From 536d8089450f47fe9b111c01be1ba2779eb2216a Mon Sep 17 00:00:00 2001 From: Yannick Warnier Date: Mon, 29 Dec 2008 13:38:58 +0100 Subject: [PATCH] [svn r17472] Improved language translation and SQL filtering (FS#3387) --- main/notebook/index.php | 16 +++++++-------- main/notebook/notebookfunction.inc.php | 27 +++++++++++++++----------- 2 files changed, 24 insertions(+), 19 deletions(-) diff --git a/main/notebook/index.php b/main/notebook/index.php index c8417470d5..6ad2152695 100755 --- a/main/notebook/index.php +++ b/main/notebook/index.php @@ -33,7 +33,7 @@ $icon_delete ='delete.gif'; //--------------------------------------------------------- -echo ''.Display::return_icon($icon_add,get_lang('NewNotebook')).get_lang('NewNotebook').''; +echo ''.Display::return_icon($icon_add,get_lang('NewNote')).get_lang('NewNote').''; if (isset($_REQUEST['action']) && $_REQUEST['action']=='addnotebook') { echo ''; @@ -41,8 +41,8 @@ if (isset($_REQUEST['action']) && $_REQUEST['action']=='addnotebook') { echo ''; echo ''; echo ''; - echo '
'; - echo '
'; + echo '
'; + echo '
'; echo ''; echo ''; echo ''; @@ -58,7 +58,7 @@ if ($ctok==$_POST['sec_token']) { $description = Security::remove_XSS($_REQUEST['description']); $add_notebook= add_notebook_details($user_id,$course_id,$session_id,$description,$date); if($add_notebook) { - Display::display_confirmation_message(get_lang('NotebookAdded')); + Display::display_confirmation_message(get_lang('NoteCreated')); } } } @@ -72,7 +72,7 @@ if ($ctok==$_POST['sec_token']) { $description = Security::remove_XSS($_REQUEST['upd_description']); $edit_notebook= edit_notebook_details($notebook_id,$user_id,$course_id,$session_id,$description,$date); if($edit_notebook) { - Display::display_confirmation_message(get_lang('NotebookUpdated')); + Display::display_confirmation_message(get_lang('NoteUpdated')); } } @@ -86,7 +86,7 @@ if (isset($_REQUEST['action']) && $_REQUEST['action'] == 'delete_notebook'){ $notebook_id = Security::remove_XSS($_REQUEST['notebook_id']); $delete_notebook = delete_notebook_details($notebook_id); if($delete_notebook) { - Display::display_confirmation_message(get_lang('NotebookDeleted')); + Display::display_confirmation_message(get_lang('NoteDeleted')); } } @@ -112,7 +112,7 @@ while ($row_notebook_list=Database::fetch_array($notebook_list)){ echo ''; echo ''; echo '
'; - echo '
'; + echo '
'; echo ''; echo ''; } else { @@ -121,7 +121,7 @@ while ($row_notebook_list=Database::fetch_array($notebook_list)){ echo ''.Display::return_icon($icon_edit,get_lang('Edit')).' '; echo ''.Display::return_icon($icon_delete,get_lang('Edit')).''; if ( $row_notebook_list['status']==1 ) { - echo '  '.get_lang('EndDate').' : '.$row_notebook_list['end_date'].''; + echo '  '.get_lang('LastUpdateDate').' : '.$row_notebook_list['end_date'].''; } echo ''; } diff --git a/main/notebook/notebookfunction.inc.php b/main/notebook/notebookfunction.inc.php index 9d699aafbc..0ca7acf2b1 100755 --- a/main/notebook/notebookfunction.inc.php +++ b/main/notebook/notebookfunction.inc.php @@ -5,9 +5,6 @@ * @author Christian Fasanando * This library enables maintenance of the notebook tool */ - - - /** * This function retrieves notebook details by users * @return array Array of type ([notebook_id=>a,user_id=>b,course=>c,session_id=>d,description=>e,start_date=>f,end_date=>g,status=>h],[]) @@ -38,17 +35,20 @@ function get_notebook_details($user_id) { */ function add_notebook_details($user_id,$course,$session_id,$description,$start_date) { $t_notebook = Database :: get_course_table(TABLE_NOTEBOOK); + if ($user_id !== strval(intval($user_id))) { return false;} $safe_user_id = (int)$user_id; $safe_course = Database::escape_string($course); - $safe_session_id = (int)$session_id; + if ($session_id !== strval(intval($session_id))) { return false;} + $safe_session_id = (int)$session_id; $safe_description = Database::escape_string($description); + $safe_start_date = Database::escape_string($start_date); - if (empty($description) || empty($start_date)) { + if (empty($description) || empty($safe_start_date)) { return false; } $sql = "INSERT INTO $t_notebook(user_id,course,session_id,description,start_date,status) - VALUES('$safe_user_id' , '$safe_course','$safe_session_id','$safe_description','$start_date',0)"; + VALUES('$safe_user_id' , '$safe_course','$safe_session_id','$safe_description','$safe_start_date',0)"; $result = api_sql_query($sql, __FILE__, __LINE__); return $result; @@ -69,11 +69,15 @@ function add_notebook_details($user_id,$course,$session_id,$description,$start_d function edit_notebook_details($notebook_id,$user_id,$course,$session_id,$description,$end_date) { $t_notebook = Database :: get_course_table(TABLE_NOTEBOOK); + if ($notebook_id !== strval(intval($notebook_id))) { return false;} $safe_notebook_id = (int)$notebook_id; + if ($user_id !== strval(intval($user_id))) { return false;} $safe_user_id = (int)$user_id; $safe_course = Database::escape_string($course); - $safe_session_id = (int)$session_id; + if ($session_id !== strval(intval($session_id))) { return false;} + $safe_session_id = (int)$session_id; $safe_description = Database::escape_string($description); + $safe_end_date = Database::escape_string($end_date); if (empty($description) || empty($end_date)) { return false; @@ -94,6 +98,7 @@ function edit_notebook_details($notebook_id,$user_id,$course,$session_id,$descri */ function delete_notebook_details($notebook_id) { $t_notebook = Database :: get_course_table(TABLE_NOTEBOOK); + if ($notebook_id !== strval(intval($notebook_id))) { return false;} $safe_notebook_id = (int)$notebook_id; $sql = "DELETE FROM $t_notebook WHERE notebook_id=$safe_notebook_id"; @@ -110,15 +115,15 @@ function to_javascript_notebook() { return "