chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

[svn r20567] Correction html purifier see FS#4169

Browse Source
skala
Carlos Vargas 17 years ago
parent 8940be1155
commit 4d9d5abe27
3 changed files with 19 additions and 14 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 12
      main/announcements/announcements.inc.php
  2. 6
      main/announcements/announcements.php
  3. 15
      main/calendar/agenda.inc.php

12
main/announcements/announcements.inc.php
Unescape View File

@ -1,4 +1,4 @@
<?php //$Id: announcements.inc.php 20519 2009-05-12 00:27:20Z cvargas1 $ <?php //$Id: announcements.inc.php 20567 2009-05-12 21:10:13Z cvargas1 $
/* /*
============================================================================== ==============================================================================
Dokeos - elearning and course management software Dokeos - elearning and course management software
@ -739,9 +739,9 @@ function store_advalvas_item($emailTitle,$newContent, $order, $to)
global $tbl_announcement; global $tbl_announcement;
global $tbl_item_property; global $tbl_item_property;
$newContent=stripslashes($newContent);
$emailTitle = Database::escape_string(Security::remove_XSS($emailTitle)); $emailTitle = Database::escape_string(Security::remove_XSS($emailTitle));
$newContent = Database::escape_string(Security::remove_XSS($newContent)); $newContent = Database::escape_string(Security::remove_XSS($newContent,COURSEMANAGER));
$order = intval($order); $order = intval($order);
// store in the table announcement // store in the table announcement
$sql = "INSERT INTO $tbl_announcement SET content = '$newContent', title = '$emailTitle', end_date = NOW(), display_order ='$order', session_id=".intval($_SESSION['id_session']); $sql = "INSERT INTO $tbl_announcement SET content = '$newContent', title = '$emailTitle', end_date = NOW(), display_order ='$order', session_id=".intval($_SESSION['id_session']);
@ -789,8 +789,9 @@ function store_advalvas_group_item($emailTitle,$newContent, $order, $to, $to_use
global $tbl_announcement; global $tbl_announcement;
global $tbl_item_property; global $tbl_item_property;
$newContent=stripslashes($newContent);
$emailTitle = Database::escape_string(Security::remove_XSS($emailTitle)); $emailTitle = Database::escape_string(Security::remove_XSS($emailTitle));
$newContent = Database::escape_string(Security::remove_XSS($newContent)); $newContent = Database::escape_string(Security::remove_XSS($newContent,COURSEMANAGER));
$order = intval($order); $order = intval($order);
// store in the table announcement // store in the table announcement
$sql = "INSERT INTO $tbl_announcement SET content = '$newContent', title = '$emailTitle', end_date = NOW(), display_order ='$order', session_id=".intval($_SESSION['id_session']); $sql = "INSERT INTO $tbl_announcement SET content = '$newContent', title = '$emailTitle', end_date = NOW(), display_order ='$order', session_id=".intval($_SESSION['id_session']);
@ -844,8 +845,9 @@ function edit_advalvas_item($id,$emailTitle,$newContent,$to)
global $tbl_announcement; global $tbl_announcement;
global $tbl_item_property; global $tbl_item_property;
$newContent=stripslashes($newContent);
$emailTitle = Database::escape_string(Security::remove_XSS($emailTitle)); $emailTitle = Database::escape_string(Security::remove_XSS($emailTitle));
$newContent = Database::escape_string(Security::remove_XSS($newContent)); $newContent = Database::escape_string(Security::remove_XSS($newContent,COURSEMANAGER));
// store the modifications in the table announcement // store the modifications in the table announcement
$sql = "UPDATE $tbl_announcement SET content='$newContent', title = '$emailTitle' WHERE id='$id'"; $sql = "UPDATE $tbl_announcement SET content='$newContent', title = '$emailTitle' WHERE id='$id'";

6
main/announcements/announcements.php
Unescape View File

@ -1,4 +1,4 @@
<?php //$Id: announcements.php 20500 2009-05-11 21:41:20Z cfasanando $ <?php //$Id: announcements.php 20567 2009-05-12 21:10:13Z cvargas1 $
/* /*
============================================================================== ==============================================================================
Dokeos - elearning and course management software Dokeos - elearning and course management software
@ -156,8 +156,8 @@ require_once(api_get_path(LIBRARY_PATH) . '/fckeditor/fckeditor.php');
----------------------------------------------------------- -----------------------------------------------------------
*/ */
$safe_emailTitle = Security::remove_XSS($_POST['emailTitle']); $safe_emailTitle = $_POST['emailTitle'];
$safe_newContent = Security::remove_XSS($_POST['newContent'],COURSEMANAGER); $safe_newContent = $_POST['newContent'];
if (!empty($_POST['To'])) if (!empty($_POST['To']))
{ {

15
main/calendar/agenda.inc.php
Unescape View File

@ -1,4 +1,4 @@
<?php //$Id: agenda.inc.php 20520 2009-05-12 00:34:16Z yannoo $ <?php //$Id: agenda.inc.php 20567 2009-05-12 21:10:13Z cvargas1 $
/* For licensing terms, see /dokeos_license.txt */ /* For licensing terms, see /dokeos_license.txt */
/* /*
============================================================================== ==============================================================================
@ -969,8 +969,9 @@ function store_new_agenda_item() {
$start_date=(int)$_POST['fyear']."-".(int)$_POST['fmonth']."-".(int)$_POST['fday']." ".(int)$_POST['fhour'].":".(int)$_POST['fminute'].":00"; $start_date=(int)$_POST['fyear']."-".(int)$_POST['fmonth']."-".(int)$_POST['fday']." ".(int)$_POST['fhour'].":".(int)$_POST['fminute'].":00";
$end_date=(int)$_POST['end_fyear']."-".(int)$_POST['end_fmonth']."-".(int)$_POST['end_fday']." ".(int)$_POST['end_fhour'].":".(int)$_POST['end_fminute'].":00"; $end_date=(int)$_POST['end_fyear']."-".(int)$_POST['end_fmonth']."-".(int)$_POST['end_fday']." ".(int)$_POST['end_fhour'].":".(int)$_POST['end_fminute'].":00";
$content=stripslashes($content);
$title=Database::escape_string(Security::remove_XSS($title)); $title=Database::escape_string(Security::remove_XSS($title));
$content=Database::escape_string(Security::remove_XSS($content)); $content = Database::escape_string(Security::remove_XSS($content,COURSEMANAGER));
$start_date=Database::escape_string($start_date); $start_date=Database::escape_string($start_date);
$end_date=Database::escape_string($end_date); $end_date=Database::escape_string($end_date);
@ -1057,7 +1058,7 @@ function store_agenda_item_as_announcement($item_id){
//insert announcement //insert announcement
$sql_ins = "INSERT INTO $table_ann (title,content,end_date,display_order) " . $sql_ins = "INSERT INTO $table_ann (title,content,end_date,display_order) " .
"VALUES ('".Security::remove_XSS($row['title'])."','".Security::remove_XSS($content)."','".$row['end_date']."','$max')"; "VALUES ('".Security::remove_XSS($row['title'])."','".$content."','".$row['end_date']."','$max')";
$res_ins = api_sql_query($sql_ins,__FILE__,__LINE__); $res_ins = api_sql_query($sql_ins,__FILE__,__LINE__);
if($res > 0) if($res > 0)
{ {
@ -1623,7 +1624,8 @@ function save_edit_agenda_item($id,$title,$content,$start_date,$end_date)
$TABLEAGENDA = Database::get_course_table(TABLE_AGENDA); $TABLEAGENDA = Database::get_course_table(TABLE_AGENDA);
$id=Database::escape_string($id); $id=Database::escape_string($id);
$title=Database::escape_string(Security::remove_XSS($title)); $title=Database::escape_string(Security::remove_XSS($title));
$content=Database::escape_string(Security::remove_XSS($content)); $content=stripslashes($content);
$content = Database::escape_string(Security::remove_XSS($content,COURSEMANAGER));
$start_date=Database::escape_string($start_date); $start_date=Database::escape_string($start_date);
$end_date=Database::escape_string($end_date); $end_date=Database::escape_string($end_date);
@ -4313,8 +4315,9 @@ function agenda_add_item($course_info, $title, $content, $db_start_date, $db_end
$item_property = Database::get_course_table(TABLE_ITEM_PROPERTY); $item_property = Database::get_course_table(TABLE_ITEM_PROPERTY);
// some filtering of the input data // some filtering of the input data
$title = Database::escape_string(Security::remove_XSS($title)); // no html allowed in the title $content=stripslashes($content);
$content = Database::escape_string(Security::remove_XSS($content)); $title=Database::escape_string(Security::remove_XSS($title));
$content = Database::escape_string(Security::remove_XSS($content,COURSEMANAGER));
$start_date = Database::escape_string($db_start_date); $start_date = Database::escape_string($db_start_date);
$end_date = Database::escape_string($db_end_date); $end_date = Database::escape_string($db_end_date);
isset($_SESSION['id_session'])?$id_session=intval($_SESSION['id_session']):$id_session=null; isset($_SESSION['id_session'])?$id_session=intval($_SESSION['id_session']):$id_session=null;

Write Preview
Loading…
Cancel
Save