chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Use api_replace_dangerous_char

Browse Source
1.10.x
Julio Montoya 11 years ago
parent dfb663ae83
commit 2ee21324ef
14 changed files with 57 additions and 55 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 2
      certificates/index.php
  2. 4
      main/admin/configure_homepage.php
  3. 2
      main/admin/configure_inscription.php
  4. 6
      main/auth/inscription.php
  5. 2
      main/auth/profile.php
  6. 30
      main/document/create_audio.php
  7. 4
      main/document/create_document.php
  8. 2
      main/document/document.php
  9. 36
      main/document/save_pixlr.php
  10. 2
      main/dropbox/dropbox_functions.inc.php
  11. 2
      main/exercice/hotpotatoes.php
  12. 2
      main/gradebook/lib/fe/exportgradebook.php
  13. 16
      main/inc/lib/course.lib.php
  14. 2
      main/mySpace/user_add.php

2
certificates/index.php
Unescape View File

@ -37,7 +37,7 @@ switch ($action) {
$pageFormat = $pdfParams['orientation'] == 'landscape' ? 'A4-L' : 'A4'; $pageFormat = $pdfParams['orientation'] == 'landscape' ? 'A4-L' : 'A4';
$userInfo = api_get_user_info($certificate->user_id); $userInfo = api_get_user_info($certificate->user_id);
$pdfName = replace_dangerous_char(get_lang('Certificate') . ' ' . $userInfo['username']); $pdfName = api_replace_dangerous_char(get_lang('Certificate') . ' ' . $userInfo['username']);
$pdf = new PDF($pageFormat, $pdfParams['orientation'], $pdfParams); $pdf = new PDF($pageFormat, $pdfParams['orientation'], $pdfParams);
$pdf->html_to_pdf($certificatePathList, $pdfName, null, false, false); $pdf->html_to_pdf($certificatePathList, $pdfName, null, false, false);

4
main/admin/configure_homepage.php
Unescape View File

@ -149,7 +149,7 @@ if (api_is_multiple_url_enabled()) {
if ($access_url_id != -1) { if ($access_url_id != -1) {
$url_info = api_get_access_url($access_url_id); $url_info = api_get_access_url($access_url_id);
$url = api_remove_trailing_slash(preg_replace('/https?:\/\//i', '', $url_info['url'])); $url = api_remove_trailing_slash(preg_replace('/https?:\/\//i', '', $url_info['url']));
$clean_url = replace_dangerous_char($url); $clean_url = api_replace_dangerous_char($url);
$clean_url = str_replace('/', '-', $clean_url); $clean_url = str_replace('/', '-', $clean_url);
$clean_url .= '/'; $clean_url .= '/';
@ -406,7 +406,7 @@ if (!empty($action)) {
} else { } else {
// New links are added as new files in the home/ directory // New links are added as new files in the home/ directory
if ($action == 'insert_link' || $action == 'insert_tabs' || empty($filename) || strstr($filename, '/') || !strstr($filename, '.html')) { if ($action == 'insert_link' || $action == 'insert_tabs' || empty($filename) || strstr($filename, '/') || !strstr($filename, '.html')) {
$filename = replace_dangerous_char($link_name, 'strict').'.html'; $filename = api_replace_dangerous_char($link_name, 'strict').'.html';
} }
// "home_" prefix for links are renamed to "user_" prefix (to avoid name clash with existing home page files) // "home_" prefix for links are renamed to "user_" prefix (to avoid name clash with existing home page files)

2
main/admin/configure_inscription.php
Unescape View File

@ -69,7 +69,7 @@ if (api_is_multiple_url_enabled()) {
$url_info = api_get_access_url($access_url_id); $url_info = api_get_access_url($access_url_id);
$url = api_remove_trailing_slash(preg_replace('/https?:\/\//i', '', $url_info['url'])); $url = api_remove_trailing_slash(preg_replace('/https?:\/\//i', '', $url_info['url']));
$clean_url = replace_dangerous_char($url); $clean_url = api_replace_dangerous_char($url);
$clean_url = str_replace('/', '-', $clean_url); $clean_url = str_replace('/', '-', $clean_url);
$clean_url .= '/'; $clean_url .= '/';

6
main/auth/inscription.php
Unescape View File

@ -6,7 +6,7 @@
* @package chamilo.auth * @package chamilo.auth
*/ */
use \ChamiloSession as Session; use ChamiloSession as Session;
//quick hack to adapt the registration form result to the selected registration language //quick hack to adapt the registration form result to the selected registration language
if (!empty($_POST['language'])) { if (!empty($_POST['language'])) {
@ -294,7 +294,7 @@ if (!CustomPages::enabled()) {
if ($access_url_id != -1) { if ($access_url_id != -1) {
$url_info = api_get_access_url($access_url_id); $url_info = api_get_access_url($access_url_id);
$url = api_remove_trailing_slash(preg_replace('/https?:\/\//i', '', $url_info['url'])); $url = api_remove_trailing_slash(preg_replace('/https?:\/\//i', '', $url_info['url']));
$clean_url = replace_dangerous_char($url); $clean_url = api_replace_dangerous_char($url);
$clean_url = str_replace('/', '-', $clean_url); $clean_url = str_replace('/', '-', $clean_url);
$clean_url .= '/'; $clean_url .= '/';
$home_old = api_get_path(SYS_PATH).'home/'; $home_old = api_get_path(SYS_PATH).'home/';
@ -591,7 +591,7 @@ if ($form->validate()) {
Session::write('is_allowedCreateCourse', $is_allowedCreateCourse); Session::write('is_allowedCreateCourse', $is_allowedCreateCourse);
// Stats // Stats
Event::event_login(); Event::event_login($user_id);
// last user login date is now // last user login date is now
$user_last_login_datetime = 0; // used as a unix timestamp it will correspond to : 1 1 1970 $user_last_login_datetime = 0; // used as a unix timestamp it will correspond to : 1 1 1970

2
main/auth/profile.php
Unescape View File

@ -328,7 +328,7 @@ function upload_user_production($user_id) {
if (!file_exists($production_repository)) { if (!file_exists($production_repository)) {
@mkdir($production_repository, api_get_permissions_for_new_directories(), true); @mkdir($production_repository, api_get_permissions_for_new_directories(), true);
} }
$filename = replace_dangerous_char($_FILES['production']['name']); $filename = api_replace_dangerous_char($_FILES['production']['name']);
$filename = disable_dangerous_file($filename); $filename = disable_dangerous_file($filename);
if (filter_extension($filename)) { if (filter_extension($filename)) {

30
main/document/create_audio.php
Unescape View File

@ -377,7 +377,7 @@ function downloadMP3_google($filepath, $dir)
} }
$documentPath = $filepath.'/'.$audio_filename; $documentPath = $filepath.'/'.$audio_filename;
/*
//prev for a fine unicode, borrowed from main api TODO:clean //prev for a fine unicode, borrowed from main api TODO:clean
// Safe replacements for some non-letter characters (whitout blank spaces) // Safe replacements for some non-letter characters (whitout blank spaces)
@ -391,19 +391,20 @@ function downloadMP3_google($filepath, $dir)
// Transliteration to ASCII letters, they are not dangerous for filesystems. // Transliteration to ASCII letters, they are not dangerous for filesystems.
$filename = api_transliterate($filename, 'x', $encoding); $filename = api_transliterate($filename, 'x', $encoding);
// Replacing remaining dangerous non-letter characters. // Replacing remaining dangerous non-letter characters.
$clean_text = str_replace($search, $replace, $filename); $clean_text = str_replace($search, $replace, $filename);*/
$clean_text = api_replace_dangerous_char($clean_text);
//adding the file //adding the file
//add new file to disk //add new file to disk
file_put_contents($documentPath, file_get_contents("http://translate.google.com/translate_tts?tl=".$clean_lang."&q=".urlencode($clean_text)."")); file_put_contents($documentPath, file_get_contents("http://translate.google.com/translate_tts?tl=".$clean_lang."&q=".urlencode($clean_text).""));
//add document to database //add document to database
$current_session_id = api_get_session_id(); $current_session_id = api_get_session_id();
$groupId=$_SESSION['_gid']; $groupId=$_SESSION['_gid'];
$file_size = filesize($documentPath); $file_size = filesize($documentPath);
$relativeUrlPath=$dir; $relativeUrlPath=$dir;
$doc_id = add_document($_course, $relativeUrlPath.$audio_filename, 'file', filesize($documentPath), $audio_title); $doc_id = add_document($_course, $relativeUrlPath.$audio_filename, 'file', filesize($documentPath), $audio_title);
api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id); api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
Display::display_confirmation_message(get_lang('DocumentCreated')); Display::display_confirmation_message(get_lang('DocumentCreated'));
//return to location //return to location
echo '<script>window.location.href="'.$location.'"</script>'; echo '<script>window.location.href="'.$location.'"</script>';
} }
@ -454,7 +455,7 @@ function downloadMP3_pediaphon($filepath, $dir){
$documentPath = $filepath.'/'.$audio_filename; $documentPath = $filepath.'/'.$audio_filename;
//prev for a fine unicode, borrowed from main api TODO:clean /*//prev for a fine unicode, borrowed from main api TODO:clean
// Safe replacements for some non-letter characters (whitout blank spaces) // Safe replacements for some non-letter characters (whitout blank spaces)
$search = array("\0", "\t", "\n", "\r", "\x0B", '/', "\\", '"', "'", '?', '*', '>', '<', '|', ':', '$', '(', ')', '^', '[', ']', '#', '+', '&', '%'); $search = array("\0", "\t", "\n", "\r", "\x0B", '/', "\\", '"', "'", '?', '*', '>', '<', '|', ':', '$', '(', ')', '^', '[', ']', '#', '+', '&', '%');
$replace = array('', '_', '_', '_', '_', '-', '-', '-', '_', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-'); $replace = array('', '_', '_', '_', '_', '-', '-', '-', '_', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-', '-');
@ -466,7 +467,8 @@ function downloadMP3_pediaphon($filepath, $dir){
// Transliteration to ASCII letters, they are not dangerous for filesystems. // Transliteration to ASCII letters, they are not dangerous for filesystems.
$filename = api_transliterate($filename, 'x', $encoding); $filename = api_transliterate($filename, 'x', $encoding);
// Replacing remaining dangerous non-letter characters. // Replacing remaining dangerous non-letter characters.
$clean_text = str_replace($search, $replace, $filename); $clean_text = str_replace($search, $replace, $filename);*/
$clean_text = api_replace_dangerous_char($clean_text);
//adding the file //adding the file

4
main/document/create_document.php
Unescape View File

@ -253,7 +253,7 @@ $form->addElement('hidden', 'title_edited', 'false', 'id="title_edited"');
function document_exists($filename) { function document_exists($filename) {
global $dir; global $dir;
// Clean up the name, only ASCII characters should stay. (and strict) // Clean up the name, only ASCII characters should stay. (and strict)
$cleanName = replace_dangerous_char($filename, 'strict'); $cleanName = api_replace_dangerous_char($filename, 'strict');
// No "dangerous" files // No "dangerous" files
$cleanName = disable_dangerous_file($cleanName); $cleanName = disable_dangerous_file($cleanName);
@ -409,7 +409,7 @@ if ($form->validate()) {
$filename = $values['title']; $filename = $values['title'];
$filename = addslashes(trim($filename)); $filename = addslashes(trim($filename));
$filename = Security::remove_XSS($filename); $filename = Security::remove_XSS($filename);
$filename = replace_dangerous_char($filename); $filename = api_replace_dangerous_char($filename);
$filename = disable_dangerous_file($filename); $filename = disable_dangerous_file($filename);
$filename .= DocumentManager::getDocumentSuffix( $filename .= DocumentManager::getDocumentSuffix(
$_course, $_course,

2
main/document/document.php
Unescape View File

@ -1254,7 +1254,7 @@ if ($is_allowed_to_edit ||
$curdirpath = $document_data['path']; $curdirpath = $document_data['path'];
} }
$added_slash = ($curdirpath == '/') ? '' : '/'; $added_slash = ($curdirpath == '/') ? '' : '/';
$dir_name = $curdirpath.$added_slash.replace_dangerous_char($post_dir_name); $dir_name = $curdirpath.$added_slash.api_replace_dangerous_char($post_dir_name);
$dir_name = disable_dangerous_file($dir_name); $dir_name = disable_dangerous_file($dir_name);
$dir_check = $base_work_dir.$dir_name; $dir_check = $base_work_dir.$dir_name;
$visibility = empty($groupId) ? null : 1; $visibility = empty($groupId) ? null : 1;

36
main/document/save_pixlr.php
Unescape View File

@ -28,7 +28,7 @@ if(!isset($_GET['title']) || !isset($_GET['type']) || !isset($_GET['image'])) {
if(!isset($_SESSION['paint_dir']) || !isset($_SESSION['whereami']) ){ if(!isset($_SESSION['paint_dir']) || !isset($_SESSION['whereami']) ){
api_not_allowed(); api_not_allowed();
die(); die();
} }
//pixlr return //pixlr return
@ -68,7 +68,7 @@ $contents = file_get_contents($urlcontents_to_save);//replace line 45.
//a bit title security //a bit title security
$filename = addslashes(trim($filename)); $filename = addslashes(trim($filename));
$filename = Security::remove_XSS($filename); $filename = Security::remove_XSS($filename);
$filename = replace_dangerous_char($filename, 'strict'); $filename = api_replace_dangerous_char($filename, 'strict');
$filename = disable_dangerous_file($filename); $filename = disable_dangerous_file($filename);
if (strlen(trim($filename))==0) { if (strlen(trim($filename))==0) {
@ -77,7 +77,7 @@ if (strlen(trim($filename))==0) {
} }
//check file_get_contents //check file_get_contents
if ($contents === false) { if ($contents === false) {
echo "I cannot read: ".$urlcontents; echo "I cannot read: ".$urlcontents;
exit; exit;
} }
@ -113,22 +113,22 @@ if(strpos($current_mime, 'image')===false) {
$paintFileName = $filename.'.'.$extension; $paintFileName = $filename.'.'.$extension;
$title = $title.'.'.$extension; $title = $title.'.'.$extension;
if($currentTool=='document/createpaint'){ if($currentTool=='document/createpaint'){
//check save as and prevent rewrite an older file with same name //check save as and prevent rewrite an older file with same name
if (0 != $groupId){ if (0 != $groupId){
$group_properties = GroupManager :: get_group_properties($groupId); $group_properties = GroupManager :: get_group_properties($groupId);
$groupPath = $group_properties['directory']; $groupPath = $group_properties['directory'];
} else { } else {
$groupPath =''; $groupPath ='';
} }
if (file_exists($saveDir.'/'.$filename.'.'.$extension)){ if (file_exists($saveDir.'/'.$filename.'.'.$extension)){
$i = 1; $i = 1;
while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++; while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++;
$paintFileName = $filename . '_' . $i . '.'.$extension; $paintFileName = $filename . '_' . $i . '.'.$extension;
$title = $filename . '_' . $i . '.'.$extension; $title = $filename . '_' . $i . '.'.$extension;
} }
// //
$documentPath = $saveDir.'/'.$paintFileName; $documentPath = $saveDir.'/'.$paintFileName;
//add new document to disk //add new document to disk
@ -138,25 +138,25 @@ if($currentTool=='document/createpaint'){
api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id); api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
}elseif($currentTool=='document/editpaint'){ }elseif($currentTool=='document/editpaint'){
$documentPath = $saveDir.'/'.$paintFileName; $documentPath = $saveDir.'/'.$paintFileName;
//add new document to disk //add new document to disk
file_put_contents( $documentPath, $contents ); file_put_contents( $documentPath, $contents );
//check path //check path
if(!isset($_SESSION['paint_file'])){ if(!isset($_SESSION['paint_file'])){
api_not_allowed(); api_not_allowed();
die(); die();
} }
if($_SESSION['paint_file']==$paintFileName){ if($_SESSION['paint_file']==$paintFileName){
$document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName); $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName);
update_existing_document($_course, $document_id, filesize($documentPath), null); update_existing_document($_course, $document_id, filesize($documentPath), null);
api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id); api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id);
}else{ }else{
//add a new document //add a new document
$doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title); $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id); api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
} }
} }
@ -172,11 +172,11 @@ unset($_SESSION['temp_realpath_image']);
if (!isset($_SESSION['exit_pixlr'])) { if (!isset($_SESSION['exit_pixlr'])) {
$location=api_get_path(WEB_CODE_PATH).'document/document.php'; $location=api_get_path(WEB_CODE_PATH).'document/document.php';
echo '<script>window.parent.location.href="'.$location.'"</script>'; echo '<script>window.parent.location.href="'.$location.'"</script>';
api_not_allowed(true); api_not_allowed(true);
} else { } else {
echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>'; echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>';
$location=api_get_path(WEB_CODE_PATH).'document/document.php?id='.Security::remove_XSS($_SESSION['exit_pixlr']); $location=api_get_path(WEB_CODE_PATH).'document/document.php?id='.Security::remove_XSS($_SESSION['exit_pixlr']);
echo '<script>window.parent.location.href="'.$location.'"</script>'; echo '<script>window.parent.location.href="'.$location.'"</script>';
unset($_SESSION['exit_pixlr']); unset($_SESSION['exit_pixlr']);
} }

2
main/dropbox/dropbox_functions.inc.php
Unescape View File

@ -836,7 +836,7 @@ function store_add_dropbox()
// Try to add an extension to the file if it hasn't got one // Try to add an extension to the file if it hasn't got one
$dropbox_filename = add_ext_on_mime($dropbox_filename, $dropbox_filetype); $dropbox_filename = add_ext_on_mime($dropbox_filename, $dropbox_filetype);
// Replace dangerous characters // Replace dangerous characters
$dropbox_filename = replace_dangerous_char($dropbox_filename); $dropbox_filename = api_replace_dangerous_char($dropbox_filename);
// Transform any .php file in .phps fo security // Transform any .php file in .phps fo security
$dropbox_filename = php2phps($dropbox_filename); $dropbox_filename = php2phps($dropbox_filename);

2
main/exercice/hotpotatoes.php
Unescape View File

@ -100,7 +100,7 @@ if ((api_is_allowed_to_edit(null, true)) && (($finish == 0) || ($finish == 2)))
if ($finish == 0) { if ($finish == 0) {
// Generate new test folder if on first step of file upload. // Generate new test folder if on first step of file upload.
$filename = replace_dangerous_char(trim($_FILES['userFile']['name']), 'strict'); $filename = api_replace_dangerous_char(trim($_FILES['userFile']['name']), 'strict');
$fld = GenerateHpFolder($document_sys_path.$uploadPath.'/'); $fld = GenerateHpFolder($document_sys_path.$uploadPath.'/');
//$doc_id = add_document($_course, '/HotPotatoes_files/'.$fld, 'folder', 0, $fld); //$doc_id = add_document($_course, '/HotPotatoes_files/'.$fld, 'folder', 0, $fld);

2
main/gradebook/lib/fe/exportgradebook.php
Unescape View File

@ -205,7 +205,7 @@ function export_pdf_attendance($headers_table, $data_table, $headers_pdf, $foote
} else { } else {
$mpdf->WriteHTML($html); $mpdf->WriteHTML($html);
} }
$mpdf->Output(replace_dangerous_char($title_pdf.'.pdf'), 'D'); $mpdf->Output(api_replace_dangerous_char($title_pdf.'.pdf'), 'D');
exit; exit;
} }

16
main/inc/lib/course.lib.php
Unescape View File

@ -5413,20 +5413,20 @@ class CourseManager
* Generates a course code from a course title * Generates a course code from a course title
* @todo Such a function might be useful in other places too. It might be moved in the CourseManager class. * @todo Such a function might be useful in other places too. It might be moved in the CourseManager class.
* @todo the function might be upgraded for avoiding code duplications (currently, it might suggest a code that is already in use) * @todo the function might be upgraded for avoiding code duplications (currently, it might suggest a code that is already in use)
* @param string A course title * @param string $title A course title
* @param string The course title encoding (defaults to type defined globally)
* @return string A proposed course code * @return string A proposed course code
* +
* @assert (null,null) === false * @assert (null,null) === false
* @assert ('ABC_DEF', null) === 'ABCDEF' * @assert ('ABC_DEF', null) === 'ABCDEF'
* @assert ('ABC09*^[%A', null) === 'ABC09A' * @assert ('ABC09*^[%A', null) === 'ABC09A'
*/ */
public static function generate_course_code($course_title, $encoding = null) public static function generate_course_code($title)
{ {
if (empty($encoding)) { return substr(
$encoding = api_get_system_encoding(); preg_replace('/[^A-Z0-9]/', '', strtoupper(api_replace_dangerous_char($title))),
} 0,
return substr(preg_replace('/[^A-Z0-9]/', '', strtoupper(api_transliterate($course_title, 'X', $encoding))), 0, CourseManager::MAX_COURSE_LENGTH_CODE
CourseManager::MAX_COURSE_LENGTH_CODE); );
} }
/** /**

2
main/mySpace/user_add.php
Unescape View File

@ -231,7 +231,7 @@ if ($form->validate()) {
if (!is_dir(api_get_path(SYS_CODE_PATH).'upload/users/')) { if (!is_dir(api_get_path(SYS_CODE_PATH).'upload/users/')) {
mkdir(api_get_path(SYS_CODE_PATH).'upload/users/', api_get_permissions_for_new_directories()); mkdir(api_get_path(SYS_CODE_PATH).'upload/users/', api_get_permissions_for_new_directories());
} }
$picture_uri = uniqid('').'_'.replace_dangerous_char($picture['name']); $picture_uri = uniqid('').'_'.api_replace_dangerous_char($picture['name']);
$picture_location = api_get_path(SYS_CODE_PATH).'upload/users/'.$picture_uri; $picture_location = api_get_path(SYS_CODE_PATH).'upload/users/'.$picture_uri;
move_uploaded_file($picture['tmp_name'], $picture_location); move_uploaded_file($picture['tmp_name'], $picture_location);
} }

Write Preview
Loading…
Cancel
Save