Skip to content

Commit 2a47c02

Browse files
jmontoyaajmontoyaa
committed
Add intval + Security::remove_XSS
1 parent 6b71eec commit 2a47c02

File tree

13 files changed

+37
-73
lines changed

13 files changed

+37
-73
lines changed

‎main/admin/ldap_users_list.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@
7878
}
7979
if (isset($_GET['id_session']) && ($_GET['id_session'] == strval(intval($_GET['id_session']))) && ($_GET['id_session']>0)) {
8080
ldap_add_user_to_session($UserList, $_GET['id_session']);
81-
header('Location: resume_session.php?id_session='.$_GET['id_session']);
81+
header('Location: resume_session.php?id_session='.intval($_GET['id_session']));
8282
} else {
8383
Display :: display_header($tool_name);
8484
if(count($userid_match_login)>0)

‎main/coursecopy/copy_course.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,9 @@
6161
$cr->set_file_option($_POST['same_file_name_option']);
6262
$cr->restore($_POST['destination_course']);
6363
Display::display_normal_message(
64-
get_lang('CopyFinished').': <a href="'.api_get_course_url($_POST['destination_course']).'">'.$_POST['destination_course'].'</a>',
64+
get_lang('CopyFinished').': <a href="'.api_get_course_url($_POST['destination_course']).'">'.
65+
Security::remove_XSS($_POST['destination_course']).
66+
'</a>',
6567
false
6668
);
6769
} elseif (Security::check_token('post') && (

‎main/dropbox/index.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,15 @@
3232
// Build URL-parameters for table-sorting
3333
$sort_params = array();
3434
if (isset($_GET['dropbox_column'])) {
35-
$sort_params[] = 'dropbox_column='.$_GET['dropbox_column'];
35+
$sort_params[] = 'dropbox_column='.intval($_GET['dropbox_column']);
3636
}
3737
if (isset($_GET['dropbox_page_nr'])) {
3838
$sort_params[] = 'page_nr='.intval($_GET['page_nr']);
3939
}
4040
if (isset($_GET['dropbox_per_page'])) {
4141
$sort_params[] = 'dropbox_per_page='.intval($_GET['dropbox_per_page']);
4242
}
43-
if (isset($_GET['dropbox_direction'])) {
43+
if (isset($_GET['dropbox_direction']) && in_array($_GET['dropbox_direction'], ['ASC', 'DESC'])) {
4444
$sort_params[] = 'dropbox_direction='.$_GET['dropbox_direction'];
4545
}
4646

‎main/gradebook/index.php‎

Lines changed: 7 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -104,27 +104,18 @@ function confirmation() {
104104
$_GET['selectcat'] = $cats[0]->get_id();
105105

106106
if (isset($_GET['isStudentView'])) {
107-
if ( (isset($_GET['selectcat']) && $_GET['selectcat']>0) && (isset($_SESSION['studentview']) && $_SESSION['studentview']=='studentview') ) {
108-
$interbreadcrumb[]= array ('url' => 'index.php'.'?selectcat=0&amp;isStudentView='.$_GET['isStudentView'],'name' => get_lang('ToolGradebook'));
107+
if ((isset($_GET['selectcat']) && $_GET['selectcat'] > 0) && (isset($_SESSION['studentview']) && $_SESSION['studentview'] == 'true')) {
108+
$interbreadcrumb[] = array(
109+
'url' => 'index.php'.'?selectcat=0&isStudentView=true',
110+
'name' => get_lang('ToolGradebook'),
111+
);
109112
}
110113
}
111114

112115
if ((isset($_GET['selectcat']) && $_GET['selectcat']>0) &&
113-
(isset($_SESSION['studentview']) && $_SESSION['studentview']=='studentview')
116+
(isset($_SESSION['studentview']) && $_SESSION['studentview']=='true')
114117
) {
115-
/*Display :: display_header();
116-
//Introduction tool: student view
117-
Display::display_introduction_section(TOOL_GRADEBOOK, array('ToolbarSet' => 'AssessmentsIntroduction'));
118-
$category = $_GET['selectcat'];
119-
$cats = Category :: load ($category, null, null, null, null, null, false);
120-
$allcat = $cats[0]->get_subcategories($stud_id, $course_code, $session_id);
121-
$alleval = $cats[0]->get_evaluations($stud_id);
122-
$alllink = $cats[0]->get_links($stud_id);
123-
$addparams = array();
124-
$gradebooktable= new GradebookTable($cats[0], $allcat, $alleval,$alllink, $addparams);
125-
$gradebooktable->display();
126-
Display :: display_footer();
127-
exit;*/
118+
128119
} else {
129120
if (!isset($_GET['selectcat']) &&
130121
($_SESSION['studentview']=='studentview') ||

‎main/inc/lib/course_home.lib.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1184,7 +1184,7 @@ public static function show_navigation_menu()
11841184
}
11851185

11861186
if (stristr($url_item['path'], $url_current['path'])) {
1187-
if (!isset($_GET['learnpath_id']) || strpos($url_item['query'], 'learnpath_id='.$_GET['learnpath_id']) === 0) {
1187+
if (!isset($_GET['learnpath_id']) || strpos($url_item['query'], 'learnpath_id='.intval($_GET['learnpath_id'])) === 0) {
11881188
$html .= ' id="here"';
11891189
}
11901190
}

‎main/mySpace/student.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ function get_users($from, $limit, $column, $direction)
5656
$active = isset($_GET['active']) ? $_GET['active'] : 1;
5757
$keyword = isset($_GET['keyword']) ? Security::remove_XSS($_GET['keyword']) : null;
5858
$sleepingDays = isset($_GET['sleeping_days']) ? intval($_GET['sleeping_days']) : null;
59+
$sessionId = isset($_GET['id_session']) ? (int) $_GET['id_session'] : 0;
5960

6061
$lastConnectionDate = null;
6162
if (!empty($sleepingDays)) {
@@ -111,7 +112,7 @@ function get_users($from, $limit, $column, $direction)
111112
foreach ($students as $student_data) {
112113
$student_id = $student_data['user_id'];
113114
if (isset($_GET['id_session'])) {
114-
$courses = Tracking :: get_course_list_in_session_from_student($student_id, $_GET['id_session']);
115+
$courses = Tracking :: get_course_list_in_session_from_student($student_id, $sessionId);
115116
}
116117

117118
$avg_time_spent = $avg_student_score = $avg_student_progress = $total_assignments = $total_messages = 0;
@@ -121,8 +122,8 @@ function get_users($from, $limit, $column, $direction)
121122
$courseInfo = api_get_course_info($course_code);
122123
$courseId = $courseInfo['real_id'];
123124
if (CourseManager :: is_user_subscribed_in_course($student_id, $course_code, true)) {
124-
$avg_time_spent += Tracking :: get_time_spent_on_the_course($student_id, $courseId, $_GET['id_session']);
125-
$my_average = Tracking :: get_avg_student_score($student_id, $course_code);
125+
$avg_time_spent += Tracking :: get_time_spent_on_the_course($student_id, $courseId, $sessionId);
126+
$my_average = Tracking :: get_avg_student_score($student_id, $course_code);
126127
if (is_numeric($my_average)) {
127128
$avg_student_score += $my_average;
128129
}
@@ -158,7 +159,7 @@ function get_users($from, $limit, $column, $direction)
158159
$row[] = $string_date;
159160

160161
if (isset($_GET['id_coach']) && intval($_GET['id_coach']) != 0) {
161-
$detailsLink = '<a href="myStudents.php?student='.$student_id.'&id_coach='.$coach_id.'&id_session='.$_GET['id_session'].'">
162+
$detailsLink = '<a href="myStudents.php?student='.$student_id.'&id_coach='.$coach_id.'&id_session='.$sessionId.'">
162163
'.Display::return_icon('2rightarrow.png').'</a>';
163164
} else {
164165
$detailsLink = '<a href="myStudents.php?student='.$student_id.'">

‎main/mySpace/teachers.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ function get_users($from, $limit, $column, $direction)
5858
$active = isset($_GET['active']) ? $_GET['active'] : 1;
5959
$keyword = isset($_GET['keyword']) ? Security::remove_XSS($_GET['keyword']) : null;
6060
$sleepingDays = isset($_GET['sleeping_days']) ? intval($_GET['sleeping_days']) : null;
61+
$sessionId = isset($_GET['id_session']) ? (int) $_GET['id_session'] : 0;
6162

6263
$lastConnectionDate = null;
6364
if (!empty($sleepingDays)) {
@@ -159,7 +160,7 @@ function get_users($from, $limit, $column, $direction)
159160
$row[] = $string_date;
160161

161162
if (isset($_GET['id_coach']) && intval($_GET['id_coach']) != 0) {
162-
$detailsLink = '<a href="myStudents.php?student='.$student_id.'&id_coach='.$coach_id.'&id_session='.$_GET['id_session'].'">
163+
$detailsLink = '<a href="myStudents.php?student='.$student_id.'&id_coach='.$coach_id.'&id_session='.$sessionId.'">
163164
'.Display::return_icon('2rightarrow.png', get_lang('Details')).'</a>';
164165
} else {
165166
$detailsLink = '<a href="myStudents.php?student='.$student_id.'">

‎main/mySpace/users.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ function get_users($from, $limit, $column, $direction)
5757
$keyword = isset($_GET['keyword']) ? Security::remove_XSS($_GET['keyword']) : null;
5858
$sleepingDays = isset($_GET['sleeping_days']) ? intval($_GET['sleeping_days']) : null;
5959
$status = isset($_GET['status']) ? Security::remove_XSS($_GET['status']) : null;
60-
60+
$sessionId = isset($_GET['id_session']) ? (int) $_GET['id_session'] : 0;
6161

6262
$lastConnectionDate = null;
6363
if (!empty($sleepingDays)) {
@@ -160,7 +160,7 @@ function get_users($from, $limit, $column, $direction)
160160
$row[] = $string_date;
161161

162162
if (isset($_GET['id_coach']) && intval($_GET['id_coach']) != 0) {
163-
$detailsLink = '<a href="myStudents.php?student='.$student_id.'&id_coach='.$coach_id.'&id_session='.$_GET['id_session'].'">
163+
$detailsLink = '<a href="myStudents.php?student='.$student_id.'&id_coach='.$coach_id.'&id_session='.$sessionId.'">
164164
'.Display::return_icon('2rightarrow.png', get_lang('Details')).'</a>';
165165
} else {
166166
$detailsLink = '<a href="myStudents.php?student='.$student_id.'">

‎main/resourcelinker/resourcelinker.inc.php‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1275,41 +1275,8 @@ function get_addedresource_link_in_learnpath($type, $id, $id_in_path)
12751275
$link .= "../phpbb/viewtopic.php?topic=".$myrow["topic_id"]."&forum=".$myrow["forum_id"]."&md5=".$myrow["md5"];
12761276
}
12771277
break;
1278-
12791278
case "Post":
1280-
/* todo REVIEW THIS SECTION - NOT USING VALID TABLES ANYMORE
1281-
$tbl_posts = $_course['dbNameGlu'].'bb_posts';
1282-
$tbl_posts_text = $_course['dbNameGlu'].'bb_posts_text';
1283-
$TBL_FORUMS = $_course['dbNameGlu']."bb_forums";
1284-
$result= Database::query("SELECT * FROM $tbl_posts where post_id=$id");
1285-
$myrow=Database::fetch_array($result);
1286-
// grabbing the title of the post
1287-
$sql_titel="SELECT * FROM $tbl_posts_text WHERE post_id=".$myrow["post_id"];
1288-
$result_titel=Database::query($sql_titel);
1289-
$myrow_titel=Database::fetch_array($result_titel);
1290-
1291-
$sql="select * from $tbl_learnpath_item where id=$id_in_path";
1292-
$result=Database::query($sql); $row=Database::fetch_array($result);
1293-
if ($row['title'] != '') { $myrow_titel["post_title"]=$row['title']; }
1294-
$desc=$row['description'];
1295-
$link .= str_repeat("&nbsp;&gt;",$level);
1296-
1297-
$posternom=$myrow['nom']; $posterprenom=$myrow['prenom'];
1298-
$posttime=$myrow['post_time']; $posttext=$myrow_titel['post_text'];
1299-
$posttitle=$myrow_titel['post_title'];
1300-
$posttext = str_replace('"',"'",$posttext);
1301-
1302-
if ($builder != 'builder')
1303-
{
1304-
$link .= api_get_self()."?action=closelesson&source_forum=".$_GET['source_forum']."&how=complete&id_in_path=$id_in_path&learnpath_id=$learnpath_id&type=Post&origin=$origin&posternom=$posternom&posterprenom=$posterprenom&posttime=$posttime&posttext=$posttext&posttitle=$posttitle#$id_in_path";
1305-
}
1306-
else
1307-
{
1308-
$link .= "../phpbb/viewtopic.php?topic=".$myrow["topic_id"]."&forum=".$myrow["forum_id"]."&md5=".$myrow["md5"];
1309-
}
1310-
*/
13111279
break;
1312-
13131280
case "Document":
13141281
$dbTable = Database::get_course_table(TABLE_DOCUMENT);
13151282
$result=Database::query("SELECT * FROM $dbTable WHERE id=$id",__FILE__,__LINE);

‎main/social/profile.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
$messageId = 0;
3939
$messageContent = $_POST['social_wall_new_msg_main'];
4040
if (!empty($_POST['url_content'])) {
41-
$messageContent = $_POST['social_wall_new_msg_main'].'<br><br>'.$_POST['url_content'];
41+
$messageContent = $_POST['social_wall_new_msg_main'].'<br /><br />'.$_POST['url_content'];
4242
}
4343
$idMessage = SocialManager::sendWallMessage(
4444
api_get_user_id(),

0 commit comments

Comments
 (0)