 /**
 /**
 *	@package dokeos.work
 *	@package dokeos.work
@@ -6,7 +6,7 @@
 * 	@author Patrick Cool <patrick.cool@UGent.be>, Ghent University - ability for course admins to specify wether uploaded documents are visible or invisible by default.
 * 	@author Patrick Cool <patrick.cool@UGent.be>, Ghent University - ability for course admins to specify wether uploaded documents are visible or invisible by default.
 * 	@author Roan Embrechts, code refactoring and virtual course support
 * 	@author Roan Embrechts, code refactoring and virtual course support
 * 	@author Frederic Vauthier, directories management
 * 	@author Frederic Vauthier, directories management
-*  	@version $Id: work.php 20227 2009-04-30 16:40:35Z cvargas1 $
+*  	@version $Id: work.php 20250 2009-05-01 14:52:02Z iflorespaz $
 *
 *
 * 	@todo refactor more code into functions, use quickforms, coding standards, ...
 * 	@todo refactor more code into functions, use quickforms, coding standards, ...
 */
 */
@@ -443,7 +443,7 @@ if (api_is_allowed_to_edit(false,true)) {
 		$result = api_sql_query($sql, __FILE__, __LINE__);
 		$result = api_sql_query($sql, __FILE__, __LINE__);
 
 
 		if (!empty($result)) {
 		if (!empty($result)) {
-			$row = mysql_fetch_array($result);
+			$row = Database::fetch_array($result);
 			$workTitle = $row['title'];
 			$workTitle = $row['title'];
 			$workAuthor = $row['author'];
 			$workAuthor = $row['author'];
 			$workDescription = $row['description'];
 			$workDescription = $row['description'];
@@ -552,7 +552,7 @@ if (api_is_allowed_to_edit(false,true)) {
 					$sql_add_publication = "INSERT INTO " . $work_table . " SET " .			
 					$sql_add_publication = "INSERT INTO " . $work_table . " SET " .			
 										   "url         = '". $dir_name_sql ."',
 										   "url         = '". $dir_name_sql ."',
 									       title        = '',
 									       title        = '',
-						                   description 	= '".Database::escape_string($_POST['description'])."',
+						                   description 	= '".Database::escape_string(Security::remove_XSS($_POST['description']))."',
 						                   author      	= '',
 						                   author      	= '',
 										   active		= '0',
 										   active		= '0',
 										   accepted		= '1',
 										   accepted		= '1',
@@ -735,7 +735,7 @@ else {
 			/*not authorized to this user */
 			/*not authorized to this user */
 		} else {
 		} else {
 			//Get the author ID for that document from the item_property table
 			//Get the author ID for that document from the item_property table
-			$author_sql = "SELECT * FROM $iprop_table WHERE tool = 'work' AND insert_user_id='$user_id' AND ref=" . mysql_real_escape_string($delete);
+			$author_sql = "SELECT * FROM $iprop_table WHERE tool = 'work' AND insert_user_id='$user_id' AND ref=" .Database::escape_string($delete);
 			$author_qry = api_sql_query($author_sql, __FILE__, __LINE__);
 			$author_qry = api_sql_query($author_sql, __FILE__, __LINE__);
 			
 			
 			if (Database :: num_rows($author_qry) == 1) {
 			if (Database :: num_rows($author_qry) == 1) {
@@ -748,7 +748,7 @@ else {
 				
 				
 				if ($result1) {
 				if ($result1) {
 					api_item_property_update($_course, 'work', $delete, 'DocumentDeleted', $user_id);
 					api_item_property_update($_course, 'work', $delete, 'DocumentDeleted', $user_id);
-					while ($thisUrl = mysql_fetch_array($result1)) {
+					while ($thisUrl = Database::fetch_array($result1)) {
 						// check the url really points to a file in the work area
 						// check the url really points to a file in the work area
 						// (some work links can come from groups area...)
 						// (some work links can come from groups area...)
 						if (substr(dirname($thisUrl['url']), -4) == "work") {
 						if (substr(dirname($thisUrl['url']), -4) == "work") {
@@ -849,8 +849,8 @@ if ($ctok==$_POST['sec_token']) { //check the token inserted into the form
 				}				
 				}				
 				$sql_add_publication = "INSERT INTO " . $work_table . " SET " .
 				$sql_add_publication = "INSERT INTO " . $work_table . " SET " .
 										       "url         = '" . $url . "',
 										       "url         = '" . $url . "',
-										       title       = '" . $title . "',
-							                   description = '" . $description . "',
+										       title       = '" . Database::escape_string(Security::remove_XSS($title)) . "',
+							                   description = '" . Database::escape_string(Security::remove_XSS($description)) . "',
 							                   author      = '" . $authors . "',
 							                   author      = '" . $authors . "',
 											   active		= '" . $active . "',
 											   active		= '" . $active . "',
 											   accepted		= '" . (api_is_allowed_to_edit()?$uploadvisibledisabled:(!$uploadvisibledisabled)) . "',
 											   accepted		= '" . (api_is_allowed_to_edit()?$uploadvisibledisabled:(!$uploadvisibledisabled)) . "',
@@ -894,14 +894,14 @@ if ($ctok==$_POST['sec_token']) { //check the token inserted into the form
 			if (!Database::num_rows($result)) {
 			if (!Database::num_rows($result)) {
 				api_sql_query("ALTER TABLE " . $work_table . " ADD sent_date DATETIME NOT NULL");
 				api_sql_query("ALTER TABLE " . $work_table . " ADD sent_date DATETIME NOT NULL");
 			}
 			}
-	
+				$current_date = date('Y-m-d H:i:s');
 				$sql = "INSERT INTO  " . $work_table . "
 				$sql = "INSERT INTO  " . $work_table . "
 					        	SET url        	= '" . $url . "',
 					        	SET url        	= '" . $url . "',
-					            title       	= '" . $title . "',
-					            description 	= '" . $description . "',
+					            title       	= '" . Database::escape_string(Security::remove_XSS($title)) . "',
+					            description 	= '" . Database::escape_string(Security::remove_XSS($description)) . "',
 					            author      	= '" . $authors . "',					 
 					            author      	= '" . $authors . "',					 
 							    post_group_id = '".$post_group_id."',
 							    post_group_id = '".$post_group_id."',
-					            sent_date    	= NOW(),
+					            sent_date    	= '".$current_date."',
 					            session_id = ".intval($id_session);
 					            session_id = ".intval($id_session);
 	
 	
 			api_sql_query($sql, __FILE__, __LINE__);
 			api_sql_query($sql, __FILE__, __LINE__);
@@ -950,8 +950,8 @@ if ($ctok==$_POST['sec_token']) { //check the token inserted into the form
 					Display::display_error_message(get_lang('QualificationMustNotBeMoreThanQualificationOver'));				
 					Display::display_error_message(get_lang('QualificationMustNotBeMoreThanQualificationOver'));				
 				} else {			
 				} else {			
 					$sql = "UPDATE  " . $work_table . "
 					$sql = "UPDATE  " . $work_table . "
-					        SET	title       = '" . $title . "',
-					            description = '" . $description . "'
+					        SET	title       = '" . Database::escape_string(Security::remove_XSS($title)) . "',
+					            description = '" . Database::escape_string(Security::remove_XSS($description)) . "'
 					            ".$add_to_update."
 					            ".$add_to_update."
 					        WHERE id    = '$id'";
 					        WHERE id    = '$id'";
 				api_sql_query($sql, __FILE__, __LINE__);				
 				api_sql_query($sql, __FILE__, __LINE__);				
@@ -1051,13 +1051,13 @@ $has_expired = false;
 $has_ended = false;
 $has_ended = false;
 isset($_GET['curdirpath'])?$curdirpath=Database::escape_string($_GET['curdirpath']):$curdirpath='';
 isset($_GET['curdirpath'])?$curdirpath=Database::escape_string($_GET['curdirpath']):$curdirpath='';
 $sql = api_sql_query('SELECT description,id FROM '.Database :: get_course_table(TABLE_STUDENT_PUBLICATION).' WHERE filetype = '."'folder'".' and has_properties != '."''".' and url = '."'/".$curdirpath."'".' LIMIT 1',__FILE__,__LINE__);
 $sql = api_sql_query('SELECT description,id FROM '.Database :: get_course_table(TABLE_STUDENT_PUBLICATION).' WHERE filetype = '."'folder'".' and has_properties != '."''".' and url = '."'/".$curdirpath."'".' LIMIT 1',__FILE__,__LINE__);
-$is_special = mysql_num_rows($sql);
+$is_special = Database::num_rows($sql);
 if($is_special > 0):
 if($is_special > 0):
 	$is_special = true;
 	$is_special = true;
 	define('IS_ASSIGNMENT',1);
 	define('IS_ASSIGNMENT',1);
-	$publication = mysql_fetch_array($sql);
+	$publication = Database::fetch_array($sql);
 	$sql = api_sql_query('SELECT * FROM '.$TSTDPUBASG.' WHERE publication_id = '.(string)$publication['id'].' LIMIT 1',__FILE__,__LINE__);
 	$sql = api_sql_query('SELECT * FROM '.$TSTDPUBASG.' WHERE publication_id = '.(string)$publication['id'].' LIMIT 1',__FILE__,__LINE__);
-	$homework = mysql_fetch_array($sql);
+	$homework = Database::fetch_array($sql);
 	
 	
 	if($homework['expires_on']!='0000-00-00 00:00:00' || $homework['ends_on']!='0000-00-00 00:00:00'):		
 	if($homework['expires_on']!='0000-00-00 00:00:00' || $homework['ends_on']!='0000-00-00 00:00:00'):		
 		$time_now = convert_date_to_number(date('Y-m-d H:i:s'));	
 		$time_now = convert_date_to_number(date('Y-m-d H:i:s'));