From 6aab8111069f2a5dc37af6a819e3e1b3c7794e48 Mon Sep 17 00:00:00 2001 From: Harris Wong Date: Fri, 23 Sep 2011 20:37:13 +0000 Subject: [PATCH] AC-4804: Security fixes for XSS, possible sql injection on multiple scripts within acontent. --- docs/documentation/search.php | 4 ++-- docs/home/search.php | 2 +- docs/include/classes/DAO/UsersDAO.class.php | 2 ++ docs/themes/default/course_category/index.tmpl.php | 2 +- .../default/language/language_add_edit.tmpl.php | 14 +++++++------- docs/themes/default/login.tmpl.php | 4 ++-- .../default/user/user_group_create_edit.tmpl.php | 6 +++--- docs/updater/patch_edit.php | 2 +- docs/user/user_create_edit.php | 1 + 9 files changed, 20 insertions(+), 17 deletions(-) diff --git a/docs/documentation/search.php b/docs/documentation/search.php index 5d58a32..8611a31 100644 --- a/docs/documentation/search.php +++ b/docs/documentation/search.php @@ -55,7 +55,7 @@ if ($_GET['query']) { $final_match_rows = array(); foreach ($search_terms as $term) { - $match_rows = $languageTextDAO->getHelpByMatchingText($term, $_SESSION['lang']); + $match_rows = $languageTextDAO->getHelpByMatchingText($addslashes($term), $_SESSION['lang']); if (is_array($match_rows)) $final_match_rows = array_merge($final_match_rows, $match_rows); } @@ -120,4 +120,4 @@ if ($_GET['query']) { } ?> - \ No newline at end of file + diff --git a/docs/home/search.php b/docs/home/search.php index 4e50f6a..22bb69c 100644 --- a/docs/home/search.php +++ b/docs/home/search.php @@ -32,7 +32,7 @@ $courseCategoriesDAO = new CourseCategoriesDAO(); //$my_courses = array(); $search_text = trim($_GET['search_text']); -$courses = $coursesDAO->getSearchResult($search_text, $_GET['catid']); +$courses = $coursesDAO->getSearchResult($addslashes($search_text), $_GET['catid']); // handle submits if (isset($_GET['action'], $_GET['cid']) && $_SESSION['user_id'] > 0) diff --git a/docs/include/classes/DAO/UsersDAO.class.php b/docs/include/classes/DAO/UsersDAO.class.php index 859e7ca..f646ec0 100644 --- a/docs/include/classes/DAO/UsersDAO.class.php +++ b/docs/include/classes/DAO/UsersDAO.class.php @@ -296,6 +296,7 @@ class UsersDAO extends DAO { */ public function getUserByID($userID) { + $userID = intval($userID); $sql = 'SELECT * FROM '.TABLE_PREFIX.'users WHERE user_id='.$userID; if ($rows = $this->execute($sql)) { @@ -313,6 +314,7 @@ class UsersDAO extends DAO { */ public function getUserByWebServiceID($webServiceID) { + $webServiceID = intval($webServiceID); $sql = "SELECT * FROM ".TABLE_PREFIX."users WHERE web_service_id='".$webServiceID."'"; if ($rows = $this->execute($sql)) { diff --git a/docs/themes/default/course_category/index.tmpl.php b/docs/themes/default/course_category/index.tmpl.php index a65e4fc..ba4b5a5 100644 --- a/docs/themes/default/course_category/index.tmpl.php +++ b/docs/themes/default/course_category/index.tmpl.php @@ -17,7 +17,7 @@ include(TR_INCLUDE_PATH.'header.inc.php'); ?>
-
+
diff --git a/docs/themes/default/language/language_add_edit.tmpl.php b/docs/themes/default/language/language_add_edit.tmpl.php index 2ac2d52..b66f1c0 100644 --- a/docs/themes/default/language/language_add_edit.tmpl.php +++ b/docs/themes/default/language/language_add_edit.tmpl.php @@ -16,7 +16,7 @@ $onload = "initial();"; include(TR_INCLUDE_PATH.'header.inc.php'); ?> -" > row["language_code"])) {?> " /> " /> @@ -41,7 +41,7 @@ include(TR_INCLUDE_PATH.'header.inc.php'); foreach ($this->rows_lang as $row_lang) { ?> - + @@ -54,7 +54,7 @@ include(TR_INCLUDE_PATH.'header.inc.php'); @@ -63,7 +63,7 @@ include(TR_INCLUDE_PATH.'header.inc.php'); @@ -73,7 +73,7 @@ include(TR_INCLUDE_PATH.'header.inc.php'); @@ -81,13 +81,13 @@ include(TR_INCLUDE_PATH.'header.inc.php'); - + - + diff --git a/docs/themes/default/login.tmpl.php b/docs/themes/default/login.tmpl.php index a17182d..9f369bd 100644 --- a/docs/themes/default/login.tmpl.php +++ b/docs/themes/default/login.tmpl.php @@ -31,10 +31,10 @@ function encrypt_password() { - + - +
diff --git a/docs/themes/default/user/user_group_create_edit.tmpl.php b/docs/themes/default/user/user_group_create_edit.tmpl.php index 006e8ed..1093703 100644 --- a/docs/themes/default/user/user_group_create_edit.tmpl.php +++ b/docs/themes/default/user/user_group_create_edit.tmpl.php @@ -16,7 +16,7 @@ $onload = "initial();"; include(TR_INCLUDE_PATH.'header.inc.php'); ?> -" > user_group_row["user_group_id"])) {?> " /> @@ -31,12 +31,12 @@ include(TR_INCLUDE_PATH.'header.inc.php');
- + - + user_group_row['user_group_id'])) {?> diff --git a/docs/updater/patch_edit.php b/docs/updater/patch_edit.php index 949eae4..acfc6ec 100644 --- a/docs/updater/patch_edit.php +++ b/docs/updater/patch_edit.php @@ -22,7 +22,7 @@ if (!isset($_REQUEST["myown_patch_id"])) exit; } -$myown_patch_id = $_REQUEST["myown_patch_id"]; +$myown_patch_id = intval($_REQUEST["myown_patch_id"]); $myownPatchesDAO = new MyownPatchesDAO(); $myownPatchesDependentDAO = new MyownPatchesDependentDAO(); diff --git a/docs/user/user_create_edit.php b/docs/user/user_create_edit.php index f57de56..16e607d 100644 --- a/docs/user/user_create_edit.php +++ b/docs/user/user_create_edit.php @@ -16,6 +16,7 @@ include_once(TR_INCLUDE_PATH.'classes/DAO/UsersDAO.class.php'); include_once(TR_INCLUDE_PATH.'classes/DAO/UserGroupsDAO.class.php'); // handle submit +$_GET['id'] = intval($_GET['id']); if (isset($_POST['cancel'])) { header('Location: index.php'); exit; -- 2.17.1
row['language_code'])) echo $this->row['language_code']; else {?> - +
row['language_code'])) if ($this->row['locale'] == '') echo _AT('na'); else echo $this->row['locale']; else {?> - +
row['language_code'])) echo $this->row['charset']; else {?> - row["charset"]; else echo DEFAULT_CHARSET; ?>" /> + row["charset"], 'input.text'); else echo DEFAULT_CHARSET; ?>" />
* " />" />
* " />" />
*" />" />