[svn r21903] Cleaning code and Database::escape_string & Security::remove_XSS functions added see FS#4389

main/announcements/announcements.inc.php

@@ -1,4 +1,4 @@
-<?php //$Id: announcements.inc.php 20791 2009-05-18 17:47:11Z iflorespaz $
+<?php //$Id: announcements.inc.php 21903 2009-07-08 17:28:02Z juliomontoya $
 /*
 ==============================================================================
 	Dokeos - elearning and course management software
@@ -340,6 +340,9 @@ function load_edit_users($tool, $id)
 	global $_course;
 	global $tbl_item_property;
 	
+	$tool = Database::escape_string($tool);
+	$id = Database::escape_string($id);
+	
 	$sql="SELECT * FROM $tbl_item_property WHERE tool='$tool' AND ref='$id'";
 	$result=api_sql_query($sql,__FILE__,__LINE__) or die (mysql_error());
 	while ($row=Database::fetch_array($result))
@@ -632,12 +635,9 @@ function sent_to_form($sent_to_array)
 */
 function separate_users_groups($to)
 {
-	foreach($to as $to_item)
+	foreach($to as $to_item) {
-	{
 		list($type, $id) = explode(':', $to_item);
-
+		switch($type) {
-		switch($type)
-		{
 			case 'GROUP':
 				$grouplist[] =$id;
 				break;
@@ -665,12 +665,18 @@ function sent_to($tool, $id)
 {
 	global $_course;
 	global $tbl_item_property;
-
+	
+	$tool = Database::escape_string($tool);
+	$id = Database::escape_string($id);
+	
+	$sent_to_group = array();
+	$sent_to = array();	
+	
 	$sql="SELECT * FROM $tbl_item_property WHERE tool='$tool' AND ref='".$id."'";
 	$result = api_sql_query($sql,__FILE__,__LINE__);
 
-	while ($row=Database::fetch_array($result))
+	
-	{
+	while ($row=Database::fetch_array($result)) {
 		// if to_group_id is null then it is sent to a specific user
 		// if to_group_id = 0 then it is sent to everybody
 		if (!is_null($row['to_group_id']))
@@ -707,7 +713,10 @@ function change_visibility_announcement($tool,$id)
 {
 	global $_course;
 	global $tbl_item_property;	
-
+	
+	$tool = Database::escape_string($tool);
+	$id = Database::escape_string($id);
+	
 	$sql="SELECT * FROM $tbl_item_property WHERE tool='$tool' AND ref='$id'";
 
 	$result=api_sql_query($sql,__FILE__,__LINE__) or die (mysql_error());
@@ -766,7 +775,7 @@ function store_advalvas_item($emailTitle,$newContent, $order, $to)
 		{
 			foreach ($send_to['users'] as $user)
 			{
-					api_item_property_update($_course, TOOL_ANNOUNCEMENT, $last_id, "AnnouncementAdded", $_user['user_id'], '', $user);
+				api_item_property_update($_course, TOOL_ANNOUNCEMENT, $last_id, "AnnouncementAdded", $_user['user_id'], '', $user);
 			}
 		}
 	}
@@ -793,7 +802,7 @@ function store_advalvas_group_item($emailTitle,$newContent, $order, $to, $to_use
 	$emailTitle = Database::escape_string(Security::remove_XSS($emailTitle));
 	$newContent = Database::escape_string(Security::remove_XSS($newContent,COURSEMANAGERLOWSECURITY));
 	$order = intval($order);
-	// store in the table announcement
+	// store in the table announcement	
 	$sql = "INSERT INTO $tbl_announcement SET content = '$newContent', title = '$emailTitle', end_date = NOW(), display_order ='$order', session_id=".intval($_SESSION['id_session']);
 	$result = api_sql_query($sql,__FILE__,__LINE__) or die (mysql_error());
 	$last_id= Database::get_last_insert_id();
@@ -901,14 +910,11 @@ function send_announcement_email($user_list, $course_code, $_course, $mail_title
 	global $charset;
 	global $_user;
 			
-	foreach ($user_list as $this_user)
+	foreach ($user_list as $this_user) {
-	{
+		/*  Header : Bericht van uw lesgever - GES ($course_code) - Morgen geen les! ($mail_title)
-		/*    Header : Bericht van uw lesgever - GES ($course_code) - Morgen geen les! ($mail_title)
+			Body :  John Doe (prenom + nom) <john_doe@hotmail.com> (email)
-				Body :   John Doe (prenom + nom) <john_doe@hotmail.com> (email)
+					Morgen geen les! ($mail_title)
-
+					Morgen is er geen les, de les wordt geschrapt wegens vergadering (newContent)
-						Morgen geen les! ($mail_title)
-
-						Morgen is er geen les, de les wordt geschrapt wegens vergadering (newContent)
 		*/
 		$mail_subject = get_lang('professorMessage').' - '.$_course['official_code'].' - '.$mail_title;
 
@@ -931,41 +937,52 @@ function update_mail_sent($insert_id)
 {
 	global $_course;
 	global $tbl_announcement;
-
+	if ($insert_id != strval(intval($insert_id))) { return false; } 
+	$insert_id = Database::escape_string($insert_id);
 	// store the modifications in the table tbl_annoucement
 	$sql = "UPDATE $tbl_announcement SET email_sent='1' WHERE id='$insert_id'";
 	api_sql_query($sql,__FILE__,__LINE__);
 }
 
+/**
+ * Gets all announcements from a user by course 
+ * @param	string course db
+ * @param	int user id 
+ * @return	string an html with the content
+ */
 function get_all_annoucement_by_user_course($course_db, $user_id)
 {	
 	$tbl_announcement		= Database::get_course_table(TABLE_ANNOUNCEMENT, $course_db);
 	$tbl_item_property  	= Database::get_course_table(TABLE_ITEM_PROPERTY, $course_db);
-
+	if (!empty($user_id) && is_numeric($user_id)) {
-	$sql="SELECT announcement.*, toolitemproperties.*
+		$user_id = Database::escape_string($user_id);
-					FROM $tbl_announcement announcement, $tbl_item_property toolitemproperties
+		$sql="SELECT announcement.*, toolitemproperties.*
-					WHERE announcement.id = toolitemproperties.ref
+						FROM $tbl_announcement announcement, $tbl_item_property toolitemproperties
-					AND toolitemproperties.tool='announcement'
+						WHERE announcement.id = toolitemproperties.ref
-					AND (toolitemproperties.insert_user_id='".$user_id."' AND toolitemproperties.to_group_id='0')
+						AND toolitemproperties.tool='announcement'
-					AND toolitemproperties.visibility='1'
+						AND (toolitemproperties.insert_user_id='".$user_id."' AND toolitemproperties.to_group_id='0')
-					AND announcement.session_id  = 0
+						AND toolitemproperties.visibility='1'
-					ORDER BY display_order DESC";
+						AND announcement.session_id  = 0
-	$result = api_sql_query($sql,__FILE__,__LINE__);
+						ORDER BY display_order DESC";
-	$num_rows = Database::num_rows($result);
+		$result = api_sql_query($sql,__FILE__,__LINE__);
-	$content = '';
+		$num_rows = Database::num_rows($result);
-	$i=0;
+		$content = '';
-	if (Database::num_rows($result)>0) {
+		$i=0;
-		while ($myrow = Database::fetch_array($result)) {
+		if (Database::num_rows($result)>0) {
-			if ($i<=4) {
+			while ($myrow = Database::fetch_array($result)) {
-				$content.= '<strong>'.$myrow['title'].'</strong><br /><br />';
+				if ($i<=4) {
-				$content.= $myrow['content'];
+					$content.= '<strong>'.$myrow['title'].'</strong><br /><br />';
-			} else {
+					$content.= $myrow['content'];
-				break;
+				} else {
+					break;
+				}
+				$i++;
 			}
-			$i++;
+			return $content;
+		} else {
+			return $content;
 		}
-		return $content;
 	} else {
-		return $content;
+		return '';
 	}
 }