From 177a85512e87f2776807e90dfe8b70405fa43509 Mon Sep 17 00:00:00 2001
From: "marcelo.cuiza" <marcelo.cuiza@colosa.com>
Date: Tue, 17 Mar 2015 17:09:30 -0400
Subject: [PATCH] xss 2

---
 workflow/engine/classes/class.processMap.php  |  4 ++++
 workflow/engine/classes/class.propelTable.php | 19 ++++++++++++++++++-
 .../engine/methods/cases/casesList_Ajax.php   |  6 ++++++
 workflow/engine/methods/setup/skin_Ajax.php   | 10 +++++++++-
 .../engine/methods/tracker/tracker_Ajax.php   |  4 ++++
 workflow/engine/methods/users/usersAjax.php   |  9 +++++++++
 workflow/engine/methods/users/users_Ajax.php  |  6 ++++++
 7 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/workflow/engine/classes/class.processMap.php b/workflow/engine/classes/class.processMap.php
index 233e6a933..f3678406e 100755
--- a/workflow/engine/classes/class.processMap.php
+++ b/workflow/engine/classes/class.processMap.php
@@ -2356,7 +2356,11 @@ class processMap
               $G_PUBLISH->AddContent('propeltable', 'paged-table', '/cases/cases_Scheduler_List', $oCriteria, array('CONFIRM' => G::LoadTranslation('ID_MSG_CONFIRM_DELETE_CASE_SCHEDULER')));
               G::RenderPage('publish');
               //return true; */
+            G::LoadSystem('inputfilter');
+            $filter = new InputFilter();
             $schedulerPath = SYS_URI . "cases/cases_Scheduler_List";
+            $schedulerPath = $filter->xssFilterHard($schedulerPath);
+            $sProcessUID = $filter->xssFilterHard($sProcessUID);
             $html = "<iframe  WIDTH=820 HEIGHT=530 FRAMEBORDER=0 src='" . $schedulerPath . '?PRO_UID=' . $sProcessUID . "'></iframe>";
             echo $html;
         } catch (Exception $oError) {
diff --git a/workflow/engine/classes/class.propelTable.php b/workflow/engine/classes/class.propelTable.php
index a412e5bac..afdf59f4b 100755
--- a/workflow/engine/classes/class.propelTable.php
+++ b/workflow/engine/classes/class.propelTable.php
@@ -559,7 +559,13 @@ class propelTable
      * @return string
      */
     public function renderTable ($block = '', $fields = '')
-    {
+    { 
+        G::LoadSystem('inputfilter');
+        $filter = new InputFilter();
+        $fields = $filter->xssFilterHard($fields);
+        $this->orderBy = $filter->xssFilterHard($this->orderBy);
+        $this->currentPage = $filter->xssFilterHard($this->currentPage);
+        
         //Render Title
         $thereisnotitle = true;
         foreach ($this->fields as $r => $rval) {
@@ -603,6 +609,11 @@ class propelTable
             $this->tpl->assign( 'pagedTable_Name', $this->name );
             $this->tpl->assign( 'pagedTable_Height', $this->xmlForm->height );
             $this->tpl->assign( "title", $this->title );
+            
+            $this->xmlForm->home = $filter->xssFilterHard($this->xmlForm->home);
+            $this->filterForm = $filter->xssFilterHard($this->filterForm);
+            $this->menu = $filter->xssFilterHard($this->menu);
+            
             if (file_exists( $this->xmlForm->home . $this->filterForm . '.xml' )) {
                 $filterForm = new filterForm( $this->filterForm, $this->xmlForm->home );
                 if ($this->menu === '') {
@@ -839,6 +850,12 @@ class propelTable
                 }
                 $this->tpl->assign( "pagesEnum", $pagesEnum );
             }
+            
+            $this->name = $filter->xssFilterHard($this->name);
+            $this->orderBy = $filter->xssFilterHard($this->orderBy);
+            $this->currentPage = $filter->xssFilterHard($this->currentPage);
+            $this->id = $filter->xssFilterHard($this->id);
+            
             ?>
 
             <script language='JavaScript'>
diff --git a/workflow/engine/methods/cases/casesList_Ajax.php b/workflow/engine/methods/cases/casesList_Ajax.php
index 8a4b48504..cac07617c 100755
--- a/workflow/engine/methods/cases/casesList_Ajax.php
+++ b/workflow/engine/methods/cases/casesList_Ajax.php
@@ -40,6 +40,12 @@ require_once ("classes/model/AdditionalTables.php");
 require_once ("classes/model/AppDelay.php");*/
 G::LoadClass( 'case' );
 
+G::LoadSystem('inputfilter');
+$filter = new InputFilter();
+$_POST = $filter->xssFilterHard($_POST);
+$_REQUEST = $filter->xssFilterHard($_REQUEST);
+$_SESSION = $filter->xssFilterHard($_SESSION); 
+
 $actionAjax = isset( $_REQUEST['actionAjax'] ) ? $_REQUEST['actionAjax'] : null;
 
 function filterUserListArray($users = array(), $filter = '')
diff --git a/workflow/engine/methods/setup/skin_Ajax.php b/workflow/engine/methods/setup/skin_Ajax.php
index 68915e73a..8339d0528 100755
--- a/workflow/engine/methods/setup/skin_Ajax.php
+++ b/workflow/engine/methods/setup/skin_Ajax.php
@@ -1,4 +1,8 @@
 <?php
+G::LoadSystem('inputfilter');
+$filter = new InputFilter();
+$_REQUEST = $filter->xssFilterHard($_REQUEST);
+
 if (! isset( $_REQUEST['action'] )) {
     $res['success'] = false;
     $res['error'] = $res['message'] = G::LoadTranslation('ID_REQUEST_ACTION');
@@ -162,7 +166,7 @@ function newSkin ($baseSkin = 'classic')
         $configFileFinal = PATH_CUSTOM_SKINS . $skinFolder . PATH_SEP . 'config.xml';
 
         $xmlConfiguration = file_get_contents( $configFileOriginal );
-
+        
         $workspace = ($_REQUEST['workspace'] == 'global') ? '' : SYS_SYS;
 
         $xmlConfigurationObj = G::xmlParser($xmlConfiguration);
@@ -360,6 +364,10 @@ function exportSkin ($skinToExport = "")
 function deleteSkin ()
 {
     try {
+        G::LoadSystem('inputfilter');
+        $filter = new InputFilter();
+        $_REQUEST['SKIN_FOLDER_ID'] = $filter->xssFilterHard($_REQUEST['SKIN_FOLDER_ID']);
+    
         if (! (isset( $_REQUEST['SKIN_FOLDER_ID'] ))) {
             throw (new Exception( G::LoadTranslation( 'ID_SKIN_FOLDER_REQUIRED' ) ));
         }
diff --git a/workflow/engine/methods/tracker/tracker_Ajax.php b/workflow/engine/methods/tracker/tracker_Ajax.php
index 1c574c3ba..9029a3858 100755
--- a/workflow/engine/methods/tracker/tracker_Ajax.php
+++ b/workflow/engine/methods/tracker/tracker_Ajax.php
@@ -22,6 +22,10 @@
  * Coral Gables, FL, 33134, USA, or email info@colosa.com.
  */
 try {
+    G::LoadSystem('inputfilter');
+    $filter = new InputFilter();
+    $_POST = $filter->xssFilterHard($_POST);
+    
     if (isset( $_POST['form']['action'] )) {
         $_POST['action'] = $_POST['form']['action'];
     }
diff --git a/workflow/engine/methods/users/usersAjax.php b/workflow/engine/methods/users/usersAjax.php
index 0feb3c8db..e5be876a3 100755
--- a/workflow/engine/methods/users/usersAjax.php
+++ b/workflow/engine/methods/users/usersAjax.php
@@ -1,4 +1,13 @@
 <?php
+G::LoadSystem('inputfilter');
+$filter = new InputFilter();
+$_POST = $filter->xssFilterHard($_POST);
+if(isset($_SESSION['USER_LOGGED'])) { 
+    $_SESSION['USER_LOGGED'] = $filter->xssFilterHard($_SESSION['USER_LOGGED']); 
+}
+if(isset($_SESSION['USR_USERNAME'])) { 
+$_SESSION['USR_USERNAME'] = $filter->xssFilterHard($_SESSION['USR_USERNAME']);
+}
 
 global $RBAC;
 $result = new StdClass();
diff --git a/workflow/engine/methods/users/users_Ajax.php b/workflow/engine/methods/users/users_Ajax.php
index 649d72a65..0d6c4b22e 100644
--- a/workflow/engine/methods/users/users_Ajax.php
+++ b/workflow/engine/methods/users/users_Ajax.php
@@ -23,6 +23,12 @@
  * Coral Gables, FL, 33134, USA, or email info@colosa.com.
  */
 try {
+    G::LoadSystem('inputfilter');
+    $filter = new InputFilter();
+    $_GET = $filter->xssFilterHard($_GET);
+    $_POST = $filter->xssFilterHard($_POST);
+    $_REQUEST = $filter->xssFilterHard($_REQUEST);
+    
     global $RBAC;
     switch ($RBAC->userCanAccess('PM_LOGIN')) {
         case - 2: