diff --git a/main/chat/chat.php b/main/chat/chat.php
index b1d94ccdef..b1e10fe7bd 100755
--- a/main/chat/chat.php
+++ b/main/chat/chat.php
@@ -79,7 +79,7 @@ if (api_get_setting('show_navigation_menu') != 'false') {
break;
}
}
-$cidreq = $_GET['cidReq'];
+$cidreq = Security::remove_XSS($_GET['cidReq']);
?>
';
echo'';
echo '';
diff --git a/main/chat/chat_banner.php b/main/chat/chat_banner.php
index 7154265c37..0a3f039030 100644
--- a/main/chat/chat_banner.php
+++ b/main/chat/chat_banner.php
@@ -5,7 +5,7 @@
* Chamilo banner
*
* @author Olivier Brouckaert
- * @chamilo chamilo.chat
+ * @package chamilo.chat
*/
$language_file = array ('chat');
@@ -13,11 +13,6 @@ require_once '../inc/global.inc.php';
require_once api_get_path(LIBRARY_PATH).'groupmanager.lib.php';
$this_section = SECTION_COURSES;
-//$interbreadcrumb[] = array ('url' => 'chat.php', 'name' => get_lang('Chat'));
-//$noPHP_SELF = true;
-//$shortBanner = false;
-//Display::display_header(null, 'Chat');
-
$tool_name = get_lang('ToolChat');
// If it is a group chat then the breadcrumbs.
diff --git a/main/chat/chat_chat.php b/main/chat/chat_chat.php
index 6d542542c7..8365c9473d 100644
--- a/main/chat/chat_chat.php
+++ b/main/chat/chat_chat.php
@@ -24,7 +24,7 @@ $group_id = intval($_SESSION['_gid']);
if (!empty($course)) {
$reset = (bool)$_GET['reset'];
$tbl_user = Database::get_main_table(TABLE_MAIN_USER);
- $query = "SELECT username FROM $tbl_user WHERE user_id='".$_user['user_id']."'";
+ $query = "SELECT username FROM $tbl_user WHERE user_id='".intval($_user['user_id'])."'";
$result = Database::query($query);
list($pseudo_user) = Database::fetch_row($result);
@@ -70,7 +70,7 @@ if (!empty($course)) {
} else {
$filename_chat = 'messages-'.$date_now.'.log.html';
}
-
+
if (!file_exists($chat_path.$filename_chat)) {
@fclose(fopen($chat_path.$filename_chat, 'w'));
if (!api_is_anonymous()) {
@@ -111,10 +111,14 @@ if (!empty($course)) {
update_existing_document($_course, $doc_id, 0);
}
-
- $content = file($chat_path.$basename_chat.'.log.html');
- $nbr_lines = sizeof($content);
- $remove = $nbr_lines - 100;
+
+ $remove = 0;
+ $content = array();
+ if (file_exists($chat_path.$basename_chat.'.log.html')) {
+ $content = file($chat_path.$basename_chat.'.log.html');
+ $nbr_lines = sizeof($content);
+ $remove = $nbr_lines - 100;
+ }
if ($remove < 0) {
$remove = 0;
@@ -128,7 +132,7 @@ if (!empty($course)) {
}
if ($_GET['origin'] == 'whoisonlinejoin') { //the joiner (we have to delete the chat request to him when he joins the chat)
$track_user_table = Database::get_main_table(TABLE_MAIN_USER);
- $sql = "update $track_user_table set chatcall_user_id = '', chatcall_date = '', chatcall_text='' where (user_id = ".$_user['user_id'].")";
+ $sql = "UPDATE $track_user_table set chatcall_user_id = '', chatcall_date = '', chatcall_text='' where (user_id = ".$_user['user_id'].")";
$result = Database::query($sql);
}
diff --git a/main/chat/chat_functions.lib.php b/main/chat/chat_functions.lib.php
index ceb3283fc1..cc2c979b11 100755
--- a/main/chat/chat_functions.lib.php
+++ b/main/chat/chat_functions.lib.php
@@ -1,17 +1,21 @@
|
-
+
|
@@ -287,5 +288,4 @@ if (!empty($course) && !empty($_user['user_id'])) {
|