chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

[svn r11114] fixing XSS hole

Browse Source 
http://www.dokeos.com/forum/viewtopic.php?t=8464
skala
Patrick Cool 18 years ago
parent dc719fc015
commit 6d52f5e483
2 changed files with 66 additions and 66 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 116
      main/calendar/agenda.php
  2. 16
      main/calendar/myagenda.php

116
main/calendar/agenda.php
Unescape View File

@ -1,4 +1,4 @@
<?php //$Id: agenda.php 10479 2006-12-13 12:42:20Z elixir_inter $
<?php //$Id: agenda.php 11114 2007-02-14 21:25:27Z pcool $
/*
==============================================================================
Dokeos - elearning and course management software
@ -22,9 +22,9 @@
==============================================================================
*/
/*
==============================================================================
==============================================================================
INIT SECTION
==============================================================================
==============================================================================
*/
// name of the language file that needs to be included
$language_file = 'agenda';
@ -43,10 +43,10 @@ $this_section=SECTION_COURSES;
//error_reporting(E_ALL);
require (api_get_path(LIBRARY_PATH).'groupmanager.lib.php');
/* ==============================================================================
/* ==============================================================================
ACCESS RIGHTS
============================================================================== */
// notice for unauthorized people.
// notice for unauthorized people.
api_protect_course_script();
/*
@ -59,7 +59,7 @@ include('../resourcelinker/resourcelinker.inc.php');
if ($addresources) // When the "Add Resource" button is clicked we store all the form data into a session
{
$form_elements= array ('day'=>$_POST['fday'], 'month'=>$_POST['fmonth'], 'year'=>$_POST['fyear'], 'hour'=>$_POST['fhour'], 'minutes'=>$_POST['fminute'],
'end_day'=>$_POST['end_fday'], 'end_month'=>$_POST['end_fmonth'], 'end_year'=>$_POST['end_fyear'], 'end_hours'=>$_POST['end_fhour'], 'end_minutes'=>$_POST['end_fminute'],
'end_day'=>$_POST['end_fday'], 'end_month'=>$_POST['end_fmonth'], 'end_year'=>$_POST['end_fyear'], 'end_hours'=>$_POST['end_fhour'], 'end_minutes'=>$_POST['end_fminute'],
'title'=>stripslashes($_POST['title']), 'content'=>stripslashes($_POST['content']), 'id'=>$_POST['id'], 'action'=>$_POST['action'], 'to'=>$_POST['selectedform']);
$_SESSION['formelements']=$form_elements;
if($id) // this is to correctly handle edits
@ -79,8 +79,8 @@ include "agenda.inc.php";
// some debug functions
include($includePath."/lib/debug.lib.inc.php");
/*==============================================================================
TREATING THE PARAMETERS
/*==============================================================================
TREATING THE PARAMETERS
1. viewing month only or everything
2. sort ascending or descending
3. showing or hiding the send-to-specific-groups-or-users form
@ -100,7 +100,7 @@ if ($_GET['action']=="showall")
$_SESSION['show']="showall";
}
//echo $_SESSION['show'];
// 2. sorting order (ASC or DESC)
if (!$_GET['sort'] and !$_SESSION['sort'])
{
@ -114,14 +114,14 @@ if ($_GET['sort']=="desc")
{
$_SESSION['sort']="DESC";
}
// 3. showing or hiding the send-to-specific-groups-or-users form
$setting_allow_individual_calendar=true;
// 3. showing or hiding the send-to-specific-groups-or-users form
$setting_allow_individual_calendar=true;
if (!$_POST['To'] and !$_SESSION['allow_individual_calendar'])
{
$_SESSION['allow_individual_calendar']="hide";
}
$allow_individual_calendar_status=$_SESSION['allow_individual_calendar'];
$allow_individual_calendar_status=$_SESSION['allow_individual_calendar'];
if ($_POST['To'] and ($allow_individual_calendar_status=="hide"))
{
$_SESSION['allow_individual_calendar']="show";
@ -130,17 +130,17 @@ if ($_POST['To'] and ($allow_individual_calendar_status=="show"))
{
$_SESSION['allow_individual_calendar']="hide";
}
// 4. filter user or group
if ($_GET['user'] or $_GET['group'])
{
$_SESSION['user']=$_GET['user'];
$_SESSION['group']=$_GET['group'];
$_SESSION['user']=(int)$_GET['user'];
$_SESSION['group']=(int)$_GET['group'];
}
if ($_GET['user']=="none" or $_GET['group']=="none")
{
api_session_unregister("user");
api_session_unregister("group");
api_session_unregister("user");
api_session_unregister("group");
}
if (!$is_courseAdmin){
if (!empty($_GET['toolgroup'])){
@ -149,46 +149,46 @@ if (!$is_courseAdmin){
api_session_register('toolgroup');
}
}
//It comes from the group tools. If it's define it overwrites $_SESSION['group']
//It comes from the group tools. If it's define it overwrites $_SESSION['group']
if ($_GET['isStudentView']=="false")
{
api_session_unregister("user");
api_session_unregister("group");
api_session_unregister("user");
api_session_unregister("group");
}
// setting the javascripts
// setting the javascripts
if ($_SESSION['allow_individual_calendar']=="show")
{
// this javascript should only be loaded when we show the forms to send messages to individual users/groups
// because otherwise it produces a bug (=> year is set to 2009 on submit due to the javascript selectAll
$htmlHeadXtra[] = to_javascript();
}
$htmlHeadXtra[] = user_group_filter_javascript();
$htmlHeadXtra[] = user_group_filter_javascript();
// this loads the javascript that is needed for the date popup selection
$htmlHeadXtra[] = "<script src=\"tbl_change.js\" type=\"text/javascript\" language=\"javascript\"></script>";
// setting the name of the tool
$nameTools = get_lang('Agenda'); // language variable in trad4all.inc.php
// showing the header if we are not in the learning path, if we are in
// the learning path, we do not include the banner so we have to explicitly
// showing the header if we are not in the learning path, if we are in
// the learning path, we do not include the banner so we have to explicitly
// include the stylesheet, which is normally done in the header
if ($_GET['origin'] != 'learnpath')
{
if ($_GET['origin'] != 'learnpath')
{
Display::display_header($nameTools,'Agenda');
}
else
else
{
echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"".$clarolineRepositoryWeb."css/default.css\"/>";
}
/* ==============================================================================
/* ==============================================================================
TRACKING
============================================================================== */
include('../inc/lib/events.lib.inc.php');
event_access_tool(TOOL_CALENDAR_EVENT);
/* ==============================================================================
/* ==============================================================================
SETTING SOME VARIABLES
============================================================================== */
// Variable definitions
@ -211,17 +211,17 @@ $tbl_session_course_user= Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USE
/* ==============================================================================
/* ==============================================================================
ACCESS RIGHTS
============================================================================== */
// permission stuff
$is_allowedToEdit = is_allowed_to_edit();
$is_allowed_to_edit = is_allowed_to_edit();
/* ==============================================================================
TITLE
/* ==============================================================================
TITLE
============================================================================== */
// Displaying the title of the tool
// Displaying the title of the tool
//api_display_tool_title($nameTools);
// tool introduction
@ -231,14 +231,14 @@ Display::display_introduction_section(TOOL_CALENDAR_EVENT);
echo "<a name=\"top\"></a>";
/*
==============================================================================
==============================================================================
MAIN SECTION
==============================================================================
==============================================================================
*/
//setting the default year and month
$select_year = $_GET['year'];
$select_month = $_GET['month'];
$select_year = (int)$_GET['year'];
$select_month = (int)$_GET['month'];
if (($select_year==NULL) && ($select_month==NULL))
{
$today = getdate();
@ -252,25 +252,25 @@ echo "<table width=\"100%\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\">"
. "<tr>";
// THE LEFT PART
if ($_GET['origin']!='learnpath')
{
if ($_GET['origin']!='learnpath')
{
echo '<td width="220" height="19" valign="top">';
// the small calendar
$MonthName = $MonthsLong[$select_month -1];
$agenda_items=get_kalender_items($select_month,$select_year);
display_minimonthcalendar($agenda_items, $select_month,$select_year, $MonthName);
display_minimonthcalendar($agenda_items, $select_month,$select_year, $MonthName);
// the links for adding, filtering, showall, ...
echo "<ul id=\"agenda_select\">";
if (is_allowed_to_edit())
{
display_courseadmin_links();
display_courseadmin_links();
}
display_student_links();
echo "</ul>";
echo "</td>";
echo "<td width=\"20\" background=\"../img/verticalruler.gif\">&nbsp;</td>";
}
$fck_attribute['Width'] = '600';
$fck_attribute['Height'] = '400';
$fck_attribute['ToolbarSet'] = 'Middle';
@ -284,7 +284,7 @@ if (is_allowed_to_edit())
switch ($_GET['action'])
{
case "add":
if ($_POST['submit_event'])
{
store_new_agenda_item();
@ -295,7 +295,7 @@ if (is_allowed_to_edit())
show_add_form();
}
break;
case "edit":
if ($_POST['submit_event'])
{
@ -308,24 +308,24 @@ if (is_allowed_to_edit())
show_add_form($id);
}
break;
case "delete":
$id=(int)$_GET['id'];
delete_agenda_item($id);
display_agenda_items();
break;
case "showhide":
$id=(int)$_GET['id'];
showhide_agenda_item($id);
display_agenda_items();
break;
break;
case "announce": //copying the agenda item into an announcement
$id=(int)$_GET['id'];
$ann_id = store_agenda_item_as_announcement($id);
$tool_group_link = (isset($_SESSION['toolgroup'])?'&toolgroup='.$_SESSION['toolgroup']:'');
Display::display_normal_message('Copied as announcement: <a href="../announcements/announcements.php?id='.$ann_id.$tool_group_link.'">New announcement</a>');
display_agenda_items();
display_agenda_items();
}
}
@ -333,25 +333,25 @@ if (is_allowed_to_edit())
// this is for students and whenever the courseaministrator has not chosen any action. It is in fact the default behaviour
if (!$_GET['action'] OR $_GET['action']=="showall" OR $_GET['action']=="showcurrent" OR $_GET['action']=="view")
{
if ($_GET['origin'] != 'learnpath')
if ($_GET['origin'] != 'learnpath')
{
display_agenda_items();
}
else
else
{
display_one_agenda_item($_GET['agenda_id']);
display_one_agenda_item((int)$_GET['agenda_id']);
}
}
echo "&nbsp;</td></tr></table>";
/*
==============================================================================
FOOTER
==============================================================================
==============================================================================
FOOTER
==============================================================================
*/
// The footer is displayed only if we are not in the learnpath
if ($_GET['origin'] != 'learnpath')
{
if ($_GET['origin'] != 'learnpath')
{
Display::display_footer();
}
}
?>

16
main/calendar/myagenda.php
Unescape View File

@ -207,22 +207,22 @@ if (isset ($_user['user_id']))
}
// setting and/or getting the year, month, day, week
$today = getdate();
$year = $_GET['year'];
$year = (int)$_GET['year'];
if ($year == NULL)
{
$year = $today['year'];
}
$month = $_GET['month'];
$month = (int)$_GET['month'];
if ($month == NULL)
{
$month = $today['mon'];
}
$day = $_GET['day'];
$day = (int)$_GET['day'];
if ($day == NULL)
{
$day = $today['mday'];
}
$week = $_GET['week'];
$week = (int)$_GET['week'];
if ($week == NULL)
{
$week = date("W");
@ -289,7 +289,7 @@ if (isset ($_user['user_id']))
show_new_item_form();
break;
case "store_personal_agenda_item" :
store_personal_item($_POST['frm_day'], $_POST['frm_month'], $_POST['frm_year'], $_POST['frm_hour'], $_POST['frm_minute'], $_POST['frm_title'], $_POST['frm_content'], $_GET['id']);
store_personal_item($_POST['frm_day'], $_POST['frm_month'], $_POST['frm_year'], $_POST['frm_hour'], $_POST['frm_minute'], $_POST['frm_title'], $_POST['frm_content'], (int)$_GET['id']);
if ($_GET['id'])
{
Display :: display_normal_message(get_lang("PeronalAgendaItemEdited"));
@ -301,10 +301,10 @@ if (isset ($_user['user_id']))
show_personal_agenda();
break;
case "edit_personal_agenda_item" :
show_new_item_form($_GET['id']);
show_new_item_form((int)$_GET['id']);
break;
case "delete_personal_agenda_item" :
delete_personal_agenda($_GET['id']);
delete_personal_agenda((int)$_GET['id']);
Display :: display_normal_message(get_lang('PeronalAgendaItemDeleted'));
show_personal_agenda();
break;
@ -551,7 +551,7 @@ function display_weekcalendar($agendaitems, $month, $year, $weekdaynames, $month
if ($_GET['week'])
{
$today = mktime(0, 0, 0, 1, 1, $year);
$today = $today + (($_GET['week']) * (7 * 24 * 60 * 60));
$today = $today + (((int)$_GET['week']) * (7 * 24 * 60 * 60));
$week_number = date("W", $today);
}
// calculating the start date of the week

Write Preview
Loading…
Cancel
Save