[svn r20835] improve security

improve form consistency
improve form layout
project description no longer a required field

main/blog/blog_admin.php

@@ -89,15 +89,15 @@ if (api_is_allowed_to_edit())
 	$get_blog_subtitle = Security::remove_XSS($_POST['blog_subtitle']);
 	$get_blog_id       = Security::remove_XSS($_POST['blog_id']);
 	
-	if (!empty($_POST['new_blog_submit']) AND !empty($_POST['blog_name']) AND !empty($_POST['blog_subtitle'])) {
+	if (!empty($_POST['new_blog_submit']) AND !empty($_POST['blog_name'])) {
-		if (strlen(trim($_POST['blog_name']))>0 && strlen(trim($_POST['blog_subtitle']))>0) {
+		if (strlen(trim($_POST['blog_name']))>0)  {
 			Blog::create_blog($get_blog_name,$get_blog_subtitle);
 			Display::display_confirmation_message(get_lang('BlogStored'));
 		}
 
 	}
-	if (!empty($_POST['edit_blog_submit']) AND !empty($_POST['blog_name']) AND !empty($_POST['blog_subtitle'])) {
+	if (!empty($_POST['edit_blog_submit']) AND !empty($_POST['blog_name'])) {
-		if (strlen(trim($_POST['blog_name']))>0 && strlen(trim($_POST['blog_subtitle']))>0) {
+		if (strlen(trim($_POST['blog_name']))>0) {
 			Blog::edit_blog($get_blog_id,$get_blog_name,$get_blog_subtitle);
 			Display::display_confirmation_message(get_lang('BlogEdited'));
 		}
@@ -123,14 +123,13 @@ if (api_is_allowed_to_edit())
 		if (isset($_GET['action']) && $_GET['action'] == 'add') {
 			// we show the form if 
 			// 1. no post data
-			// 2. there is post data and one of the three form elements is empty
+			// 2. there is post data and one of the required form elements is empty
-			if (!$_POST OR (!empty($_POST) AND (empty($_POST['Submit']) OR empty($_POST['blog_name']) OR empty($_POST['blog_subtitle'])))) {
+			if (!$_POST OR (!empty($_POST) AND (empty($_POST['new_blog_submit']) OR empty($_POST['blog_name'])))) {
 				// if there is post data there is certainly an error in the form
 				/*if ($_POST){
 					Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
 				}*/
-				
+				if (strlen($_POST['blog_name'])==0) {
-			if (strlen($_POST['blog_name'])==0 || strlen($_POST['blog_subtitle'])==0 ) {
 				if (count($_POST)>0) {
 					Display::display_error_message(get_lang('FormHasErrorsPleaseComplete'));
 				}
@@ -139,13 +138,13 @@ if (api_is_allowed_to_edit())
 			} 
 			Blog::display_new_blog_form();
 		}
-			
 		}
+			
 		if (isset($_GET['action']) && $_GET['action'] == 'edit') {
 			// we show the form if 
 			// 1. no post data
 			// 2. there is post data and one of the three form elements is empty
-			if (!$_POST OR (!empty($_POST) AND (empty($_POST['edit_blog_submit']) OR empty($_POST['blog_name']) OR empty($_POST['blog_subtitle']))))
+			if (!$_POST OR (!empty($_POST) AND (empty($_POST['edit_blog_submit']) OR empty($_POST['blog_name']) )))
 			{
 				// if there is post data there is certainly an error in the form
 				if ($_POST) {

main/inc/lib/blog.lib.php

@@ -141,7 +141,7 @@ class Blog
 		$tbl_blogs_tasks 	= Database::get_course_table(TABLE_BLOGS_TASKS);
 
 		//verified if exist blog
-		$sql='SELECT COUNT(*) as count FROM '.$tbl_blogs.'  WHERE blog_name="'.$title.'" AND blog_subtitle="'.$subtitle.'";';
+		$sql='SELECT COUNT(*) as count FROM '.$tbl_blogs.'  WHERE blog_name="'.Database::escape_string($title).'" AND blog_subtitle="'.Database::escape_string($subtitle).'";';
 		$res=Database::query($sql,__FILE__,__LINE__);
 		$info_count=Database::result($res,0,0);
 		if ($info_count==0) {
@@ -1326,7 +1326,7 @@ class Blog
 			// article text
 			$oFCKeditor = new FCKeditor('post_full_text') ;
 			$oFCKeditor->Width		= '100%';
-			$oFCKeditor->Height		= '400';
+			$oFCKeditor->Height		= '200';
 			if(!api_is_allowed_to_edit()) {
 				$oFCKeditor->ToolbarSet = 'Blog_Student';
 			} else {
@@ -1426,7 +1426,7 @@ class Blog
 								$oFCKeditor = new FCKeditor('post_full_text') ;
 
 								$oFCKeditor->Width		= '100%';
-								$oFCKeditor->Height		= '400';
+								$oFCKeditor->Height		= '200';
 								
 								if(!api_is_allowed_to_edit())
 								{
@@ -2522,7 +2522,7 @@ class Blog
 		// comment text
 									$oFCKeditor = new FCKeditor('comment_text') ;													
 									$oFCKeditor->Width		= '100%';
-									$oFCKeditor->Height		= '300';
+									$oFCKeditor->Height		= '200';
 									if(!api_is_allowed_to_edit())
 									{
 										$oFCKeditor->ToolbarSet = 'BlogComment_Student';
@@ -2769,16 +2769,16 @@ class Blog
 						<span class="form_required">*</span>' . get_lang('Title') . '
 					</div>
 					<div class="formw">
-						<input name="blog_name" type="text" size="100" value="'.Security::remove_XSS($_POST['blog_name']).'" />
+						<input name="blog_name" type="text" size="50" value="'.Security::remove_XSS($_POST['blog_name']).'" />
 					</div>
 				</div>
 				
 				<div class="row">
 					<div class="label">
-						<span class="form_required">*</span>' . get_lang('Subtitle') . '
+						' . get_lang('Subtitle') . '
 					</div>
 					<div class="formw">
-						<input name="blog_subtitle" type="text" size="100" value="'.Security::remove_XSS($_POST['blog_subtitle']).'"/>
+						<input name="blog_subtitle" type="text" size="50" value="'.Security::remove_XSS($_POST['blog_subtitle']).'"/>
 					</div>
 				</div>	
 				
@@ -2828,16 +2828,16 @@ class Blog
 						<span class="form_required">*</span>' . get_lang('Title') . '
 					</div>
 					<div class="formw">
-						<input name="blog_name" type="text" size="100" value="' . $blog['blog_name'] . '" />
+						<input name="blog_name" type="text" size="50" value="' . $blog['blog_name'] . '" />
 					</div>
 				</div>
 				
 				<div class="row">
 					<div class="label">
-						<span class="form_required">*</span>' . get_lang('Subtitle') . '
+						' . get_lang('Subtitle') . '
 					</div>
 					<div class="formw">
-						<input name="blog_subtitle" type="text" size="100" value="' . $blog['blog_subtitle'] . '" />
+						<input name="blog_subtitle" type="text" size="50" value="' . $blog['blog_subtitle'] . '" />
 					</div>
 				</div>