chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Replace $_SESSION['sec_token'] with Security::getTokenFromSession()

Browse Source
pull/2487/head
jmontoyaa 8 years ago
parent 608b37cb6f
commit 9cc9903a9e
12 changed files with 248 additions and 201 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 7
      main/admin/special_exports.php
  2. 26
      main/admin/specific_fields.php
  3. 2
      main/admin/user_information.php
  4. 328
      main/admin/user_list.php
  5. 3
      main/admin/usergroup_import.php
  6. 23
      main/admin/usergroup_user_import.php
  7. 2
      main/auth/courses_categories.php
  8. 2
      main/auth/ldap/authldap.php
  9. 10
      main/inc/lib/auth.lib.php
  10. 2
      main/inc/lib/course_category.lib.php
  11. 42
      main/inc/lib/security.lib.php
  12. 2
      main/user/user.php

7
main/admin/special_exports.php
Unescape View File

@ -228,7 +228,6 @@ function fullexportspecial()
$to_group_id = 0;
$zip_folder = new PclZip($FileZip['TEMP_FILE_ZIP']);
$list_course = CourseManager::get_course_list();
$tbl_document = Database::get_course_table(TABLE_DOCUMENT);
$tbl_property = Database::get_course_table(TABLE_ITEM_PROPERTY);
@ -263,7 +262,8 @@ function fullexportspecial()
$FileZip['PATH_COURSE'].$_course['directory']."/document".$rows_course_file['path'],
PCLZIP_OPT_ADD_PATH,
$_course['directory'],
PCLZIP_OPT_REMOVE_PATH, $FileZip['PATH_COURSE'].$_course['directory']."/document".$FileZip['PATH_REMOVE']
PCLZIP_OPT_REMOVE_PATH,
$FileZip['PATH_COURSE'].$_course['directory']."/document".$FileZip['PATH_REMOVE']
);
}
@ -276,7 +276,8 @@ function fullexportspecial()
$query_session = Database::query($sql);
while ($rows_session = Database::fetch_assoc($query_session)) {
$session_id = $rows_session['id'];
$sql_session_doc = "SELECT path FROM $tbl_document AS docs, $tbl_property AS props
$sql_session_doc = "SELECT path
FROM $tbl_document AS docs, $tbl_property AS props
WHERE props.tool='".TOOL_DOCUMENT."'
AND docs.id=props.ref
AND docs.path LIKE '".$querypath."/%'

26
main/admin/specific_fields.php
Unescape View File

@ -34,23 +34,31 @@ $column_order = array(3, 2, 1);
$extra_fields = get_specific_field_list();
$number_of_extra_fields = count($extra_fields);
$table = new SortableTableFromArrayConfig($extra_fields, 2, 50, '', $column_show, $column_order);
$table = new SortableTableFromArrayConfig(
$extra_fields,
2,
50,
'',
$column_show,
$column_order
);
$table->set_header(0, ' ', false, null, 'width="2%"', 'style="display:none"');
$table->set_header(1, get_lang('Code'), true, 'width="10%"');
$table->set_header(2, get_lang('Name'));
$table->set_header(3, get_lang('Modify'), false, 'width="10%"');
$table->set_column_filter(3, 'edit_filter');
function edit_filter($id, $url_params, $row) {
global $charset;
$return = '<a href="specific_fields_add.php?action=edit&field_id='.$row[0].'">'.Display::return_icon('edit.gif', get_lang('Edit')).'</a>';
$return .= ' <a href="'.api_get_self().'?action=delete&field_id='.$row[0].'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice"), ENT_QUOTES, $charset))."'".')) return false;">'.Display::return_icon('delete.gif', get_lang('Delete')).'</a>';
return $return;
function edit_filter($id, $url_params, $row)
{
global $charset;
$return = '<a href="specific_fields_add.php?action=edit&field_id='.$row[0].'">'.Display::return_icon('edit.gif', get_lang('Edit')).'</a>';
$return .= ' <a href="'.api_get_self().'?action=delete&field_id='.$row[0].'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice"), ENT_QUOTES, $charset))."'".')) return false;">'.Display::return_icon('delete.gif', get_lang('Delete')).'</a>';
return $return;
}
if (isset($_REQUEST['action']) && $_REQUEST['action'] == 'delete') {
delete_specific_field($_REQUEST['field_id']);
header('Location: specific_fields.php?message='.get_lang('FieldRemoved'));
delete_specific_field($_REQUEST['field_id']);
header('Location: specific_fields.php?message='.get_lang('FieldRemoved'));
exit;
}
@ -61,7 +69,7 @@ Display::display_header(get_lang('SpecificSearchFields'));
echo Display::addFlash(Display::return_message(get_lang('SpecificSearchFieldsIntro')));
if (!empty($_GET['message'])) {
Display::addFlash(Display::return_message($_GET['message'], 'confirm'));
Display::addFlash(Display::return_message($_GET['message'], 'confirm'));
}
echo '<div class="actions">';

2
main/admin/user_information.php
Unescape View File

@ -71,7 +71,7 @@ if (api_is_platform_admin()) {
[],
ICON_SIZE_MEDIUM
),
api_get_path(WEB_CODE_PATH).'admin/user_list.php?action=login_as&user_id='.$userId.'&sec_token='.$_SESSION['sec_token']
api_get_path(WEB_CODE_PATH).'admin/user_list.php?action=login_as&user_id='.$userId.'&sec_token='.Security::getTokenFromSession()
);
$actions[] = Display::url(

328
main/admin/user_list.php
Unescape View File

@ -12,8 +12,9 @@ use ChamiloSession as Session;
$cidReset = true;
require_once __DIR__.'/../inc/global.inc.php';
$current_access_url_id = api_get_current_access_url_id();
api_protect_admin_script(true);
$current_access_url_id = api_get_current_access_url_id();
$action = isset($_REQUEST["action"]) ? $_REQUEST["action"] : null;
// Blocks the possibility to delete a user
@ -24,8 +25,6 @@ if (api_get_configuration_value('deny_delete_users')) {
$url = api_get_path(WEB_AJAX_PATH).'course.ajax.php?a=get_user_courses';
$urlSession = api_get_path(WEB_AJAX_PATH).'session.ajax.php?a=get_user_sessions';
$extraField = new ExtraField('user');
$variables = $extraField->get_all_extra_field_by_type(ExtraField::FIELD_TYPE_TAG);
$variablesSelect = $extraField->get_all_extra_field_by_type(ExtraField::FIELD_TYPE_SELECT);
@ -44,81 +43,81 @@ Session::write('variables_to_show', $variablesToShow);
$htmlHeadXtra[] = '<script>
function load_course_list (div_course,my_user_id) {
$.ajax({
contentType: "application/x-www-form-urlencoded",
beforeSend: function(objeto) {
$.ajax({
contentType: "application/x-www-form-urlencoded",
beforeSend: function(objeto) {
$("div#"+div_course).html("<img src=\'../inc/lib/javascript/indicator.gif\' />"); },
type: "POST",
url: "'.$url.'",
data: "user_id="+my_user_id,
success: function(datos) {
$("div#"+div_course).html(datos);
$("div#div_"+my_user_id).attr("class","blackboard_show");
$("div#div_"+my_user_id).attr("style","");
}
});
type: "POST",
url: "'.$url.'",
data: "user_id="+my_user_id,
success: function(datos) {
$("div#"+div_course).html(datos);
$("div#div_"+my_user_id).attr("class","blackboard_show");
$("div#div_"+my_user_id).attr("style","");
}
});
}
function load_session_list(div_session, my_user_id) {
$.ajax({
contentType: "application/x-www-form-urlencoded",
beforeSend: function(objeto) {
$.ajax({
contentType: "application/x-www-form-urlencoded",
beforeSend: function(objeto) {
$("div#"+div_session).html("<img src=\'../inc/lib/javascript/indicator.gif\' />"); },
type: "POST",
url: "'.$urlSession.'",
data: "user_id="+my_user_id,
success: function(datos) {
$("div#"+div_session).html(datos);
$("div#div_s_"+my_user_id).attr("class","blackboard_show");
$("div#div_s_"+my_user_id).attr("style","");
}
});
type: "POST",
url: "'.$urlSession.'",
data: "user_id="+my_user_id,
success: function(datos) {
$("div#"+div_session).html(datos);
$("div#div_s_"+my_user_id).attr("class","blackboard_show");
$("div#div_s_"+my_user_id).attr("style","");
}
});
}
function active_user(element_div) {
id_image=$(element_div).attr("id");
image_clicked=$(element_div).attr("src");
image_clicked_info = image_clicked.split("/");
image_real_clicked = image_clicked_info[image_clicked_info.length-1];
var status = 1;
if (image_real_clicked == "accept.png") {
status = 0;
}
user_id=id_image.split("_");
ident="#img_"+user_id[1];
if (confirm("'.get_lang('AreYouSureToEditTheUserStatus', '').'")) {
$.ajax({
contentType: "application/x-www-form-urlencoded",
beforeSend: function(objeto) {
$(ident).attr("src","'.Display::returnIconPath('loading1.gif').'"); }, //candy eye stuff
type: "GET",
url: "'.api_get_path(WEB_AJAX_PATH).'user_manager.ajax.php?a=active_user",
data: "user_id="+user_id[1]+"&status="+status,
success: function(data) {
if (data == 1) {
$(ident).attr("src", "'.Display::returnIconPath('accept.png').'");
$(ident).attr("title","'.get_lang('Lock').'");
}
id_image=$(element_div).attr("id");
image_clicked=$(element_div).attr("src");
image_clicked_info = image_clicked.split("/");
image_real_clicked = image_clicked_info[image_clicked_info.length-1];
var status = 1;
if (image_real_clicked == "accept.png") {
status = 0;
}
user_id=id_image.split("_");
ident="#img_"+user_id[1];
if (confirm("'.get_lang('AreYouSureToEditTheUserStatus', '').'")) {
$.ajax({
contentType: "application/x-www-form-urlencoded",
beforeSend: function(objeto) {
$(ident).attr("src","'.Display::returnIconPath('loading1.gif').'"); }, //candy eye stuff
type: "GET",
url: "'.api_get_path(WEB_AJAX_PATH).'user_manager.ajax.php?a=active_user",
data: "user_id="+user_id[1]+"&status="+status,
success: function(data) {
if (data == 1) {
$(ident).attr("src", "'.Display::returnIconPath('accept.png').'");
$(ident).attr("title","'.get_lang('Lock').'");
}
if (data == 0) {
$(ident).attr("src","'.Display::returnIconPath('error.png').'");
$(ident).attr("title","'.get_lang('Unlock').'");
}
$(ident).attr("src","'.Display::returnIconPath('error.png').'");
$(ident).attr("title","'.get_lang('Unlock').'");
}
if (data == -1) {
$(ident).attr("src", "'.Display::returnIconPath('warning.png').'");
$(ident).attr("title","'.get_lang('ActionNotAllowed').'");
$(ident).attr("title","'.get_lang('ActionNotAllowed').'");
}
}
});
}
}
});
}
}
function clear_course_list(div_course) {
$("div#"+div_course).html("&nbsp;");
$("div#"+div_course).hide("");
$("div#"+div_course).html("&nbsp;");
$("div#"+div_course).hide("");
}
function clear_session_list(div_session) {
$("div#"+div_session).html("&nbsp;");
$("div#"+div_session).hide("");
$("div#"+div_session).html("&nbsp;");
$("div#"+div_session).hide("");
}
function display_advanced_search_form () {
@ -146,8 +145,8 @@ $(document).ready(function() {
//Load user calendar
function load_calendar(user_id, month, year) {
var url = "'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&user_id=" +user_id + "&month="+month+"&year="+year;
$(".modal-body").load(url);
var url = "'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&user_id=" +user_id + "&month="+month+"&year="+year;
$(".modal-body").load(url);
}
</script>';
@ -192,8 +191,6 @@ if ($action == 'login_as') {
Security::clear_token();
}
api_protect_admin_script(true);
/**
* Prepares the shared SQL query for the user table.
* See get_user_data() and get_number_of_users().
@ -232,7 +229,8 @@ function prepare_user_sql_query($is_count)
// adding the filter to see the user's only of the current access_url
if ((api_is_platform_admin() || api_is_session_admin()) && api_get_multiple_access_url()) {
$access_url_rel_user_table = Database::get_main_table(TABLE_MAIN_ACCESS_URL_REL_USER);
$sql .= " INNER JOIN $access_url_rel_user_table url_rel_user ON (u.id=url_rel_user.user_id)";
$sql .= " INNER JOIN $access_url_rel_user_table url_rel_user
ON (u.id=url_rel_user.user_id)";
}
$keywordList = array(
@ -440,9 +438,9 @@ function get_user_data($from, $number_of_items, $column, $direction)
$users = array();
$t = time();
while ($user = Database::fetch_row($res)) {
$userPicture = UserManager::getUserPicture($user[0], USER_IMAGE_SIZE_SMALL);
$photo = '<img src="'.$userPicture.'" width="22" height="22" alt="'.api_get_person_name($user[2], $user[3]).'" title="'.api_get_person_name($user[2], $user[3]).'" />';
while ($user = Database::fetch_row($res)) {
$userPicture = UserManager::getUserPicture($user[0], USER_IMAGE_SIZE_SMALL);
$photo = '<img src="'.$userPicture.'" width="22" height="22" alt="'.api_get_person_name($user[2], $user[3]).'" title="'.api_get_person_name($user[2], $user[3]).'" />';
if ($user[7] == 1 && !empty($user[10])) {
// check expiration date
@ -479,7 +477,7 @@ function get_user_data($from, $number_of_items, $column, $direction)
*/
function email_filter($email)
{
return Display :: encrypted_mailto_link($email, $email);
return Display :: encrypted_mailto_link($email, $email);
}
/**
@ -489,7 +487,7 @@ function email_filter($email)
*/
function user_filter($name, $params, $row)
{
return '<a href="'.api_get_path(WEB_PATH).'whoisonline.php?origin=user_list&id='.$row[0].'">'.$name.'</a>';
return '<a href="'.api_get_path(WEB_PATH).'whoisonline.php?origin=user_list&id='.$row[0].'">'.$name.'</a>';
}
/**
@ -507,34 +505,34 @@ function modify_filter($user_id, $url_params, $row)
$user_is_anonymous = false;
$current_user_status_label = $row['7'];
if ($current_user_status_label == $statusname[ANONYMOUS]) {
$user_is_anonymous = true;
}
$result = '';
if (!$user_is_anonymous) {
if ($current_user_status_label == $statusname[ANONYMOUS]) {
$user_is_anonymous = true;
}
$result = '';
if (!$user_is_anonymous) {
$icon = Display::return_icon(
'course.png',
get_lang('Courses'),
array('onmouseout' => 'clear_course_list (\'div_'.$user_id.'\')')
);
$result .= '<a href="javascript:void(0)" onclick="load_course_list(\'div_'.$user_id.'\','.$user_id.')" >
'.$icon.'
<div class="blackboard_hide" id="div_'.$user_id.'">&nbsp;&nbsp;</div>
</a>';
$result .= '<a href="javascript:void(0)" onclick="load_course_list(\'div_'.$user_id.'\','.$user_id.')" >
'.$icon.'
<div class="blackboard_hide" id="div_'.$user_id.'">&nbsp;&nbsp;</div>
</a>';
$icon = Display::return_icon(
'session.png',
get_lang('Sessions'),
array('onmouseout' => 'clear_session_list (\'div_s_'.$user_id.'\')')
);
$result .= '<a href="javascript:void(0)" onclick="load_session_list(\'div_s_'.$user_id.'\','.$user_id.')" >
'.$icon.'
<div class="blackboard_hide" id="div_s_'.$user_id.'">&nbsp;&nbsp;</div>
</a>';
} else {
$result .= Display::return_icon('course_na.png', get_lang('Courses')).'&nbsp;&nbsp;';
$result .= Display::return_icon('course_na.png', get_lang('Sessions')).'&nbsp;&nbsp;';
}
$result .= '<a href="javascript:void(0)" onclick="load_session_list(\'div_s_'.$user_id.'\','.$user_id.')" >
'.$icon.'
<div class="blackboard_hide" id="div_s_'.$user_id.'">&nbsp;&nbsp;</div>
</a>';
} else {
$result .= Display::return_icon('course_na.png', get_lang('Courses')).'&nbsp;&nbsp;';
$result .= Display::return_icon('course_na.png', get_lang('Sessions')).'&nbsp;&nbsp;';
}
if (api_is_platform_admin()) {
if (!$user_is_anonymous) {
@ -548,7 +546,8 @@ function modify_filter($user_id, $url_params, $row)
if (api_is_platform_admin() || (api_is_session_admin() && $current_user_status_label == $statusname[STUDENT])) {
if (!$user_is_anonymous) {
if (api_global_admin_can_edit_admin($user_id)) {
$result .= '<a href="user_list.php?action=login_as&user_id='.$user_id.'&sec_token='.$_SESSION['sec_token'].'">'.Display::return_icon('login_as.png', get_lang('LoginAs')).'</a>&nbsp;';
$result .= '<a href="user_list.php?action=login_as&user_id='.$user_id.'&sec_token='.Security::getTokenFromSession().'">'.
Display::return_icon('login_as.png', get_lang('LoginAs')).'</a>&nbsp;';
} else {
$result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;';
}
@ -583,26 +582,25 @@ function modify_filter($user_id, $url_params, $row)
);
}
if ($is_admin) {
if ($is_admin) {
$result .= Display::return_icon(
'admin_star.png',
get_lang('IsAdministrator'),
array('width' => ICON_SIZE_SMALL, 'heigth' => ICON_SIZE_SMALL)
);
} else {
$result .= Display::return_icon('admin_star_na.png', get_lang('IsNotAdministrator'));
}
} else {
$result .= Display::return_icon('admin_star_na.png', get_lang('IsNotAdministrator'));
}
// actions for assigning sessions, courses or users
if (!api_is_session_admin()) {
// actions for assigning sessions, courses or users
if (!api_is_session_admin()) {
if ($current_user_status_label == $statusname[SESSIONADMIN]) {
$result .= Display::url(
Display::return_icon('view_more_stats.gif', get_lang('AssignSessions')),
"dashboard_add_sessions_to_user.php?user={$user_id}"
);
} else {
if (
$current_user_status_label == $statusname[DRH] ||
if ($current_user_status_label == $statusname[DRH] ||
UserManager::is_admin($user_id) ||
$current_user_status_label == $statusname[STUDENT_BOSS]
) {
@ -624,11 +622,17 @@ function modify_filter($user_id, $url_params, $row)
);
}
}
}
}
if (api_is_platform_admin()) {
$result .= ' <a data-title="'.get_lang('FreeBusyCalendar').'" href="'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&user_id='.$user_id.'&modal_size=lg" class="agenda_opener ajax">'.
Display::return_icon('calendar.png', get_lang('FreeBusyCalendar'), array(), ICON_SIZE_SMALL).'</a>';
Display::return_icon(
'calendar.png',
get_lang('FreeBusyCalendar'),
array(),
ICON_SIZE_SMALL
).
'</a>';
$deleteAllowed = !api_get_configuration_value('deny_delete_users');
if ($deleteAllowed) {
if ($user_id != api_get_user_id() &&
@ -636,14 +640,19 @@ function modify_filter($user_id, $url_params, $row)
api_global_admin_can_edit_admin($user_id)
) {
// you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
$result .= ' <a href="user_list.php?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.$_SESSION['sec_token'].'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;">'.Display::return_icon('delete.png', get_lang('Delete'), array(), ICON_SIZE_SMALL).'</a>';
$result .= ' <a href="user_list.php?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.Security::getTokenFromSession().'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;">'.Display::return_icon('delete.png', get_lang('Delete'), array(), ICON_SIZE_SMALL).'</a>';
} else {
$result .= Display::return_icon('delete_na.png', get_lang('Delete'), array(), ICON_SIZE_SMALL);
$result .= Display::return_icon(
'delete_na.png',
get_lang('Delete'),
array(),
ICON_SIZE_SMALL
);
}
}
}
return $result;
return $result;
}
/**
@ -675,16 +684,16 @@ function active_filter($active, $params, $row)
if ($action === 'edit') {
$result = Display::return_icon($image.'.png', get_lang('AccountExpired'), array(), 16);
} elseif ($row['0'] <> $_user['user_id']) {
// you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
// you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
$result = Display::return_icon(
$image.'.png',
get_lang(ucfirst($action)),
array('onclick' => 'active_user(this);', 'id' => 'img_'.$row['0']),
16
);
}
}
return $result;
return $result;
}
/**
@ -696,9 +705,10 @@ function active_filter($active, $params, $row)
* @version march 2008
* @author Patrick Cool <patrick.cool@UGent.be>, Ghent University, Belgium
*/
function status_filter($status) {
$statusname = api_get_status_langvars();
return $statusname[$status];
function status_filter($status)
{
$statusname = api_get_status_langvars();
return $statusname[$status];
}
if (isset($_GET['keyword']) || isset($_GET['keyword_firstname'])) {
@ -714,8 +724,8 @@ $message = '';
if (!empty($action)) {
$check = Security::check_token('get');
if ($check) {
switch ($action) {
if ($check) {
switch ($action) {
case 'add_user_to_my_url':
$user_id = $_REQUEST["user_id"];
$result = UrlManager::add_user_to_url($user_id, $current_access_url_id);
@ -725,52 +735,52 @@ if (!empty($action)) {
$message = Display::return_message($message, 'confirmation');
}
break;
case 'delete_user':
if (api_is_platform_admin()) {
case 'delete_user':
if (api_is_platform_admin()) {
$user_to_delete = $_GET['user_id'];
$userToDeleteInfo = api_get_user_info($user_to_delete);
$current_user_id = api_get_user_id();
if ($userToDeleteInfo && $deleteUserAvailable && api_global_admin_can_edit_admin($_GET['user_id'])) {
if ($user_to_delete != $current_user_id && UserManager :: delete_user($_GET['user_id'])) {
$message = Display :: return_message(
get_lang('UserDeleted').': '.$userToDeleteInfo['complete_name_with_username'],
if ($userToDeleteInfo && $deleteUserAvailable && api_global_admin_can_edit_admin($_GET['user_id'])) {
if ($user_to_delete != $current_user_id && UserManager :: delete_user($_GET['user_id'])) {
$message = Display :: return_message(
get_lang('UserDeleted').': '.$userToDeleteInfo['complete_name_with_username'],
'confirmation'
);
} else {
$message = Display :: return_message(get_lang('CannotDeleteUserBecauseOwnsCourse'), 'error');
}
} else {
$message = Display :: return_message(get_lang('CannotDeleteUser'), 'error');
}
Display::addFlash($message);
header('Location: '.api_get_self());
} else {
$message = Display :: return_message(get_lang('CannotDeleteUserBecauseOwnsCourse'), 'error');
}
} else {
$message = Display :: return_message(get_lang('CannotDeleteUser'), 'error');
}
Display::addFlash($message);
header('Location: '.api_get_self());
exit;
}
break;
}
break;
case 'delete':
if (api_is_platform_admin()) {
$number_of_selected_users = count($_POST['id']);
$number_of_deleted_users = 0;
if (is_array($_POST['id'])) {
foreach ($_POST['id'] as $index => $user_id) {
if ($user_id != $_user['user_id']) {
if (UserManager::delete_user($user_id)) {
$number_of_deleted_users++;
}
}
}
}
if ($number_of_selected_users == $number_of_deleted_users) {
if (api_is_platform_admin()) {
$number_of_selected_users = count($_POST['id']);
$number_of_deleted_users = 0;
if (is_array($_POST['id'])) {
foreach ($_POST['id'] as $index => $user_id) {
if ($user_id != $_user['user_id']) {
if (UserManager::delete_user($user_id)) {
$number_of_deleted_users++;
}
}
}
}
if ($number_of_selected_users == $number_of_deleted_users) {
$message = Display :: return_message(get_lang('SelectedUsersDeleted'), 'confirmation');
} else {
} else {
$message = Display :: return_message(get_lang('SomeUsersNotDeleted'), 'error');
}
}
break;
}
Security::clear_token();
}
}
}
break;
}
Security::clear_token();
}
}
// Create a search-box
@ -795,7 +805,7 @@ $actionsLeft = '';
$actionsCenter = '';
$actionsRight = '';
if (api_is_platform_admin()) {
$actionsRight .= '<a class="pull-right" href="'.api_get_path(WEB_CODE_PATH).'admin/user_add.php">'.
$actionsRight .= '<a class="pull-right" href="'.api_get_path(WEB_CODE_PATH).'admin/user_add.php">'.
Display::return_icon('new_user.png', get_lang('AddUsers'), '', ICON_SIZE_MEDIUM).'</a>';
}
@ -803,8 +813,8 @@ $actionsLeft .= $form->returnForm();
$actionsCenter .= $searchAdvanced;
if (isset($_GET['keyword'])) {
$parameters = array('keyword' => Security::remove_XSS($_GET['keyword']));
} elseif (isset ($_GET['keyword_firstname'])) {
$parameters = array('keyword' => Security::remove_XSS($_GET['keyword']));
} elseif (isset($_GET['keyword_firstname'])) {
$parameters['keyword_firstname'] = Security::remove_XSS($_GET['keyword_firstname']);
$parameters['keyword_lastname'] = Security::remove_XSS($_GET['keyword_lastname']);
$parameters['keyword_username'] = Security::remove_XSS($_GET['keyword_username']);
@ -820,7 +830,14 @@ $parameters['sec_token'] = Security::get_token();
$_admins_list = array_keys(UserManager::get_all_administrators());
Session::write('admin_list', $_admins_list);
// Display Advanced search form.
$form = new FormValidator('advanced_search', 'get', '', '', array(), FormValidator::LAYOUT_HORIZONTAL);
$form = new FormValidator(
'advanced_search',
'get',
'',
'',
array(),
FormValidator::LAYOUT_HORIZONTAL
);
$form->addElement('html', '<div id="advanced_search_form" style="display:none;">');
$form->addElement('header', get_lang('AdvancedSearch'));
@ -877,11 +894,11 @@ $table->set_header(1, get_lang('Photo'), false);
$table->set_header(2, get_lang('OfficialCode'));
if (api_is_western_name_order()) {
$table->set_header(3, get_lang('FirstName'));
$table->set_header(4, get_lang('LastName'));
$table->set_header(3, get_lang('FirstName'));
$table->set_header(4, get_lang('LastName'));
} else {
$table->set_header(3, get_lang('LastName'));
$table->set_header(4, get_lang('FirstName'));
$table->set_header(3, get_lang('LastName'));
$table->set_header(4, get_lang('FirstName'));
}
$table->set_header(5, get_lang('LoginName'));
$table->set_header(6, get_lang('Email'));
@ -914,7 +931,6 @@ if ($table->get_total_number_of_items() == 0) {
$conditions = array('username' => $keyword);
$user_list = UserManager::get_user_list($conditions, array(), false, ' OR ');
if (!empty($user_list)) {
$extra_search_options = Display::page_subheader(get_lang('UsersFoundInOtherPortals'));
$table = new HTML_Table(array('class' => 'data_table'));
@ -944,7 +960,7 @@ if ($table->get_total_number_of_items() == 0) {
$row_table = array();
$row_table[] = api_get_person_name($user['firstname'], $user['lastname']).' ('.$user['username'].') ';
$row_table[] = $access_info_to_string;
$url = api_get_self().'?action=add_user_to_my_url&user_id='.$user['id'].'&sec_token='.$_SESSION['sec_token'];
$url = api_get_self().'?action=add_user_to_my_url&user_id='.$user['id'].'&sec_token='.Security::getTokenFromSession();
$row_table[] = Display::url(get_lang('AddUserToMyURL'), $url, array('class' => 'btn'));
foreach ($row_table as $cell) {

3
main/admin/usergroup_import.php
Unescape View File

@ -10,7 +10,8 @@
/**
* Validates imported data.
*/
function validate_data($classes) {
function validate_data($classes)
{
$errors = array();
$usergroup = new UserGroup();
foreach ($classes as $index => $class) {

23
main/admin/usergroup_user_import.php
Unescape View File

@ -12,7 +12,8 @@
/**
* Validates imported data.
*/
function validate_data($user_classes) {
function validate_data($user_classes)
{
global $purification_option_for_usernames;
$errors = array();
$classcodes = array();
@ -67,19 +68,16 @@ function validate_data($user_classes) {
/**
* Saves imported data.
*/
function save_data($users_classes, $deleteUsersNotInList = false) {
function save_data($users_classes, $deleteUsersNotInList = false)
{
global $purification_option_for_usernames;
// Table definitions.
$user_table = Database::get_main_table(TABLE_MAIN_USER);
$usergroup = new UserGroup();
// Data parsing: purification + conversion (UserName, ClassName) --> (user_is, class_id)
$csv_data = array();
if (!empty($users_classes)) {
foreach ($users_classes as $user_class) {
$sql1 = "SELECT user_id FROM $user_table
WHERE username = '".Database::escape_string(UserManager::purify_username($user_class['UserName'], $purification_option_for_usernames))."'";
@ -105,8 +103,14 @@ function save_data($users_classes, $deleteUsersNotInList = false) {
$class_name = $user_data['class_name'];
$user_list_name = $user_data['user_list_name'];
$usergroup->subscribe_users_to_usergroup($class_id, $user_list, $deleteUsersNotInList);
$message .= Display::return_message(get_lang('Class').': '.$class_name.'<br />', 'normal', false);
$message .= Display::return_message(get_lang('Users').': '.implode(', ', $user_list_name));
$message .= Display::return_message(
get_lang('Class').': '.$class_name.'<br />',
'normal',
false
);
$message .= Display::return_message(
get_lang('Users').': '.implode(', ', $user_list_name)
);
}
}
return $message;
@ -117,7 +121,8 @@ function save_data($users_classes, $deleteUsersNotInList = false) {
* @param string $file Path to the CSV-file
* @return array All course-information read from the file
*/
function parse_csv_data($file) {
function parse_csv_data($file)
{
$courses = Import::csvToArray($file);
return $courses;
}

2
main/auth/courses_categories.php
Unescape View File

@ -10,7 +10,7 @@
if (isset($_REQUEST['action']) && Security::remove_XSS($_REQUEST['action']) !== 'subscribe') {
$stok = Security::get_token();
} else {
$stok = $_SESSION['sec_token'];
$stok = Security::getTokenFromSession();
}
$showCourses = CoursesAndSessionsCatalog::showCourses();

2
main/auth/ldap/authldap.php
Unescape View File

@ -469,7 +469,7 @@ function modify_filter($user_id, $url_params, $row) {
$query_string .= '&amp;id_session='.Security::remove_XSS($_GET['id_session']);
}
//$url_params_id="id=".$row[0];
$result = '<a href="ldap_users_list.php?action=add_user&amp;user_id='.$user_id.'&amp;'.$query_string.'&amp;sec_token='.$_SESSION['sec_token'].'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice"), ENT_QUOTES, api_get_system_encoding()))."'".')) return false;">'.Display::return_icon('add_user.gif', get_lang('AddUsers')).'</a>';
$result = '<a href="ldap_users_list.php?action=add_user&amp;user_id='.$user_id.'&amp;'.$query_string.'&amp;sec_token='.Security::getTokenFromSession().'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice"), ENT_QUOTES, api_get_system_encoding()))."'".')) return false;">'.Display::return_icon('add_user.gif', get_lang('AddUsers')).'</a>';
return $result;
}

10
main/inc/lib/auth.lib.php
Unescape View File

@ -643,9 +643,13 @@ class Auth
$message = get_lang('CourseRequiresPassword').'<br />';
$message .= $all_course_information['title'].' ('.$all_course_information['visual_code'].') ';
$action = api_get_path(WEB_CODE_PATH)."auth/courses.php?action=subscribe_user_with_password&sec_token=".$_SESSION['sec_token'];
$form = new FormValidator('subscribe_user_with_password', 'post', $action);
$form->addElement('hidden', 'sec_token', $_SESSION['sec_token']);
$action = api_get_path(WEB_CODE_PATH)."auth/courses.php?action=subscribe_user_with_password&sec_token=".Security::getTokenFromSession();
$form = new FormValidator(
'subscribe_user_with_password',
'post',
$action
);
$form->addElement('hidden', 'sec_token', Security::getTokenFromSession());
$form->addElement('hidden', 'subscribe_user_with_password', $all_course_information['code']);
$form->addElement('text', 'course_registration_code');
$form->addButton('submit', get_lang('SubmitRegistrationCode'));

2
main/inc/lib/course_category.lib.php
Unescape View File

@ -1067,7 +1067,7 @@ class CourseCategory
$pageUrl .=
'&search_term='.$searchTerm.
'&search_course=1'.
'&sec_token='.$_SESSION['sec_token'];
'&sec_token='.Security::getTokenFromSession();
break;
case 'display_courses':
// No break

42
main/inc/lib/security.lib.php
Unescape View File

@ -1,6 +1,7 @@
<?php
/* For licensing terms, see /license.txt */
use ChamiloSession as Session;
use Chamilo\CoreBundle\Component\HTMLPurifier\Filter\AllowIframes;
/**
@ -117,6 +118,14 @@ class Security
return disable_dangerous_file($filename);
}
/**
* @return string
*/
public function getTokenFromSession()
{
return Session::read('sec_token');
}
/**
* This function checks that the token generated in get_token() has been kept (prevents
* Cross-Site Request Forgeries attacks)
@ -125,27 +134,28 @@ class Security
*/
public static function check_token($request_type = 'post')
{
$sessionToken = Session::read('sec_token');
switch ($request_type) {
case 'request':
if (isset($_SESSION['sec_token']) && isset($_REQUEST['sec_token']) && $_SESSION['sec_token'] === $_REQUEST['sec_token']) {
if (!empty($sessionToken) && isset($_REQUEST['sec_token']) && $sessionToken === $_REQUEST['sec_token']) {
return true;
}
return false;
case 'get':
if (isset($_SESSION['sec_token']) && isset($_GET['sec_token']) && $_SESSION['sec_token'] === $_GET['sec_token']) {
if (!empty($sessionToken) && isset($_GET['sec_token']) && $sessionToken === $_GET['sec_token']) {
return true;
}
return false;
case 'post':
if (isset($_SESSION['sec_token']) && isset($_POST['sec_token']) && $_SESSION['sec_token'] === $_POST['sec_token']) {
if (!empty($sessionToken) && isset($_POST['sec_token']) && $sessionToken === $_POST['sec_token']) {
return true;
}
return false;
default:
if (isset($_SESSION['sec_token']) && isset($request_type) && $_SESSION['sec_token'] === $request_type) {
if (!empty($sessionToken) && isset($request_type) && $sessionToken === $request_type) {
return true;
}
@ -161,7 +171,10 @@ class Security
*/
public static function check_ua()
{
if (isset($_SESSION['sec_ua']) && $_SESSION['sec_ua'] === $_SERVER['HTTP_USER_AGENT'].$_SESSION['sec_ua_seed']) {
$security = Session::read('sec_ua');
$securitySeed = Session::read('sec_ua_seed');
if ($security === $_SERVER['HTTP_USER_AGENT'].$securitySeed) {
return true;
}
@ -174,8 +187,7 @@ class Security
*/
public static function clear_token()
{
$_SESSION['sec_token'] = null;
unset($_SESSION['sec_token']);
Session::erase('sec_token');
}
/**
@ -191,7 +203,7 @@ class Security
{
$token = md5(uniqid(rand(), true));
$string = '<input type="hidden" name="sec_token" value="'.$token.'" />';
$_SESSION['sec_token'] = $token;
Session::write('sec_token', $token);
return $string;
}
@ -208,7 +220,7 @@ class Security
public static function get_token()
{
$token = md5(uniqid(rand(), true));
$_SESSION['sec_token'] = $token;
Session::write('sec_token', $token);
return $token;
}
@ -218,11 +230,10 @@ class Security
*/
public static function get_existing_token()
{
if (isset($_SESSION['sec_token']) && !empty($_SESSION['sec_token'])) {
return $_SESSION['sec_token'];
$token = Session::read('sec_token');
if (!empty($token)) {
return $token;
} else {
return self::get_token();
}
}
@ -234,8 +245,9 @@ class Security
*/
public static function get_ua()
{
$_SESSION['sec_ua_seed'] = uniqid(rand(), true);
$_SESSION['sec_ua'] = $_SERVER['HTTP_USER_AGENT'].$_SESSION['sec_ua_seed'];
$seed = uniqid(rand(), true);
Session::write('sec_ua_seed', $seed);
Session::write('sec_ua', $_SERVER['HTTP_USER_AGENT'].$seed);
}
/**

2
main/user/user.php
Unescape View File

@ -998,7 +998,7 @@ function modify_filter($user_id, $row, $data)
// If platform admin, show the login_as icon (this drastically shortens
// time taken by support to test things out)
if (api_is_platform_admin()) {
$result .= ' <a href="'.api_get_path(WEB_CODE_PATH).'admin/user_list.php?action=login_as&user_id='.$user_id.'&sec_token='.$_SESSION['sec_token'].'">'.
$result .= ' <a href="'.api_get_path(WEB_CODE_PATH).'admin/user_list.php?action=login_as&user_id='.$user_id.'&sec_token='.Security::getTokenFromSession().'">'.
Display::return_icon('login_as.gif', get_lang('LoginAs')).'</a>&nbsp;&nbsp;';
}

Write Preview
Loading…
Cancel
Save