chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

allow the new youtube src when copy from it and avoid xss security from google chrome when there is an iframe - refs BT#7930

Browse Source
1.9.x
Francis Gonzales 12 years ago
parent 9d0baf39ed
commit 388bdff34f
2 changed files with 99 additions and 94 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 187
      main/course_description/course_description_controller.php
  2. 6
      main/inc/lib/htmlpurifier/library/HTMLPurifier/Filter/AllowIframes.php

187
main/course_description/course_description_controller.php
Unescape View File

@ -38,13 +38,19 @@ class CourseDescriptionController { // extends Controller {
$data = array();
$course_description_data = $course_description->get_description_data();
$data['descriptions'] = $course_description_data['descriptions'];
$data['default_description_titles'] = $course_description->get_default_description_title();
$data['default_description_title_editable'] = $course_description->get_default_description_title_editable();
$data['default_description_icon'] = $course_description->get_default_description_icon();
$data['messages'] = $messages;
$browser = api_get_navigator();
if (strpos($data['descriptions'], '<iframe') !== false && $browser['name'] == 'Chrome') {
header("X-XSS-Protection: 0");
}
// render to the view
$this->view->set_data($data);
$this->view->set_layout('layout');
@ -57,97 +63,96 @@ class CourseDescriptionController { // extends Controller {
* render to listing or edit view
* @param int description type
*/
public function edit($id, $description_type) {
$course_description = new CourseDescription();
$session_id = api_get_session_id();
$course_description->set_session_id($session_id);
$data = array();
$data['id'] = $id;
if (strtoupper($_SERVER['REQUEST_METHOD']) == "POST") {
if (!empty($_POST['title']) && !empty($_POST['contentDescription'])) {
$check = Security::check_token();
if ($check) {
$title = $_POST['title'];
if (api_get_setting('wcag_anysurfer_public_pages')=='true') {
$content = WCAG_Rendering::prepareXHTML();
} else {
$content = $_POST['contentDescription'];
}
$description_type = $_POST['description_type'];
$id = $_POST['id'];
$progress = $_POST['progress'];
$course_description->set_description_type($description_type);
$course_description->set_title($title);
$course_description->set_content($content);
$course_description->set_progress($progress);
$thematic_advance = $course_description->get_data_by_id($id);
if (!empty($thematic_advance)) {
$course_description->set_id($id);
$affected_rows = $course_description->update();
} else {
$affected_rows = $course_description->insert();
public function edit($id, $description_type)
{
$course_description = new CourseDescription();
$session_id = api_get_session_id();
$course_description->set_session_id($session_id);
$data = array();
$data['id'] = $id;
if (strtoupper($_SERVER['REQUEST_METHOD']) == "POST") {
if (!empty($_POST['title']) && !empty($_POST['contentDescription'])) {
$check = Security::check_token();
if ($check) {
$title = $_POST['title'];
if (api_get_setting('wcag_anysurfer_public_pages') == 'true') {
$content = WCAG_Rendering::prepareXHTML();
} else {
$content = $_POST['contentDescription'];
}
$description_type = $_POST['description_type'];
$id = $_POST['id'];
$progress = $_POST['progress'];
$course_description->set_description_type($description_type);
$course_description->set_title($title);
$course_description->set_content($content);
$course_description->set_progress($progress);
$thematic_advance = $course_description->get_data_by_id($id);
if (!empty($thematic_advance)) {
$course_description->set_id($id);
$affected_rows = $course_description->update();
} else {
$affected_rows = $course_description->insert();
}
Security::clear_token();
}
Security::clear_token();
}
if ($affected_rows) {
$message['edit'] = true;
}
$this->listing(false,$message);
} else {
$data['error'] = 1;
$data['default_description_titles'] = $course_description->get_default_description_title();
$data['default_description_title_editable'] = $course_description->get_default_description_title_editable();
$data['default_description_icon'] = $course_description->get_default_description_icon();
$data['question'] = $course_description->get_default_question();
$data['information'] = $course_description->get_default_information();
$data['description_title'] = $_POST['title'];
$data['description_content'] = $_POST['contentDescription'];
$data['description_type'] = $_POST['description_type'];
$data['progress'] = $_POST['progress'];
$data['descriptions'] = $course_description->get_data_by_id($_POST['id']);
// render to the view
$this->view->set_data($data);
$this->view->set_layout('layout');
$this->view->set_template('edit');
$this->view->render();
}
} else {
$data['default_description_titles'] = $course_description->get_default_description_title();
$data['default_description_title_editable'] = $course_description->get_default_description_title_editable();
$data['default_description_icon'] = $course_description->get_default_description_icon();
$data['question'] = $course_description->get_default_question();
$data['information'] = $course_description->get_default_information();
$data['description_type'] = $description_type;
if (!empty($id)) {
if (isset($_GET['id_session'])) {
$session_id = intval($_GET['id_session']);
}
$course_description_data = $course_description->get_data_by_id($id, null, $session_id);
$data['description_type'] = $course_description_data['description_type'];
$data['description_title'] = $course_description_data['description_title'];
$data['description_content'] = $course_description_data['description_content'];
$data['progress'] = $course_description_data['progress'];
$data['descriptions'] = $course_description->get_data_by_description_type($description_type, null, $session_id);
}
// render to the view
$this->view->set_data($data);
$this->view->set_layout('layout');
$this->view->set_template('edit');
$this->view->render();
if ($affected_rows) {
$message['edit'] = true;
}
$this->listing(false, $message);
} else {
$data['error'] = 1;
$data['default_description_titles'] = $course_description->get_default_description_title();
$data['default_description_title_editable'] = $course_description->get_default_description_title_editable();
$data['default_description_icon'] = $course_description->get_default_description_icon();
$data['question'] = $course_description->get_default_question();
$data['information'] = $course_description->get_default_information();
$data['description_title'] = $_POST['title'];
$data['description_content'] = $_POST['contentDescription'];
$data['description_type'] = $_POST['description_type'];
$data['progress'] = $_POST['progress'];
$data['descriptions'] = $course_description->get_data_by_id($_POST['id']);
// render to the view
$this->view->set_data($data);
$this->view->set_layout('layout');
$this->view->set_template('edit');
$this->view->render();
}
} else {
$data['default_description_titles'] = $course_description->get_default_description_title();
$data['default_description_title_editable'] = $course_description->get_default_description_title_editable();
$data['default_description_icon'] = $course_description->get_default_description_icon();
$data['question'] = $course_description->get_default_question();
$data['information'] = $course_description->get_default_information();
$data['description_type'] = $description_type;
if (!empty($id)) {
if (isset($_GET['id_session'])) {
$session_id = intval($_GET['id_session']);
}
$course_description_data = $course_description->get_data_by_id($id, null, $session_id);
$data['description_type'] = $course_description_data['description_type'];
$data['description_title'] = $course_description_data['description_title'];
$data['description_content'] = $course_description_data['description_content'];
$data['progress'] = $course_description_data['progress'];
$data['descriptions'] = $course_description->get_data_by_description_type($description_type, null, $session_id);
}
// render to the view
$this->view->set_data($data);
$this->view->set_layout('layout');
$this->view->set_template('edit');
$this->view->render();
}
}
}
/**
/**
* It's used for adding a course description,
* render to listing or add view
*/

6
main/inc/lib/htmlpurifier/library/HTMLPurifier/Filter/AllowIframes.php
Unescape View File

@ -46,14 +46,14 @@ class HTMLPurifier_Filter_AllowIframes extends HTMLPurifier_Filter
protected function postFilterCallback($matches)
{
// Domain Whitelist
$youTubeNewMatch = preg_match('#src="//www.youtube(-nocookie)?.com/#i', $matches[1]);
$youTubeMatch = preg_match('#src="https?://www.youtube(-nocookie)?.com/#i', $matches[1]);
$vimeoMatch = preg_match('#src="http://player.vimeo.com/#i', $matches[1]);
$googleMapsMatch = preg_match('#src="https://maps.google.com/#i', $matches[1]);
if ($youTubeMatch || $vimeoMatch || $googleMapsMatch) {
if ($youTubeMatch || $vimeoMatch || $googleMapsMatch || $youTubeNewMatch) {
$extra = ' frameborder="0"';
if ($youTubeMatch) {
if ($youTubeMatch || $youTubeNewMatch) {
$extra .= ' allowfullscreen';
} elseif ($vimeoMatch) {
$extra .= ' webkitAllowFullScreen mozallowfullscreen allowFullScreen';

Write Preview
Loading…
Cancel
Save