chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

[svn r21119] logic changes - security improvements in file whoisonline - (partial FS#4261)

Browse Source
skala
Isaac Flores 17 years ago
parent f07d5e34c9
commit 339ce68566
1 changed files with 8 additions and 7 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 9
      whoisonline.php

9
whoisonline.php
Unescape View File

@ -1,4 +1,4 @@
<?php // $Id: whoisonline.php 21076 2009-05-29 16:36:04Z aportugal $ <?php // $Id: whoisonline.php 21119 2009-05-30 22:58:11Z iflorespaz $
/* /*
============================================================================== ==============================================================================
Dokeos - elearning and course management software Dokeos - elearning and course management software
@ -117,12 +117,13 @@ if ($_GET['chatid'] != '') {
$time = time(); $time = time();
$time = date("Y-m-d H:i:s", $time); $time = date("Y-m-d H:i:s", $time);
$chatid = addslashes($_GET['chatid']); $chatid = addslashes($_GET['chatid']);
$sql="update $track_user_table set chatcall_user_id = '".Database::escape_string($_user['user_id'])."', chatcall_date = '".Database::escape_string($time)."', chatcall_text = '' where (user_id = ".Database::escape_string($chatid).")"; if ($_GET['chatid']==strval(intval($_GET['chatid']))) {
$sql="update $track_user_table set chatcall_user_id = '".Database::escape_string($_user['user_id'])."', chatcall_date = '".Database::escape_string($time)."', chatcall_text = '' where (user_id = ".(int)Database::escape_string($chatid).")";
$result=api_sql_query($sql,__FILE__,__LINE__); $result=api_sql_query($sql,__FILE__,__LINE__);
//redirect caller to chat //redirect caller to chat
header("Location: ".$_configuration['code_append']."chat/chat.php?".api_get_cidreq()."&origin=whoisonline&target=".Security::remove_XSS($chatid)); header("Location: ".$_configuration['code_append']."chat/chat.php?".api_get_cidreq()."&origin=whoisonline&target=".Security::remove_XSS($chatid));
exit(); exit;
}
} }

Write Preview
Loading…
Cancel
Save