From 135211ed716af227527e02453d8af4acf61f8514 Mon Sep 17 00:00:00 2001 From: "Paula V. Quispe" Date: Tue, 21 Apr 2015 09:35:39 -0400 Subject: [PATCH] I solved some issues Cross-Site Scripting [April 18] --- gulliver/system/class.g.php | 3 +++ .../thirdparty/pear/PEAR/Frontend/CLI.php | 19 +++++++++++++++++++ .../pear/SOAP/Interop/interop_client_run.php | 13 +++++++++++-- .../methods/cases/cases_StepToRevise.php | 2 +- .../cases/cases_StepToReviseInputs.php | 2 +- .../cases/cases_StepToReviseOutputs.php | 2 +- .../cases/cases_ToReviseOutputDocView.php | 2 +- .../dynaforms/dynaforms_FlatEditor.php | 12 ++++++------ 8 files changed, 43 insertions(+), 12 deletions(-) diff --git a/gulliver/system/class.g.php b/gulliver/system/class.g.php index 846fbd558..b6298dab2 100755 --- a/gulliver/system/class.g.php +++ b/gulliver/system/class.g.php @@ -3133,6 +3133,9 @@ class G */ public function evalJScript ($c) { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + $c = $filter->xssFilterHard($c); print ("") ; } diff --git a/gulliver/thirdparty/pear/PEAR/Frontend/CLI.php b/gulliver/thirdparty/pear/PEAR/Frontend/CLI.php index 55ee979eb..67c15b9ea 100755 --- a/gulliver/thirdparty/pear/PEAR/Frontend/CLI.php +++ b/gulliver/thirdparty/pear/PEAR/Frontend/CLI.php @@ -72,6 +72,15 @@ class PEAR_Frontend_CLI extends PEAR function _displayLine($text) { + $realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] ); + $docuroot = explode( '/', $realdocuroot ); + array_pop( $docuroot ); + $pathhome = implode( '/', $docuroot ) . '/'; + array_pop( $docuroot ); + $pathTrunk = implode( '/', $docuroot ) . '/'; + require_once($pathTrunk.'gulliver/system/class.inputfilter.php'); + $filter = new InputFilter(); + $text = $filter->xssFilterHard($text); print "$this->lp$text\n"; } @@ -124,15 +133,25 @@ class PEAR_Frontend_CLI extends PEAR function userDialog($command, $prompts, $types = array(), $defaults = array()) { + $realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] ); + $docuroot = explode( '/', $realdocuroot ); + array_pop( $docuroot ); + $pathhome = implode( '/', $docuroot ) . '/'; + array_pop( $docuroot ); + $pathTrunk = implode( '/', $docuroot ) . '/'; + require_once($pathTrunk.'gulliver/system/class.inputfilter.php'); + $filter = new InputFilter(); $result = array(); if (is_array($prompts)) { $fp = fopen("php://stdin", "r"); foreach ($prompts as $key => $prompt) { $type = $types[$key]; $default = @$defaults[$key]; + $default = $filter->xssFilterHard($default); if ($type == 'password') { system('stty -echo'); } + $prompt = $filter->xssFilterHard($prompt); print "$this->lp$prompt "; if ($default) { print "[$default] "; diff --git a/gulliver/thirdparty/pear/SOAP/Interop/interop_client_run.php b/gulliver/thirdparty/pear/SOAP/Interop/interop_client_run.php index c77eb78f1..70f98dddb 100755 --- a/gulliver/thirdparty/pear/SOAP/Interop/interop_client_run.php +++ b/gulliver/thirdparty/pear/SOAP/Interop/interop_client_run.php @@ -82,10 +82,19 @@ function print_test_names() function print_endpoint_names() { global $iop; + $realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] ); + $docuroot = explode( '/', $realdocuroot ); + array_pop( $docuroot ); + $pathhome = implode( '/', $docuroot ) . '/'; + array_pop( $docuroot ); + $pathTrunk = implode( '/', $docuroot ) . '/'; + require_once($pathTrunk.'gulliver/system/class.inputfilter.php'); + $filter = new InputFilter(); + $currTest = $filter->xssFilterHard($iop->currentTest); if (!$iop->getEndpoints($iop->currentTest)) { - die("Unable to retrieve endpoints for $iop->currentTest\n"); + die("Unable to retrieve endpoints for $currTest\n"); } - print "Interop Servers for $iop->currentTest:\n"; + print "Interop Servers for $currTestt:\n"; foreach ($iop->endpoints as $server) { print " $server->name\n"; } diff --git a/workflow/engine/methods/cases/cases_StepToRevise.php b/workflow/engine/methods/cases/cases_StepToRevise.php index d693fae4c..dbf7e5f88 100755 --- a/workflow/engine/methods/cases/cases_StepToRevise.php +++ b/workflow/engine/methods/cases/cases_StepToRevise.php @@ -138,7 +138,7 @@ if (! isset( $_GET['ex'] )) { // DEPRECATED this JS section is marked for removal function setSelect() { - var ex=; + var ex=xssFilterHard($_GET['ex'])?>; try { for(i=1; i<50; i++) { if (i == ex) { diff --git a/workflow/engine/methods/cases/cases_StepToReviseInputs.php b/workflow/engine/methods/cases/cases_StepToReviseInputs.php index b4999f81e..07d45ca39 100755 --- a/workflow/engine/methods/cases/cases_StepToReviseInputs.php +++ b/workflow/engine/methods/cases/cases_StepToReviseInputs.php @@ -140,7 +140,7 @@ G::RenderPage( 'publish', 'blank' ); //Deprecated Section since the interface are now movig to ExtJS function setSelect() { - var ex=; + var ex=xssFilterHard($_GET['ex'])?>; try { for (i=1; i<50; i++) { if (i == ex) { diff --git a/workflow/engine/methods/cases/cases_StepToReviseOutputs.php b/workflow/engine/methods/cases/cases_StepToReviseOutputs.php index 976b75dc5..1a78eaf4f 100755 --- a/workflow/engine/methods/cases/cases_StepToReviseOutputs.php +++ b/workflow/engine/methods/cases/cases_StepToReviseOutputs.php @@ -84,7 +84,7 @@ if (! isset( $_GET['ex'] )) { //Deprecated Section since the interface are now movig to ExtJS function setSelect() { - var ex=; + var ex=xssFilterHard($_GET['ex'])?>; try{ for (i=1; i<50; i++) { if (i == ex) { diff --git a/workflow/engine/methods/cases/cases_ToReviseOutputDocView.php b/workflow/engine/methods/cases/cases_ToReviseOutputDocView.php index 351d778d9..b978b21e0 100755 --- a/workflow/engine/methods/cases/cases_ToReviseOutputDocView.php +++ b/workflow/engine/methods/cases/cases_ToReviseOutputDocView.php @@ -104,7 +104,7 @@ if (! isset( $_GET['ex'] )) { /*------------------------------ To Revise Routines ---------------------------*/ function setSelect() { - var ex=; + var ex=xssFilterHard($_GET['ex'])?>; try{ for(i=1; i<50; i++) { diff --git a/workflow/engine/methods/dynaforms/dynaforms_FlatEditor.php b/workflow/engine/methods/dynaforms/dynaforms_FlatEditor.php index 0014b64f9..b615b5005 100755 --- a/workflow/engine/methods/dynaforms/dynaforms_FlatEditor.php +++ b/workflow/engine/methods/dynaforms/dynaforms_FlatEditor.php @@ -170,12 +170,12 @@ G::RenderPage( "publish", "raw" );