Skip to content

Commit d13365c

Browse files
committed
Security - Add Database:escape_string and remove_XSS
1 parent 74894f2 commit d13365c

File tree

7 files changed

+32
-23
lines changed

7 files changed

+32
-23
lines changed

main/admin/languages.php

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -197,13 +197,13 @@
197197

198198
if (isset($_POST['Submit']) && $_POST['Submit']) {
199199
// changing the name
200-
$sql = "UPDATE $tbl_admin_languages SET original_name='{$_POST['txt_name']}'
201-
WHERE id='{$_POST['edit_id']}'";
200+
$name = Database::escape_string($_POST['txt_name']);
201+
$postId = (int) $_POST['edit_id'];
202+
$sql = "UPDATE $tbl_admin_languages SET original_name='$name'
203+
WHERE id='$postId'";
202204
$result = Database::query($sql);
203205
// changing the Platform language
204206
if ($_POST['platformlanguage'] && $_POST['platformlanguage'] != '') {
205-
//$sql_update_2 = "UPDATE $tbl_settings_current SET selected_value='{$_POST['platformlanguage']}' WHERE variable='platformLanguage'";
206-
//$result_2 = Database::query($sql_update_2);
207207
api_set_setting('platformLanguage', $_POST['platformlanguage'], null, null, $_configuration['access_url']);
208208
}
209209
} elseif (isset($_POST['action'])) {
@@ -253,13 +253,16 @@
253253
// including the header file (which includes the banner itself)
254254
Display::display_header($tool_name);
255255

256-
echo '<a id="disable_all_except_default" href="javascript:void(0)" class="btn btn-primary"><em class="fa fa-eye"></em> '.get_lang('LanguagesDisableAllExceptDefault').'</a><br /><br />';
256+
echo '<a
257+
id="disable_all_except_default"
258+
href="javascript:void(0)" class="btn btn-primary">
259+
<em class="fa fa-eye"></em> '.get_lang('LanguagesDisableAllExceptDefault').'</a><br /><br />';
257260

258261
// selecting all the languages
259262
$sql_select = "SELECT * FROM $tbl_admin_languages";
260263
$result_select = Database::query($sql_select);
261264

262-
$sql_select_lang = "SELECT * FROM $tbl_settings_current WHERE category='Languages'";
265+
$sql_select_lang = "SELECT * FROM $tbl_settings_current WHERE category='Languages'";
263266
$result_select_lang = Database::query($sql_select_lang);
264267
$row_lang = Database::fetch_array($result_select_lang);
265268

main/admin/subscribe_user2course.php

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,6 @@
1717

1818
api_protect_admin_script();
1919

20-
/* Global constants and variables */
21-
2220
$form_sent = 0;
2321
$first_letter_user = '';
2422
$first_letter_course = '';
@@ -30,7 +28,7 @@
3028

3129
/* Header */
3230
$tool_name = get_lang('AddUsersToACourse');
33-
$interbreadcrumb[] = ["url" => 'index.php', "name" => get_lang('PlatformAdmin')];
31+
$interbreadcrumb[] = ['url' => 'index.php', 'name' => get_lang('PlatformAdmin')];
3432

3533
$htmlHeadXtra[] = '<script>
3634
function validate_filter() {
@@ -56,7 +54,7 @@ function validate_filter() {
5654
$new_field_list = [];
5755
if (is_array($extra_field_list)) {
5856
foreach ($extra_field_list as $extra_field) {
59-
//if is enabled to filter and is a "<select>" field type
57+
// if is enabled to filter and is a "<select>" field type
6058
if ($extra_field[8] == 1 && $extra_field[2] == ExtraField::FIELD_TYPE_SELECT) {
6159
$new_field_list[] = [
6260
'name' => $extra_field[3],
@@ -83,8 +81,8 @@ function validate_filter() {
8381
$form_sent = $_POST['form_sent'];
8482
$users = isset($_POST['UserList']) && is_array($_POST['UserList']) ? $_POST['UserList'] : [];
8583
$courses = isset($_POST['CourseList']) && is_array($_POST['CourseList']) ? $_POST['CourseList'] : [];
86-
$first_letter_user = $_POST['firstLetterUser'];
87-
$first_letter_course = $_POST['firstLetterCourse'];
84+
$first_letter_user = Database::escape_string($_POST['firstLetterUser']);
85+
$first_letter_course = Database::escape_string($_POST['firstLetterCourse']);
8886

8987
foreach ($users as $key => $value) {
9088
$users[$key] = intval($value);
@@ -306,7 +304,7 @@ function validate_filter() {
306304
<b><?php echo get_lang('CourseList'); ?> :</b>
307305
<br/><br/>
308306
<?php echo get_lang('FirstLetterCourse'); ?> :
309-
<select name="firstLetterCourse"
307+
<select name="firstLetterCourse"
310308
onchange="javascript:document.formulaire.form_sent.value='2'; document.formulaire.submit();"
311309
aria-label="<?php echo get_lang('FirstLetterCourse'); ?>">
312310
<option value="">--</option>

main/admin/teacher_time_report.php

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,11 @@
4646
$selectedTeacher = $formValues['teacher'];
4747

4848
if (!empty($formValues['from'])) {
49-
$selectedFrom = $formValues['from'];
49+
$selectedFrom = Security::remove_XSS($formValues['from']);
5050
}
5151

5252
if (!empty($formValues['until'])) {
53-
$selectedUntil = $formValues['until'];
53+
$selectedUntil = Security::remove_XSS($formValues['until']);
5454
}
5555
}
5656

@@ -96,6 +96,9 @@
9696
if (!empty($selectedCourse)) {
9797
$withFilter = true;
9898
$course = api_get_course_info($selectedCourse);
99+
if (empty($course)) {
100+
api_not_allowed(true);
101+
}
99102
$reportTitle = sprintf(get_lang('TimeReportForCourseX'), $course['title']);
100103
$teachers = CourseManager::get_teacher_list_from_course_code($selectedCourse);
101104

main/auth/courses_categories.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,17 @@
88
*
99
* @package chamilo.auth
1010
*/
11+
1112
if (isset($_REQUEST['action']) && Security::remove_XSS($_REQUEST['action']) !== 'subscribe') {
1213
$stok = Security::get_token();
1314
} else {
1415
$stok = Security::getTokenFromSession();
1516
}
1617

1718
$action = !empty($_REQUEST['action']) ? Security::remove_XSS($_REQUEST['action']) : 'display_courses';
19+
global $actions;
20+
$action = in_array($action, $actions) ? $action : 'display_courses';
21+
1822
$showCourses = CoursesAndSessionsCatalog::showCourses();
1923
$showSessions = CoursesAndSessionsCatalog::showSessions();
2024
$pageCurrent = isset($pageCurrent) ? $pageCurrent : isset($_GET['pageCurrent']) ? intval($_GET['pageCurrent']) : 1;

main/inc/lib/api.lib.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3270,6 +3270,7 @@ function api_display_tool_view_option()
32703270
$output_string .= '<a class="btn btn-default btn-sm" href="'.$sourceurl.'&isStudentView=true" target="_self">'.
32713271
Display::returnFontAwesomeIcon('eye').' '.get_lang('SwitchToStudentView').'</a>';
32723272
}
3273+
$output_string = Security::remove_XSS($output_string);
32733274
$html = Display::tag('div', $output_string, ['class' => 'view-options']);
32743275

32753276
return $html;

main/inc/lib/formvalidator/Element/DateRangePicker.php

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ public function setValue($value)
5353
*/
5454
public function parseDateRange($dateRange)
5555
{
56+
$dateRange = Security::remove_XSS($dateRange);
5657
$dates = explode('/', $dateRange);
5758
$dates = array_map('trim', $dates);
5859
$start = isset($dates[0]) ? $dates[0] : '';
@@ -82,7 +83,7 @@ public function validateDates($dates, $format = null)
8283
$d = DateTime::createFromFormat($format, $dates['end']);
8384
$resultEnd = $d && $d->format($format) == $dates['end'];
8485

85-
if (!($resultStart) || !$resultEnd) {
86+
if (!$resultStart || !$resultEnd) {
8687
return false;
8788
}
8889

@@ -133,29 +134,29 @@ private function getElementJS()
133134
}
134135

135136
$minDate = null;
136-
$minDateValue = $this->getAttribute('minDate');
137+
$minDateValue = Security::remove_XSS($this->getAttribute('minDate'));
137138
if (!empty($minDateValue)) {
138139
$minDate = "
139140
minDate: '{$minDateValue}',
140141
";
141142
}
142143

143144
$maxDate = null;
144-
$maxDateValue = $this->getAttribute('maxDate');
145+
$maxDateValue = Security::remove_XSS($this->getAttribute('maxDate'));
145146
if (!empty($maxDateValue)) {
146147
$maxDate = "
147148
maxDate: '{$maxDateValue}',
148149
";
149150
}
150151

151152
$format = 'YYYY-MM-DD HH:mm';
152-
$formatValue = $this->getAttribute('format');
153+
$formatValue = Security::remove_XSS($this->getAttribute('format'));
153154
if (!empty($formatValue)) {
154155
$format = $formatValue;
155156
}
156157

157158
$timePicker = 'true';
158-
$timePickerValue = $this->getAttribute('timePicker');
159+
$timePickerValue = Security::remove_XSS($this->getAttribute('timePicker'));
159160
if (!empty($timePickerValue)) {
160161
$timePicker = $timePickerValue;
161162
}

main/inc/lib/formvalidator/Element/HtmlEditor.php

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,7 @@ public function __construct(
5454
*/
5555
public function toHtml()
5656
{
57-
$value = $this->getValue();
58-
57+
$value = Security::remove_XSS($this->getValue());
5958
if ($this->editor) {
6059
if ($this->editor->getConfigAttribute('fullPage')) {
6160
if (strlen(trim($value)) == 0) {
@@ -100,7 +99,7 @@ public function buildEditor($style = false)
10099
{
101100
$result = '';
102101
if ($this->editor) {
103-
$this->editor->value = $this->getValue();
102+
$this->editor->value = Security::remove_XSS($this->getValue());
104103
$this->editor->setName($this->getName());
105104
if ($style == true) {
106105
$result = $this->editor->createHtmlStyle();

0 commit comments

Comments
 (0)