Skip to content

Commit 52ef413

Browse files
jmontoyaajmontoyaa
committed
Add database::escape_string, Security::remove_XSS
1 parent 3d62bc8 commit 52ef413

File tree

7 files changed

+36
-37
lines changed

7 files changed

+36
-37
lines changed

‎main/exercice/adminhp.php‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,26 +20,25 @@
2020
}
2121

2222
$newName = !empty($_REQUEST['newName']) ? $_REQUEST['newName'] : '';
23-
$hotpotatoesName = !empty($_REQUEST['hotpotatoesName']) ? $_REQUEST['hotpotatoesName'] : '';
24-
25-
$is_allowedToEdit=api_is_allowed_to_edit(null,true);
23+
$hotpotatoesName = !empty($_REQUEST['hotpotatoesName']) ? Security::remove_XSS($_REQUEST['hotpotatoesName']) : '';
24+
$is_allowedToEdit = api_is_allowed_to_edit(null,true);
2625

2726
// document path
2827
$documentPath = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
2928

3029
// picture path
31-
$picturePath=$documentPath.'/images';
30+
$picturePath = $documentPath.'/images';
3231

3332
// audio path
34-
$audioPath=$documentPath.'/audio';
33+
$audioPath = $documentPath.'/audio';
3534

3635
// Database table definitions
3736
if (!$is_allowedToEdit) {
3837
api_not_allowed(true);
3938
}
4039

4140
if (isset($_SESSION['gradebook'])) {
42-
$gradebook= $_SESSION['gradebook'];
41+
$gradebook = $_SESSION['gradebook'];
4342
}
4443

4544
if (!empty($gradebook) && $gradebook == 'view') {

‎main/exercice/hotpotatoes_exercise_report.php‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,28 @@
11
<?php
22
/* For licensing terms, see /license.txt */
3+
4+
use ChamiloSession as Session;
5+
36
/**
47
* Exercise list: This script shows the list of exercises for administrators and students.
58
* @package chamilo.exercise
69
* @author hubert.borderiou
710
*
811
*/
912

10-
use ChamiloSession as Session;
11-
12-
// including the global library
1313
require_once '../inc/global.inc.php';
1414

1515
// Setting the tabs
1616
$this_section = SECTION_COURSES;
17-
1817
$htmlHeadXtra[] = api_get_jqgrid_js();
18+
$_course = api_get_course_info();
1919

2020
// Access control
2121
api_protect_course_script(true, false, true);
2222

2323
// including additional libraries
2424
require_once 'hotpotatoes.lib.php';
2525

26-
2726
// document path
2827
$documentPath = api_get_path(SYS_COURSE_PATH).$_course['path']."/document";
2928

@@ -37,7 +36,7 @@
3736
$TBL_LP_ITEM_VIEW = Database :: get_course_table(TABLE_LP_ITEM_VIEW);
3837

3938
$course_id = api_get_course_int_id();
40-
$hotpotatoes_path = isset($_REQUEST['path']) ? $_REQUEST['path'] : null;
39+
$hotpotatoes_path = isset($_REQUEST['path']) ? Security::remove_XSS($_REQUEST['path']) : null;
4140
$filter_user = isset($_REQUEST['filter_by_user']) ? intval($_REQUEST['filter_by_user']) : null;
4241

4342
if (empty($hotpotatoes_path)) {
@@ -73,10 +72,12 @@
7372
if ($is_allowedToEdit && $origin != 'learnpath') {
7473
// the form
7574
if (api_is_platform_admin() || api_is_course_admin() || api_is_course_tutor() || api_is_course_coach()) {
76-
$actions .= '<a id="export_opener" href="'.api_get_self().'?export_report=1&path='.Security::remove_XSS($hotpotatoes_path).' ">'.Display::return_icon('save.png', get_lang('Export'),'',ICON_SIZE_MEDIUM).'</a>';
75+
$actions .= '<a id="export_opener" href="'.api_get_self().'?export_report=1&path='.$hotpotatoes_path.' ">'.
76+
Display::return_icon('save.png', get_lang('Export'),'',ICON_SIZE_MEDIUM).'</a>';
7777
}
7878
} else {
79-
$actions .= '<a href="exercise.php">' . Display :: return_icon('back.png', get_lang('GoBackToQuestionList'),'',ICON_SIZE_MEDIUM).'</a>';
79+
$actions .= '<a href="exercise.php">' .
80+
Display :: return_icon('back.png', get_lang('GoBackToQuestionList'),'',ICON_SIZE_MEDIUM).'</a>';
8081
}
8182

8283
if ($is_allowedToEdit) {

‎main/exercice/hotpotatoes_exercise_result.class.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ public function getExercisesReporting($document_path, $hotpotato_name)
121121
* @param boolean Whether to include user fields or not
122122
* @return boolean False on error
123123
*/
124-
public function exportCompleteReportCSV($document_path='', $hotpotato_name)
124+
public function exportCompleteReportCSV($document_path = '', $hotpotato_name)
125125
{
126126
global $charset;
127127
$this->getExercisesReporting($document_path, $hotpotato_name);

‎main/exercice/hotspot_admin.inc.php‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use \ChamiloSession as Session;
5+
46
/**
57
* This script allows to manage answers. It is included from the
68
* script admin.php
79
* @package chamilo.exercise
810
* @author Toon Keppens
911
*/
10-
use \ChamiloSession as Session;
1112

1213
$modifyAnswers = intval($_GET['hotspotadmin']);
1314

@@ -246,11 +247,11 @@
246247
} // end for()
247248

248249
//now the noerror section
249-
$selectQuestionNoError = $_POST['select_question_noerror'];
250-
$lp_noerror = $_POST['lp_noerror'];
251-
$try_noerror = isset($_POST['try_noerror']) ? $_POST['try_noerror'] : null;
252-
$url_noerror = $_POST['url_noerror'];
253-
$comment_noerror = $_POST['comment_noerror'];
250+
$selectQuestionNoError = Security::remove_XSS($_POST['select_question_noerror']);
251+
$lp_noerror = Security::remove_XSS($_POST['lp_noerror']);
252+
$try_noerror = isset($_POST['try_noerror']) ? Security::remove_XSS($_POST['try_noerror']) : null;
253+
$url_noerror = Security::remove_XSS($_POST['url_noerror']);
254+
$comment_noerror = Security::remove_XSS($_POST['comment_noerror']);
254255
$threadhold_total = '0;0;0';
255256

256257
if ($try_noerror == 'on') {
@@ -292,6 +293,7 @@
292293
if ($weighting[$i]) {
293294
$questionWeighting+=$weighting[$i];
294295
}
296+
295297
// creates answer
296298
$objAnswer->createAnswer(
297299
$reponse[$i],
@@ -324,7 +326,6 @@
324326

325327
$editQuestion = $questionId;
326328
unset($modifyAnswers);
327-
328329
echo '<script type="text/javascript">window.location.href="' . $hotspot_admin_url . '&message=ItemUpdated"</script>';
329330
}
330331
}

‎main/forum/forumqualify.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ function hidecontent(content){
171171
// Show max qualify in my form
172172
$maxQualify = showQualify('2', $userIdToQualify, $threadId);
173173

174-
$score = isset($_POST['idtextqualify']) ? $_POST['idtextqualify'] : '';
174+
$score = isset($_POST['idtextqualify']) ? Security::remove_XSS($_POST['idtextqualify']) : '';
175175

176176
if ($score > $maxQualify) {
177177
Display:: display_error_message(
@@ -292,7 +292,7 @@ function hidecontent(content){
292292
$realname = $attachment_list['path'];
293293
$user_filename = $attachment_list['filename'];
294294

295-
echo Display::return_icon('attachment.gif',get_lang('Attachment'));
295+
echo Display::return_icon('attachment.gif', get_lang('Attachment'));
296296
echo '<a href="download.php?file=';
297297
echo $realname;
298298
echo ' "> '.$user_filename.' </a>';

‎main/inc/lib/fileUpload.lib.php‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1202,7 +1202,7 @@ function filter_extension(&$filename)
12021202
* @param int $group_id
12031203
* @param int $session_id Session ID, if any
12041204
* @param int $userId creator id
1205-
*
1205+
*
12061206
* @return int id if inserted document
12071207
*/
12081208
function add_document(
@@ -1542,13 +1542,12 @@ function create_unexisting_directory(
15421542
WHERE
15431543
c_id = $course_id AND
15441544
(
1545-
path = '" . $systemFolderName . "'
1545+
path = '" . Database::escape_string($systemFolderName). "'
15461546
)
15471547
";
15481548

15491549
$rs = Database::query($sql);
15501550
if (Database::num_rows($rs) == 0) {
1551-
15521551
$document_id = add_document(
15531552
$_course,
15541553
$systemFolderName,
@@ -1566,7 +1565,6 @@ function create_unexisting_directory(
15661565
if ($document_id) {
15671566
// Update document item_property
15681567
if (!empty($visibility)) {
1569-
15701568
$visibilities = array(
15711569
0 => 'invisible',
15721570
1 => 'visible',

‎main/upload/upload.document.php‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
* @author Yannick Warnier <[email protected]>
1111
*/
1212

13+
$_course = api_get_course_info();
1314
$courseDir = $_course['path'] . "/document";
1415
$sys_course_path = api_get_path(SYS_COURSE_PATH);
1516
$base_work_dir = $sys_course_path . $courseDir;
@@ -18,7 +19,7 @@
1819

1920
//what's the current path?
2021
if (isset($_POST['curdirpath'])) {
21-
$path = $_POST['curdirpath'];
22+
$path = Security::remove_XSS($_POST['curdirpath']);
2223
} else {
2324
$path = '/';
2425
}
@@ -34,7 +35,7 @@
3435
*/
3536
$nameTools = get_lang('UplUploadDocument');
3637
$interbreadcrumb[] = array(
37-
"url" => "./document.php?curdirpath=" . urlencode($path) . '&'.api_get_cidreq(),
38+
"url" => api_get_path(WEB_CODE_PATH)."document/document.php?curdirpath=" . urlencode($path) . '&'.api_get_cidreq(),
3839
"name" => $langDocuments
3940
);
4041
Display::display_header($nameTools, "Doc");
@@ -54,14 +55,14 @@
5455
$_FILES['user_upload'],
5556
$base_work_dir,
5657
$_POST['curdirpath'],
57-
$_user['user_id'],
58+
api_get_user_id(),
5859
$to_group_id,
5960
$to_user_id,
6061
$_POST['unzip'],
6162
$_POST['if_exists']
6263
);
63-
$new_comment = isset($_POST['comment']) ? trim($_POST['comment']) : '';
64-
$new_title = isset($_POST['title']) ? trim($_POST['title']) : '';
64+
$new_comment = isset($_POST['comment']) ? Database::escape_string(trim($_POST['comment'])) : '';
65+
$new_title = isset($_POST['title']) ? Database::escape_string(trim($_POST['title'])) : '';
6566

6667
if ($new_path && ($new_comment || $new_title))
6768
if (($docid = DocumentManager::get_document_id($_course, $new_path))) {
@@ -99,7 +100,7 @@
99100
$img_directory = str_replace('.', '_', $_POST['related_file']."_files");
100101
$folderData = create_unexisting_directory(
101102
$_course,
102-
$_user['user_id'],
103+
api_get_user_id(),
103104
api_get_session_id(),
104105
$to_group_id,
105106
$to_user_id,
@@ -131,11 +132,11 @@
131132
}
132133
//they want to create a directory
133134
if (isset($_POST['create_dir']) && $_POST['dirname']!='') {
134-
$added_slash = ($path == '/') ? '' : '/';
135+
$added_slash = $path == '/' ? '' : '/';
135136
$dir_name = $path.$added_slash.api_replace_dangerous_char($_POST['dirname']);
136137
$created_dir = create_unexisting_directory(
137138
$_course,
138-
$_user['user_id'],
139+
api_get_user_id(),
139140
api_get_session_id(),
140141
$to_group_id,
141142
$to_user_id,
@@ -206,7 +207,6 @@
206207
&nbsp;&nbsp;&nbsp;<input type="radio" name="if_exists" value="nothing" title="<?php echo (get_lang('UplDoNothingLong'));?>" checked="checked"/> <?php echo (get_lang('UplDoNothing'));?><br/>
207208
&nbsp;&nbsp;&nbsp;<input type="radio" name="if_exists" value="overwrite" title="<?php echo (get_lang('UplOverwriteLong'));?>"/> <?php echo (get_lang('UplOverwrite'));?><br/>
208209
&nbsp;&nbsp;&nbsp;<input type="radio" name="if_exists" value="rename" title="<?php echo (get_lang('UplRenameLong'));?>"/> <?php echo (get_lang('UplRename'));?>
209-
210210
</td>
211211
</tr>
212212
</table>

0 commit comments

Comments
 (0)