diff --git a/main/resourcelinker/resourcelinker.inc.php b/main/resourcelinker/resourcelinker.inc.php
index 204a9fc66e..d56afcca5c 100755
--- a/main/resourcelinker/resourcelinker.inc.php
+++ b/main/resourcelinker/resourcelinker.inc.php
@@ -1275,41 +1275,8 @@ function get_addedresource_link_in_learnpath($type, $id, $id_in_path)
$link .= "../phpbb/viewtopic.php?topic=".$myrow["topic_id"]."&forum=".$myrow["forum_id"]."&md5=".$myrow["md5"];
}
break;
-
case "Post":
- /* todo REVIEW THIS SECTION - NOT USING VALID TABLES ANYMORE
- $tbl_posts = $_course['dbNameGlu'].'bb_posts';
- $tbl_posts_text = $_course['dbNameGlu'].'bb_posts_text';
- $TBL_FORUMS = $_course['dbNameGlu']."bb_forums";
- $result= Database::query("SELECT * FROM $tbl_posts where post_id=$id");
- $myrow=Database::fetch_array($result);
- // grabbing the title of the post
- $sql_titel="SELECT * FROM $tbl_posts_text WHERE post_id=".$myrow["post_id"];
- $result_titel=Database::query($sql_titel);
- $myrow_titel=Database::fetch_array($result_titel);
-
- $sql="select * from $tbl_learnpath_item where id=$id_in_path";
- $result=Database::query($sql); $row=Database::fetch_array($result);
- if ($row['title'] != '') { $myrow_titel["post_title"]=$row['title']; }
- $desc=$row['description'];
- $link .= str_repeat(" >",$level);
-
- $posternom=$myrow['nom']; $posterprenom=$myrow['prenom'];
- $posttime=$myrow['post_time']; $posttext=$myrow_titel['post_text'];
- $posttitle=$myrow_titel['post_title'];
- $posttext = str_replace('"',"'",$posttext);
-
- if ($builder != 'builder')
- {
- $link .= api_get_self()."?action=closelesson&source_forum=".$_GET['source_forum']."&how=complete&id_in_path=$id_in_path&learnpath_id=$learnpath_id&type=Post&origin=$origin&posternom=$posternom&posterprenom=$posterprenom&posttime=$posttime&posttext=$posttext&posttitle=$posttitle#$id_in_path";
- }
- else
- {
- $link .= "../phpbb/viewtopic.php?topic=".$myrow["topic_id"]."&forum=".$myrow["forum_id"]."&md5=".$myrow["md5"];
- }
- */
break;
-
case "Document":
$dbTable = Database::get_course_table(TABLE_DOCUMENT);
$result=Database::query("SELECT * FROM $dbTable WHERE id=$id",__FILE__,__LINE);
diff --git a/main/social/profile.php b/main/social/profile.php
index 3b42cebabb..a6056ba13b 100755
--- a/main/social/profile.php
+++ b/main/social/profile.php
@@ -38,7 +38,7 @@ if (!empty($_POST['social_wall_new_msg_main']) || !empty($_FILES['picture']['tmp
$messageId = 0;
$messageContent = $_POST['social_wall_new_msg_main'];
if (!empty($_POST['url_content'])) {
- $messageContent = $_POST['social_wall_new_msg_main'].'
'.$_POST['url_content'];
+ $messageContent = $_POST['social_wall_new_msg_main'].'
'.$_POST['url_content'];
}
$idMessage = SocialManager::sendWallMessage(
api_get_user_id(),
diff --git a/main/survey/fillsurvey.php b/main/survey/fillsurvey.php
index 15fbe79620..cfc646dba2 100755
--- a/main/survey/fillsurvey.php
+++ b/main/survey/fillsurvey.php
@@ -1174,7 +1174,7 @@ $g_ic = isset($_GET['invitationcode']) ? Security::remove_XSS($_GET['invitationc
$g_cr = isset($_GET['cidReq']) ? Security::remove_XSS($_GET['cidReq']) : '';
$p_l = isset($_POST['language']) ? Security::remove_XSS($_POST['language']) : '';
-$add_parameters = isset($_GET['user_id']) ? 'user_id='.$_GET['user_id'].'&' : '';
+$add_parameters = isset($_GET['user_id']) ? 'user_id='.intval($_GET['user_id']).'&' : '';
$url = api_get_self().'?'.$add_parameters.'course='.$g_c.'&invitationcode='.$g_ic.'&show='.$show.'&cidReq='.$g_cr;
$form = new FormValidator('question', 'post', $url);
diff --git a/main/wiki/wiki.inc.php b/main/wiki/wiki.inc.php
index cf81e73a0e..b2c3b68238 100755
--- a/main/wiki/wiki.inc.php
+++ b/main/wiki/wiki.inc.php
@@ -2136,7 +2136,9 @@ class Wiki
'.$photo.'
'.Display::tag('span', api_get_person_name($userinfo['firstname'], $userinfo['lastname']), array('title'=>$username)).' |
';
- $content_orig_B = '
'.get_lang('AssignmentDescription').': '.$title_orig.'
'.$_POST['content'];
+ $content_orig_B = '
'.
+ get_lang('AssignmentDescription').': '.
+ $title_orig.'
'.Security::remove_XSS($_POST['content']);
//Second: student list (names, photo and links to their works).
//Third: Create Students work pages.
@@ -2180,7 +2182,7 @@ class Wiki
'span',
strtoupper($o_user_to_add['lastname']).', '.$o_user_to_add['firstname'], array('title'=>$username)
).
- ' [['.$_POST['title']."_uass".$assig_user_id.' | '.$photo.']] '.$status_in_group.'';
+ ' [['.Security::remove_XSS($_POST['title'])."_uass".$assig_user_id.' | '.$photo.']] '.$status_in_group.'';
//don't change this line without guaranteeing that users will be ordered by last names in the following format (surname, name)
$values['assignment']=2;
}
diff --git a/tests/main/exercice/freeanswer.class.test.php b/tests/main/exercice/freeanswer.class.test.php
index 8b94afc0e0..6b1deb894a 100755
--- a/tests/main/exercice/freeanswer.class.test.php
+++ b/tests/main/exercice/freeanswer.class.test.php
@@ -1,29 +1,29 @@
assertTrue(is_null($res));
//var_dump($res);
- }
-
+ }
+
/**
* abstract function which creates the form to create / edit the answers of the question
* @param the formvalidator instance
*/
-
+
function testprocessAnswersCreation () {
- $form = new FormValidator('exercise_admin', 'post', api_get_self().'?exerciseId='.$_GET['exerciseId']);
+ $form = new FormValidator('exercise_admin', 'post', api_get_self().'?exerciseId='.intval($_GET['exerciseId']));
$res =FreeAnswer::processAnswersCreation($form);
$this->assertTrue(is_null($res));
//var_dump($res);
}
-
+
}
?>