From d816f0a5c1cd33effec02508b581f5203cb93182 Mon Sep 17 00:00:00 2001
From: Julio Montoya <gugli100@gmail.com>
Date: Tue, 16 Feb 2010 15:39:42 -0500
Subject: [PATCH 1/6] Some cleaning in reply.php, delete not necessary
 remove_XSS functions)

---
 main/forum/reply.php | 47 +++++++++++++-------------------------------
 1 file changed, 14 insertions(+), 33 deletions(-)

diff --git a/main/forum/reply.php b/main/forum/reply.php
index bd1eb07e92..3e94b20416 100755
--- a/main/forum/reply.php
+++ b/main/forum/reply.php
@@ -1,25 +1,5 @@
 <?php
-/*
-==============================================================================
-	Dokeos - elearning and course management software
-
-	Copyright (c) 2006-2008 Dokeos SPRL
-	Copyright (c) 2006 Ghent University (UGent)
-
-	For a full list of contributors, see "credits.txt".
-	The full license can be read in "license.txt".
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	See the GNU General Public License for more details.
-
-	Contact address: Dokeos, 108 rue du Corbeau, B-1030 Brussels, Belgium
-	Mail: info@dokeos.com
-==============================================================================
-*/
+/* For licensing terms, see /license.txt */
 
 /**
 *	These files are a complete rework of the forum. The database structure is
@@ -46,7 +26,7 @@
 $language_file = array('forum','document');
 
 // including the global dokeos file
-require '../inc/global.inc.php';
+require_once '../inc/global.inc.php';
 
 // the section (tabs)
 $this_section=SECTION_COURSES;
@@ -56,8 +36,8 @@ api_protect_course_script(true);
 
 
 // including additional library scripts
-require_once (api_get_path(LIBRARY_PATH).'formvalidator/FormValidator.class.php');
-include_once (api_get_path(LIBRARY_PATH).'groupmanager.lib.php');
+require_once api_get_path(LIBRARY_PATH).'formvalidator/FormValidator.class.php';
+require_once api_get_path(LIBRARY_PATH).'groupmanager.lib.php';
 $nameTools=get_lang('Forum');
 
 $origin = '';
@@ -71,7 +51,7 @@ if(isset($_GET['origin'])) {
 	Including necessary files
 -----------------------------------------------------------
 */
-require 'forumconfig.inc.php';
+require_once 'forumconfig.inc.php';
 require_once 'forumfunction.inc.php';
 
 
@@ -94,6 +74,7 @@ $htmlHeadXtra[] = '<script>
 		MAIN DISPLAY SECTION
 ==============================================================================
 */
+
 /*
 -----------------------------------------------------------
 	Retrieving forum and forum categorie information
@@ -102,9 +83,9 @@ $htmlHeadXtra[] = '<script>
 // we are getting all the information about the current forum and forum category.
 // note pcool: I tried to use only one sql statement (and function) for this
 // but the problem is that the visibility of the forum AND forum cateogory are stored in the item_property table
-$current_thread=get_thread_information(Security::remove_XSS($_GET['thread'])); // note: this has to be validated that it is an existing thread
-$current_forum=get_forum_information($current_thread['forum_id']); // note: this has to be validated that it is an existing forum.
-$current_forum_category=get_forumcategory_information(Security::remove_XSS($current_forum['forum_category']));
+$current_thread	= get_thread_information($_GET['thread']); // note: this has to be validated that it is an existing thread
+$current_forum	= get_forum_information($current_thread['forum_id']); // note: this has to be validated that it is an existing forum.
+$current_forum_category = get_forumcategory_information(Security::remove_XSS($current_forum['forum_category']));
 
 /*
 -----------------------------------------------------------
@@ -112,12 +93,12 @@ $current_forum_category=get_forumcategory_information(Security::remove_XSS($curr
 -----------------------------------------------------------
 */
 if (isset($_SESSION['gradebook'])){
-	$gradebook=	$_SESSION['gradebook'];
+	$gradebook = Security::remove_XSS($_SESSION['gradebook']);
 }
 
-if (!empty($gradebook) && $gradebook=='view') {
+if (!empty($gradebook) && $gradebook == 'view') {
 	$interbreadcrumb[]= array (
-			'url' => '../gradebook/'.$_SESSION['gradebook_dest'],
+			'url' => '../gradebook/'.Security::remove_XSS($_SESSION['gradebook_dest']),
 			'name' => get_lang('Gradebook')
 		);
 }
@@ -229,12 +210,12 @@ echo '</table>';
 
 // the form for the reply
 $my_action   = isset($_GET['action']) ? Security::remove_XSS($_GET['action']) : '';
-$my_post     = isset($_GET['post']) ? Security::remove_XSS($_GET['post']) : '';
+$my_post     = isset($_GET['post']) ?   Security::remove_XSS($_GET['post']) : '';
 $my_elements = isset($_SESSION['formelements']) ? $_SESSION['formelements'] : '';
 $values=show_add_post_form(Security::remove_XSS($my_action,$my_post, $my_elements)); // note: this has to be cleaned first
 
 if (!empty($values) AND isset($_POST['SubmitPost'])) {
-	store_reply(Security::remove_XSS($values));
+	store_reply($values);
 }
 
 /*

From 8c31ee4095f77191e68ce87f9fe539425fd5e181 Mon Sep 17 00:00:00 2001
From: Julio Montoya <gugli100@gmail.com>
Date: Tue, 16 Feb 2010 15:50:05 -0500
Subject: [PATCH 2/6] Code cleaning adding Security::remove_XSS functions

---
 main/forum/viewthread.php | 79 +++++++++++----------------------------
 1 file changed, 21 insertions(+), 58 deletions(-)

diff --git a/main/forum/viewthread.php b/main/forum/viewthread.php
index 54838ce6fc..344a944c0b 100755
--- a/main/forum/viewthread.php
+++ b/main/forum/viewthread.php
@@ -1,28 +1,5 @@
 <?php
-
-/*
-==============================================================================
-	Dokeos - elearning and course management software
-
-	Copyright (c) 2004-2008 Dokeos SPRL
-	Copyright (c) 2003 Ghent University (UGent)
-	Copyright (c) 2001 Universite catholique de Louvain (UCL)
-	Copyright (c) various contributors
-
-	For a full list of contributors, see "credits.txt".
-	The full license can be read in "license.txt".
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	See the GNU General Public License for more details.
-
-	Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
-	Mail: info@dokeos.com
-==============================================================================
-*/
+/* For licensing terms, see /license.txt */
 
 /**
 *	@Author Patrick Cool <patrick.cool@UGent.be>, Ghent University
@@ -32,13 +9,10 @@
 * 	@package dokeos.forum
 */
 // name of the language file that needs to be included
-$language_file = array (
-'forum',
-'group'
-);
+$language_file = array ('forum','group');
 
 // including the global dokeos file
-require '../inc/global.inc.php';
+require_once '../inc/global.inc.php';
 
 // the section (tabs)
 $this_section=SECTION_COURSES;
@@ -47,20 +21,15 @@ $this_section=SECTION_COURSES;
 api_protect_course_script(true);
 
 // including additional library scripts
-require_once (api_get_path(LIBRARY_PATH).'formvalidator/FormValidator.class.php');
-require_once (api_get_path(LIBRARY_PATH).'groupmanager.lib.php');
-//require_once (api_get_path(LIBRARY_PATH).'resourcelinker.lib.php');
-$nameTools=get_lang('Forum');
+require_once api_get_path(LIBRARY_PATH).'formvalidator/FormValidator.class.php';
+require_once api_get_path(LIBRARY_PATH).'groupmanager.lib.php';
 
-/*
------------------------------------------------------------
-	Including necessary files
------------------------------------------------------------
-*/
-require 'forumconfig.inc.php';
+require_once 'forumconfig.inc.php';
 require_once 'forumfunction.inc.php';
 
 
+$nameTools=get_lang('Forum');
+
 //are we in a lp ?
 $origin = '';
 if (isset($_GET['origin'])) {
@@ -81,11 +50,11 @@ if (isset($_GET['origin'])) {
 // we are getting all the information about the current forum and forum category.
 // note pcool: I tried to use only one sql statement (and function) for this
 // but the problem is that the visibility of the forum AND forum cateogory are stored in the item_property table
-$current_thread=get_thread_information($_GET['thread']); // note: this has to be validated that it is an existing thread
-$current_forum=get_forum_information($current_thread['forum_id']); // note: this has to be validated that it is an existing forum.
-$current_forum_category=get_forumcategory_information($current_forum['forum_category']);
+$current_thread	= get_thread_information($_GET['thread']); // note: this has to be validated that it is an existing thread
+$current_forum	= get_forum_information($current_thread['forum_id']); // note: this has to be validated that it is an existing forum.
+$current_forum_category	= get_forumcategory_information($current_forum['forum_category']);
 
-$whatsnew_post_info=$_SESSION['whatsnew_post_info'];
+$whatsnew_post_info	= $_SESSION['whatsnew_post_info']; //this variable should be deprecated?
 
 /*
 -----------------------------------------------------------
@@ -98,10 +67,7 @@ $whatsnew_post_info=$_SESSION['whatsnew_post_info'];
 if (!empty($_GET['gradebook']) && $_GET['gradebook']=='view' ) {
 	$_SESSION['gradebook']=Security::remove_XSS($_GET['gradebook']);
 	$gradebook=	$_SESSION['gradebook'];
-} /*elseif (empty($_GET['gradebook'])) {
-	unset($_SESSION['gradebook']);
-	$gradebook=	'';
-} */
+}
 
 if (!empty($gradebook) && $gradebook=='view') {
 	$interbreadcrumb[] = array (
@@ -111,13 +77,12 @@ if (!empty($gradebook) && $gradebook=='view') {
 }
 
 if (!empty($_SESSION['toolgroup'])) {
-
-	$_clean['toolgroup']=(int)$_SESSION['toolgroup'];
-	$group_properties  = GroupManager :: get_group_properties($_clean['toolgroup']);
-	$interbreadcrumb[] = array("url"=>"../group/group.php", "name" => get_lang('Groups'));
-	$interbreadcrumb[] = array("url"=>"../group/group_space.php?gidReq=".$_SESSION['toolgroup'], "name"=> get_lang('GroupSpace').' ('.$group_properties['name'].')');
-	$interbreadcrumb[] = array("url"=>"viewforum.php?forum=".Security::remove_XSS($_GET['forum'])."&amp;gidReq=".$_SESSION['toolgroup']."&amp;origin=".$origin."&amp;search=".Security::remove_XSS(urlencode($my_search)),"name" => prepare4display($current_forum['forum_title']));
-	$interbreadcrumb[] = array("url"=>"viewthread.php?forum=".Security::remove_XSS($_GET['forum'])."&gradebook=".$gradebook."&amp;thread=".Security::remove_XSS($_GET['thread']),"name" => prepare4display($current_thread['thread_title']));
+	$session_toolgroup	= intval($_SESSION['toolgroup']);
+	$group_properties	= GroupManager :: get_group_properties($session_toolgroup);
+	$interbreadcrumb[] 	= array("url"=>"../group/group.php", "name" => get_lang('Groups'));
+	$interbreadcrumb[] 	= array("url"=>"../group/group_space.php?gidReq=".$session_toolgroup, "name"=> get_lang('GroupSpace').' ('.$group_properties['name'].')');
+	$interbreadcrumb[] 	= array("url"=>"viewforum.php?forum=".Security::remove_XSS($_GET['forum'])."&amp;gidReq=".$session_toolgroup."&amp;origin=".$origin."&amp;search=".Security::remove_XSS(urlencode($my_search)),"name" => prepare4display($current_forum['forum_title']));
+	$interbreadcrumb[] 	= array("url"=>"viewthread.php?forum=".Security::remove_XSS($_GET['forum'])."&gradebook=".$gradebook."&amp;thread=".Security::remove_XSS($_GET['thread']),"name" => prepare4display($current_thread['thread_title']));
 
 	Display :: display_header('');
 	api_display_tool_title($nameTools);
@@ -126,11 +91,9 @@ if (!empty($_SESSION['toolgroup'])) {
 
 	$my_search=isset($_GET['search']) ? $_GET['search'] : '';
 
-
 	if ($origin=='learnpath') {
-		include(api_get_path(INCLUDE_PATH).'reduced_header.inc.php');
+		require_once api_get_path(INCLUDE_PATH).'reduced_header.inc.php';
 	} else {
-
 		$interbreadcrumb[]=array("url" => "index.php?gradebook=$gradebook&search=".Security::remove_XSS(urlencode($my_search)),"name" => $nameTools);
 		$interbreadcrumb[]=array("url" => "viewforumcategory.php?forumcategory=".$current_forum_category['cat_id']."&amp;origin=".$origin."&amp;search=".Security::remove_XSS(urlencode($my_search)),"name" => prepare4display($current_forum_category['cat_title']));
 		$interbreadcrumb[]=array("url" => "viewforum.php?forum=".Security::remove_XSS($_GET['forum'])."&amp;origin=".$origin."&amp;search=".Security::remove_XSS(urlencode($my_search)),"name" => prepare4display($current_forum['forum_title']));
@@ -196,7 +159,7 @@ if ($my_message<>'PostDeletedSpecial') {
 	echo '<span style="float:right;">'.search_link().'</span>';
 	if ($origin != 'learnpath') {
 		echo '<a href="index.php?gradebook='.$gradebook.'">'.Display::return_icon('back.png',get_lang('BackToForumOverview')).' '.get_lang('BackToForumOverview').'</a>';
-		echo '<a href="viewforum.php?&forum='.Security::remove_XSS($_GET['forum']).'&amp;gidReq='.$_SESSION['toolgroup'].'">'.Display::return_icon('forum.gif',get_lang('BackToForum')).' '.get_lang('BackToForum').'</a>';
+		echo '<a href="viewforum.php?&forum='.Security::remove_XSS($_GET['forum']).'&amp;gidReq='.$session_toolgroup.'">'.Display::return_icon('forum.gif',get_lang('BackToForum')).' '.get_lang('BackToForum').'</a>';
 	}
 	// the reply to thread link should only appear when the forum_category is not locked AND the forum is not locked AND the thread is not locked.
 	// if one of the three levels is locked then the link should not be displayed

From dcd55c8beda1cadeacf82cef308a10e8eaa9a6db Mon Sep 17 00:00:00 2001
From: Julio Montoya <gugli100@gmail.com>
Date: Wed, 17 Feb 2010 11:14:30 -0500
Subject: [PATCH 3/6] Adding \"intval\" function, deleting unnecessary
 \"remove_XSS\" function when inserting a post in a forum partial CT#586

---
 main/forum/forumfunction.inc.php | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/main/forum/forumfunction.inc.php b/main/forum/forumfunction.inc.php
index c2337d8748..e56e136b72 100755
--- a/main/forum/forumfunction.inc.php
+++ b/main/forum/forumfunction.inc.php
@@ -1526,13 +1526,15 @@ function get_post_information($post_id) {
 function get_thread_information($thread_id) {
 	global $table_threads;
 	global $table_item_property;
+	
+	$thread_id = intval($thread_id);
 
-	$sql="SELECT * FROM ".$table_threads." threads, ".$table_item_property." item_properties
+	$sql	="SELECT * FROM ".$table_threads." threads, ".$table_item_property." item_properties
 			WHERE item_properties.tool='".TOOL_FORUM_THREAD."'
 			AND item_properties.ref='".Database::escape_string($thread_id)."'
 			AND threads.thread_id='".Database::escape_string($thread_id)."'";
-	$result=Database::query($sql);
-	$row=Database::fetch_array($result);
+	$result	= Database::query($sql);
+	$row	= Database::fetch_array($result);
 	return $row;
 }
 
@@ -1650,6 +1652,7 @@ function get_thread_users_not_qualify($thread_id, $db_name = null) {
 function get_forum_information($forum_id) {
 	global $table_forums;
 	global $table_item_property;
+	$forum_id = intval($forum_id);
 
 	$sql="SELECT * FROM ".$table_forums." forums, ".$table_item_property." item_properties
 			WHERE item_properties.tool='".TOOL_FORUM."'
@@ -1868,7 +1871,9 @@ function show_add_post_form($action='', $id='', $form_values='') {
 	global $_user;
 	global $origin;
 	global $charset;
+	
 	$gradebook=Security::remove_XSS($_GET['gradebook']);
+	
 	// setting the class and text of the form title and submit button
 	if ($_GET['action']=='quote'){
 		$class='save';
@@ -2201,6 +2206,7 @@ function current_qualify_of_thread($thread_id,$session_id) {
 * @version february 2006, dokeos 1.8
 */
 function store_reply($values) {
+	
 	global $table_threads;
 	global $table_posts;
 	global $forum_table_attachment;
@@ -2327,6 +2333,7 @@ function show_edit_post_form($current_post, $current_thread, $current_forum, $fo
 	global $forum_setting;
 	global $_user;
 	global $origin;
+	
 	$gradebook=Security::remove_XSS($_GET['gradebook']);
 
 	// initiate the object
@@ -2396,12 +2403,13 @@ function show_edit_post_form($current_post, $current_thread, $current_forum, $fo
 	$form->addElement('textarea','file_comment',get_lang('FileComment'),array ('rows' => 4, 'cols' => 34));
 	$form->applyFilter('file_comment', 'html_filter');
 	$form->addElement('html','</div><br /><br />');
+	
 	if ($current_forum['allow_attachments']=='1' OR api_is_allowed_to_edit(null,true)) {
 		if (empty($form_values) AND !isset($_POST['SubmitPost'])) {
 			//edit_added_resources('forum_post',$current_post['post_id']);
 		}
 		//$form->add_resource_button();
-		$values = $form->exportValues();
+		$values = $form->exportValues();		
 	}
 
 	$form->addElement('style_submit_button', 'SubmitPost', get_lang('ModifyThread'), 'class="save"');
@@ -2452,6 +2460,7 @@ function store_edit_post($values) {
 	global $table_threads;
 	global $table_posts;
 	global $origin;
+	
 	$gradebook=Security::remove_XSS($_GET['gradebook']);
 	// first we check if the change affects the thread and if so we commit the changes (sticky and post_title=thread_title are relevant)
 	//if (array_key_exists('is_first_post_of_thread',$values)  AND $values['is_first_post_of_thread']=='1') {
@@ -2465,10 +2474,11 @@ function store_edit_post($values) {
 		Database::query($sql);
 	//}
 	// update the post_title and the post_text
-	$sql="UPDATE $table_posts SET post_title='".Database::escape_string(Security::remove_XSS($values['post_title']))."',
-				post_text='".Database::escape_string(Security::remove_XSS(stripslashes(api_html_entity_decode($values['post_text'])),COURSEMANAGERLOWSECURITY))."',
-				post_notification='".Database::escape_string(isset($values['post_notification'])?$values['post_notification']:null)."'
-				WHERE post_id='".Database::escape_string($values['post_id'])."'";
+	$sql="UPDATE $table_posts SET
+			post_title='".Database::escape_string($values['post_title'])."',
+			post_text='".Database::escape_string($values['post_text'])."',
+			post_notification='".Database::escape_string(isset($values['post_notification'])?$values['post_notification']:null)."'
+			WHERE post_id='".Database::escape_string($values['post_id'])."'";
 	Database::query($sql);
 
 	if (!empty($values['remove_attach'])) {
@@ -3142,6 +3152,7 @@ function store_move_thread($values) {
 function prepare4display($input='') {
 	$highlightcolors = array('yellow', '#33CC33','#3399CC', '#9999FF', '#33CC33');
 	if (!is_array($input)) {
+		//search for contents
 		if (!empty($_GET['search'])) {
 			if (strstr($_GET['search'],'+')) {
 				$search_terms = explode('+',$_GET['search']);
@@ -3154,6 +3165,7 @@ function prepare4display($input='') {
 				$counter++;
 			}
 		}
+		
 		return api_html_entity_decode(stripslashes($input));
 	} else {
 		/*foreach ($input as $key=>$value)

From 45b46c550eab2bce87a12b57d400017376efd22d Mon Sep 17 00:00:00 2001
From: Julio Montoya <gugli100@gmail.com>
Date: Wed, 17 Feb 2010 11:16:14 -0500
Subject: [PATCH 4/6] Security issue: Adding \"intval\" and \"remove_XSS\"
 functions  partial CT#586

---
 main/forum/newthread.php | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/main/forum/newthread.php b/main/forum/newthread.php
index e184f1d292..b851a242d8 100755
--- a/main/forum/newthread.php
+++ b/main/forum/newthread.php
@@ -29,6 +29,7 @@ $language_file = array('forum','document');
 // including the global dokeos file
 require_once '../inc/global.inc.php';
 require_once '../gradebook/lib/gradebook_functions.inc.php';
+
 // the section (tabs)
 $this_section=SECTION_COURSES;
 
@@ -36,10 +37,10 @@ $this_section=SECTION_COURSES;
 api_protect_course_script(true);
 
 // including additional library scripts
-require_once (api_get_path(LIBRARY_PATH).'formvalidator/FormValidator.class.php');
-include_once (api_get_path(LIBRARY_PATH).'groupmanager.lib.php');
-$nameTools=get_lang('Forum');
+require_once api_get_path(LIBRARY_PATH).'formvalidator/FormValidator.class.php';
+require_once api_get_path(LIBRARY_PATH).'groupmanager.lib.php';
 
+$nameTools	= get_lang('Forum');
 
 /*
 -----------------------------------------------------------
@@ -89,28 +90,28 @@ $current_forum_category=get_forumcategory_information($current_forum['forum_cate
 */
 
 if (isset($_SESSION['gradebook'])){
-	$gradebook=	$_SESSION['gradebook'];
+	$gradebook = Security::remove_XSS($_SESSION['gradebook']);
 }
 
 if (!empty($gradebook) && $gradebook=='view') {
 	$interbreadcrumb[]= array (
-			'url' => '../gradebook/'.$_SESSION['gradebook_dest'],
+			'url' => '../gradebook/'.Security::remove_XSS($_SESSION['gradebook_dest']),
 			'name' => get_lang('Gradebook')
 		);
 }
 
 if (!empty($_GET['gidReq'])) {
-	$toolgroup = Database::escape_string($_GET['gidReq']);
+	$toolgroup = intval($_GET['gidReq']);
 	api_session_register('toolgroup');
 }
 
+$session_toolgroup = 0;
 if (!empty($_SESSION['toolgroup'])) {
-
-	$_clean['toolgroup']=(int)$_SESSION['toolgroup'];
-	$group_properties  = GroupManager :: get_group_properties($_clean['toolgroup']);
+	$session_toolgroup = intval($_SESSION['toolgroup']);
+	$group_properties  = GroupManager :: get_group_properties($session_toolgroup);
 	$interbreadcrumb[] = array ("url" => "../group/group.php", "name" => get_lang('Groups'));
-	$interbreadcrumb[] = array ("url"=>"../group/group_space.php?gidReq=".$_SESSION['toolgroup'], "name"=> get_lang('GroupSpace').' ('.$group_properties['name'].')');
-	$interbreadcrumb[]=array("url" => "viewforum.php?origin=".$origin."&amp;gidReq=".$_SESSION['toolgroup']."&forum=".Security::remove_XSS($_GET['forum']),"name" => $current_forum['forum_title']);
+	$interbreadcrumb[] = array ("url"=>"../group/group_space.php?gidReq=".$session_toolgroup, "name"=> get_lang('GroupSpace').' ('.$group_properties['name'].')');
+	$interbreadcrumb[]=array("url" => "viewforum.php?origin=".$origin."&amp;gidReq=".$session_toolgroup."&forum=".Security::remove_XSS($_GET['forum']),"name" => $current_forum['forum_title']);
 	$interbreadcrumb[]=array("url" => "newthread.php?origin=".$origin."&forum=".Security::remove_XSS($_GET['forum']),"name" => get_lang('NewTopic'));
 } else {
 	$interbreadcrumb[]=array("url" => "index.php?gradebook=$gradebook","name" => $nameTools);
@@ -124,9 +125,9 @@ if (!empty($_SESSION['toolgroup'])) {
 -----------------------------------------------------------
 */
 if (isset($_POST['add_resources']) AND $_POST['add_resources']==get_lang('Resources')) {
-	$_SESSION['formelements']=$_POST;
-	$_SESSION['origin']=$_SERVER['REQUEST_URI'];
-	$_SESSION['breadcrumbs']=$interbreadcrumb;
+	$_SESSION['formelements']	= $_POST;
+	$_SESSION['origin']			= $_SERVER['REQUEST_URI'];
+	$_SESSION['breadcrumbs']	= $interbreadcrumb;
 	header("Location: ../resourcelinker/resourcelinker.php");
 }
 
@@ -136,7 +137,7 @@ if (isset($_POST['add_resources']) AND $_POST['add_resources']==get_lang('Resour
 -----------------------------------------------------------
 */
 if($origin=='learnpath') {
-	include(api_get_path(INCLUDE_PATH).'reduced_header.inc.php');
+	require_once api_get_path(INCLUDE_PATH).'reduced_header.inc.php';
 } else {
 	Display :: display_header(null);
 	//api_display_tool_title($nameTools);
@@ -191,7 +192,7 @@ handle_forum_and_forumcategories();
 echo '<div class="actions">';
 echo '<span style="float:right;">'.search_link().'</span>';
 echo '<a href="index.php?gradebook='.$gradebook.'">'.Display::return_icon('back.png',get_lang('BackToForumOverview')).' '.get_lang('BackToForumOverview').'</a>';
-echo '<a href="viewforum.php?forum='.Security::remove_XSS($_GET['forum']).'&amp;gidReq='.$_SESSION['toolgroup'].'">'.Display::return_icon('forum.gif',get_lang('BackToForum')).' '.get_lang('BackToForum').'</a>';
+echo '<a href="viewforum.php?forum='.Security::remove_XSS($_GET['forum']).'&amp;gidReq='.$session_toolgroup.'">'.Display::return_icon('forum.gif',get_lang('BackToForum')).' '.get_lang('BackToForum').'</a>';
 echo '</div>';
 
 /*

From 0e468d936579bdcb0ca77257ba900c620ac10e86 Mon Sep 17 00:00:00 2001
From: Julio Montoya <gugli100@gmail.com>
Date: Wed, 17 Feb 2010 11:18:13 -0500
Subject: [PATCH 5/6] Avoid Security::remove_XSS partial CT#586

---
 main/forum/reply.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/forum/reply.php b/main/forum/reply.php
index 3e94b20416..bc5a8bc9f2 100755
--- a/main/forum/reply.php
+++ b/main/forum/reply.php
@@ -215,7 +215,7 @@ $my_elements = isset($_SESSION['formelements']) ? $_SESSION['formelements'] : ''
 $values=show_add_post_form(Security::remove_XSS($my_action,$my_post, $my_elements)); // note: this has to be cleaned first
 
 if (!empty($values) AND isset($_POST['SubmitPost'])) {
-	store_reply($values);
+	store_reply(Security::remove_XSS($values));
 }
 
 /*

From cedfa9eb53ea119792133ec7af9e4a9be95b0f1a Mon Sep 17 00:00:00 2001
From: Julio Montoya <gugli100@gmail.com>
Date: Wed, 17 Feb 2010 12:00:54 -0500
Subject: [PATCH 6/6] Fixes CT#586

---
 main/forum/viewthread_flat.inc.php     | 27 ++----------
 main/forum/viewthread_nested.inc.php   | 24 +----------
 main/forum/viewthread_threaded.inc.php | 59 ++++++--------------------
 3 files changed, 19 insertions(+), 91 deletions(-)

diff --git a/main/forum/viewthread_flat.inc.php b/main/forum/viewthread_flat.inc.php
index d11072dcc0..53f3d7ede2 100755
--- a/main/forum/viewthread_flat.inc.php
+++ b/main/forum/viewthread_flat.inc.php
@@ -1,25 +1,5 @@
 <?php
-/*
-==============================================================================
-	Dokeos - elearning and course management software
-
-	Copyright (c) 2008 Dokeos SPRL
-	Copyright (c) 2006 Ghent University (UGent)
-
-	For a full list of contributors, see "credits.txt".
-	The full license can be read in "license.txt".
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	See the GNU General Public License for more details.
-
-	Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
-	Mail: info@dokeos.com
-==============================================================================
-*/
+/* For licensing terms, see /license.txt */
 /**
 * 	@package dokeos.forum
 */
@@ -133,9 +113,8 @@ foreach ($rows as $row) {
 
 	
 	// The post message
-	//var_dump($messageclass);
-	
-	$row['post_text']= Security::remove_XSS($row['post_text']);
+	//we can see now the html tags
+	$row['post_text']= Security::remove_XSS($row['post_text'], STUDENT);
 	
 	echo "\t<tr>\n";
 	echo "\t\t<td class=\"$messageclass\">".prepare4display($row['post_text'])."</td>\n";
diff --git a/main/forum/viewthread_nested.inc.php b/main/forum/viewthread_nested.inc.php
index f97428e5b4..d65a808148 100755
--- a/main/forum/viewthread_nested.inc.php
+++ b/main/forum/viewthread_nested.inc.php
@@ -1,25 +1,5 @@
 <?php
-/*
-==============================================================================
-	Dokeos - elearning and course management software
-
-	Copyright (c) 2006 Dokeos SPRL
-	Copyright (c) 2006 Ghent University (UGent)
-
-	For a full list of contributors, see "credits.txt".
-	The full license can be read in "license.txt".
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	See the GNU General Public License for more details.
-
-	Contact address: Dokeos, 44 rue des palais, B-1030 Brussels, Belgium
-	Mail: info@dokeos.com
-==============================================================================
-*/
+/* For licensing terms, see /license.txt */
 
 /**
 *	@Author Patrick Cool <patrick.cool@UGent.be>, Ghent University
@@ -130,7 +110,7 @@ foreach ($rows as $post) {
 
 	// The post message
 	
-	$post['post_text']= Security::remove_XSS($post['post_text']);
+	$post['post_text']= Security::remove_XSS($post['post_text'], STUDENT);
 	
 	echo "\t<tr>\n";
 	echo "\t\t<td class=\"$messageclass\">".prepare4display($post['post_text'])."</td>\n";
diff --git a/main/forum/viewthread_threaded.inc.php b/main/forum/viewthread_threaded.inc.php
index 268eb1ae12..f818529c8f 100755
--- a/main/forum/viewthread_threaded.inc.php
+++ b/main/forum/viewthread_threaded.inc.php
@@ -1,25 +1,5 @@
 <?php
-/*
-==============================================================================
-	Dokeos - elearning and course management software
-
-	Copyright (c) 2006-2008 Dokeos SPRL
-	Copyright (c) 2006 Ghent University (UGent)
-
-	For a full list of contributors, see "credits.txt".
-	The full license can be read in "license.txt".
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	See the GNU General Public License for more details.
-
-	Contact address: Dokeos, 108 rue du Corbeau, B-1030 Brussels, Belgium
-	Mail: info@dokeos.com
-==============================================================================
-*/
+/* For licensing terms, see /license.txt */
 
 /**
 *	These files are a complete rework of the forum. The database structure is
@@ -56,12 +36,9 @@
 $rows=get_posts($_GET['thread']); // note: this has to be cleaned first
 $rows=calculate_children($rows);
 
-if ($_GET['post'])
-{
-	$display_post_id=Security::remove_XSS($_GET['post']); // note: this has to be cleaned first
-}
-else
-{
+if ($_GET['post']) {
+	$display_post_id	= intval($_GET['post']); // note: this has to be cleaned first
+} else {
 	// we need to display the first post
 	reset($rows);
 	$current=current($rows);
@@ -70,8 +47,7 @@ else
 
 //are we in a lp ?
 $origin = '';
-if(isset($_GET['origin']))
-{
+if(isset($_GET['origin'])) {
     $origin =  Security::remove_XSS($_GET['origin']);
 }
 
@@ -206,14 +182,12 @@ unset($whatsnew_post_info[$current_forum['forum_id']][$current_thread['thread_id
 echo "<table width=\"100%\"  class=\"post\"  cellspacing=\"5\" border=\"0\">\n";
 echo "\t<tr>\n";
 echo "\t\t<td rowspan=\"3\" class=\"$leftclass\">";
-if ($rows[$display_post_id]['user_id']=='0')
-{
+if ($rows[$display_post_id]['user_id']=='0') {
 	$name=prepare4display($rows[$display_post_id]['poster_name']);
-}
-else
-{
+} else {
 	$name=api_get_person_name($rows[$display_post_id]['firstname'], $rows[$display_post_id]['lastname']);
 }
+
 if (api_get_course_setting('allow_user_image_forum')) {echo '<br />'.display_user_image($rows[$display_post_id]['user_id'],$name, $origin).'<br />';	}
 echo display_user_link($rows[$display_post_id]['user_id'], $name, $origin).'<br />';
 echo $rows[$display_post_id]['post_date'].'<br /><br />';
@@ -308,17 +282,14 @@ echo "\t</tr>\n";
 
 // The post message
 
-$rows[$display_post_id]['post_text']= Security::remove_XSS($rows[$display_post_id]['post_text']);
-
 echo "\t<tr>\n";
-echo "\t\t<td class=\"$messageclass\">".prepare4display(Security::remove_XSS($rows[$display_post_id]['post_text']))."</td>\n";
+echo "\t\t<td class=\"$messageclass\">".prepare4display(Security::remove_XSS($rows[$display_post_id]['post_text']), STUDENT)."</td>\n";
 echo "\t</tr>\n";
 
 // The check if there is an attachment
-$attachment_list=get_attachment($display_post_id);
+$attachment_list = get_attachment($display_post_id);
 
-if (!empty($attachment_list))
-{
+if (!empty($attachment_list)) {
 	echo '<tr><td height="50%">';
 	$realname=$attachment_list['path'];
 	$user_filename=$attachment_list['filename'];
@@ -327,7 +298,7 @@ if (!empty($attachment_list))
 	echo '<a href="download.php?file=';
 	echo $realname;
 	echo ' "> '.$user_filename.' </a>';
-	echo '<span class="forum_attach_comment" >'.Security::remove_XSS($attachment_list['comment'],STUDENT).'</span>';
+	echo '<span class="forum_attach_comment" >'.Security::remove_XSS($attachment_list['comment'], STUDENT).'</span>';
 	if (($current_forum['allow_edit']==1 AND $rows[$display_post_id]['user_id']==$_user['user_id']) or (api_is_allowed_to_edit(false,true)  && !(api_is_course_coach() && $current_forum['session_id']!=$_SESSION['id_session'])))	{
 		echo '&nbsp;&nbsp;<a href="'.api_get_self().'?'.api_get_cidreq().'&amp;origin='.Security::remove_XSS($_GET['origin']).'&amp;action=delete_attach&amp;id_attach='.$attachment_list['id'].'&amp;forum='.Security::remove_XSS($_GET['forum']).'&amp;thread='.Security::remove_XSS($_GET['thread']).'" onclick="javascript:if(!confirm(\''.addslashes(api_htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset)).'\')) return false;">'.Display::return_icon('delete.gif',get_lang('Delete')).'</a><br />';
 	}
@@ -354,8 +325,7 @@ echo $thread_structure;
 * @return an array containing all the information on the posts of a thread
 * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
 */
-function calculate_children($rows)
-{
+function calculate_children($rows) {
 	foreach($rows as $row)
 	{
 		$rows_with_children[$row["post_id"]]=$row;
@@ -368,8 +338,7 @@ function calculate_children($rows)
 	return $sorted_rows;
 }
 
-function _phorum_recursive_sort($rows, &$threads, $seed=0, $indent=0)
-{
+function _phorum_recursive_sort($rows, &$threads, $seed=0, $indent=0) {
 	if($seed>0)
 	{
 		$threads[$rows[$seed]["post_id"]]=$rows[$seed];