fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

I reviewed the XSS - MEDIUM in last files

Browse Source
This commit is contained in:
Paula V. Quispe
2015-03-20 16:42:30 -04:00
parent dda8a2a245
commit 1825e6aed8
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
workflow/engine/methods/controls/varsAjaxByType.php
View File

@@ -35,6 +35,10 @@
*/
G::LoadClass( 'xmlfield_InputPM' );
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_POST = $filter->xssFilterHard($_POST);
$aFields = getDynaformsVars( $_POST['sProcess'], true, isset( $_POST['bIncMulSelFields'] ) ? $_POST['bIncMulSelFields'] : 0 );
$aType = $_POST['type'];

5
workflow/engine/methods/processes/processes_Import_Bpmn.php
View File

@@ -1,12 +1,17 @@
<?php
ini_set("max_execution_time", 0);
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_FILES = $filter->xssFilterHard($_FILES);
$_SESSION['USER_LOGGED'] = $filter->xssFilterHard($_SESSION['USER_LOGGED']);
if (isset($_FILES["PROCESS_FILENAME"]) &&
pathinfo($_FILES["PROCESS_FILENAME"]["name"], PATHINFO_EXTENSION) == "bpmn"
) {
try {
$createMode = $_REQUEST["createMode"];
$createMode = $filter->xssFilterHard($createMode);
$name = pathinfo($_FILES["PROCESS_FILENAME"]["name"], PATHINFO_FILENAME);
$data = array(
"type" => "bpmnProject",