From 3440e95d3fe2ddaee3b6656cdf578cb89c63383a Mon Sep 17 00:00:00 2001 From: "Paula V. Quispe" Date: Tue, 10 Mar 2015 17:06:49 -0400 Subject: [PATCH 1/5] Some changes in InputFilter class and check genericAjax --- gulliver/methods/genericAjax.php | 6 ++ gulliver/system/class.inputfilter.php | 88 ++++++++++++++++++++++----- 2 files changed, 79 insertions(+), 15 deletions(-) diff --git a/gulliver/methods/genericAjax.php b/gulliver/methods/genericAjax.php index 712797f5f..1a52c1087 100755 --- a/gulliver/methods/genericAjax.php +++ b/gulliver/methods/genericAjax.php @@ -1,4 +1,10 @@ xssFilterHard($_GET); +$_POST = $filter->xssFilterHard($_POST); +$_REQUEST = $filter->xssFilterHard($_REQUEST); +$_SESSION = $filter->xssFilterHard($_SESSION); $request = isset($_POST['request'])? $_POST['request']: null; if( !isset($request) ){ diff --git a/gulliver/system/class.inputfilter.php b/gulliver/system/class.inputfilter.php index e512d97f0..138be6c11 100644 --- a/gulliver/system/class.inputfilter.php +++ b/gulliver/system/class.inputfilter.php @@ -366,7 +366,7 @@ class InputFilter } /** - * Internal method removes tags/special characters from a string + * Internal method removes tags/special characters * @author Marcelo Cuiza * @access protected * @param Array or String $input @@ -413,8 +413,13 @@ class InputFilter if(is_array($val) && sizeof($val)) { $input[$i] = $this->xssFilterHard($val); } else { - $inputFiltered = $purifier->purify($val); - $input[$i] = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8')); + if(!empty($val)) { + $inputFiltered = $purifier->purify($val); + $inputFiltered = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8')); + } else { + $inputFiltered = ""; + } + $input[$i] = $inputFiltered; } } } @@ -429,25 +434,78 @@ class InputFilter } } + /** + * Internal method: protect against SQL injection + * @author Marcelo Cuiza + * @access protected + * @param String $con + * @param String $query + * @param Array $values + * @return String $query + */ + function preventSqlInjection($query, $values = Array(), &$con = NULL) + { + if(is_array($values) && sizeof($values)) { + foreach($values as $k1 => $val1) { + $values[$k1] = mysql_real_escape_string($val1); + } + + if ( get_magic_quotes_gpc() ) { + foreach($values as $k => $val) { + $values[$k] = stripslashes($val); + } + } + $newquery = vsprintf($query,$values); + } else { + //$newquery = mysql_real_escape_string($query); + $newquery = $this->quoteSmart($this->decode($query), $con); + } + return $newquery; + } + /** * Internal method: protect against SQL injenction * @author Marcelo Cuiza * @access protected - * @param Array or String $value - * @return Array or String $value + * @param String $value + * @param String $type + * @return String $value */ - function protectSql($value) + function validateInput($value, $type = "string") { - // Stripslashes - if ( get_magic_quotes_gpc() ) { - $value = stripslashes( $value ); + if(!isset($value) || trim($value) === '' || $value === NULL ) { + return ''; + } + + if($pos = strpos($value,";")) { + $value = substr($value,0,$pos); } - // Quote if not a number or a numeric string - if ( !is_numeric( $value ) ) - { - $value = "'" . mysql_real_escape_string($value) . "'"; + + switch($type) { + case 'float': + $value = (float)filter_var($value, FILTER_SANITIZE_NUMBER_FLOAT); + break; + case 'int': + $value = (int)filter_var($value, FILTER_SANITIZE_NUMBER_INT); + break; + case 'boolean': + $value = (boolean)filter_var($value, FILTER_VALIDATE_BOOLEAN,FILTER_NULL_ON_FAILURE); + break; + case 'path': + if(!file_exists($value)) { + $value = ''; + } + break; + case 'noSql': + $value = (string)filter_var($value, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH); + if(preg_match('/\b(or|and|xor|drop|insert|update|delete|select)\b/i' , $value)) { + $value = ''; + } + break; + default: + $value = (string)filter_var($value, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH); } + return $value; } -} - +} \ No newline at end of file From e7849a434f68e56dfa554ac6bf30cf5f24e07089 Mon Sep 17 00:00:00 2001 From: Victor Saisa Lopez Date: Wed, 11 Mar 2015 08:56:10 -0400 Subject: [PATCH 2/5] PM-1788 "Designer > Designer Classic > Report Tables: El report..." SOLVED MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue: Designer > Designer Classic > Report Tables: El report table perteneciente a un proceso no se visualiza en la opcion "Report Tables" en el diseñr Cause: En PHP-5.4 se incorpora de manera predefinida la constante E_STRICT, siendo este la causa para los "Warnings PHP Strict Standards" Solution: Se ha corregido codigo para respetar el "PHP Strict Standards" Note: - Los procesos adjuntos "sys-wsqa_2014-01-23_0759.pmt" y "Test_Report_Table_Grid1 %281%29.pm" no tienen el mismo PRO_UID, osea no tienen ninguna relacion - Se pide crear un nuevo proceso y report table para el testeo --- workflow/engine/classes/class.pmTable.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/workflow/engine/classes/class.pmTable.php b/workflow/engine/classes/class.pmTable.php index 005a7a3ac..01ffda4c3 100755 --- a/workflow/engine/classes/class.pmTable.php +++ b/workflow/engine/classes/class.pmTable.php @@ -135,7 +135,7 @@ class PmTable * @param string $dbsUid corresponding to DBS_UID key * @return string contains resolved DBS_UID */ - public function resolveDbSource ($dbsUid) + public static function resolveDbSource($dbsUid) { switch ($dbsUid) { case 'workflow': From 14c2edaaed80701cfa5f6bf3482cd575b4ab8b81 Mon Sep 17 00:00:00 2001 From: "Paula V. Quispe" Date: Wed, 11 Mar 2015 12:07:16 -0400 Subject: [PATCH 3/5] I corrected some files --- gulliver/methods/genericAjax.php | 8 ++--- gulliver/system/class.inputfilter.php | 31 ++++++++++++++----- rbac/engine/templates/login/showDBFiles.php | 5 ++- .../engine/templates/login/showDBFiles.php | 5 ++- 4 files changed, 36 insertions(+), 13 deletions(-) diff --git a/gulliver/methods/genericAjax.php b/gulliver/methods/genericAjax.php index 1a52c1087..f0f53b9f1 100755 --- a/gulliver/methods/genericAjax.php +++ b/gulliver/methods/genericAjax.php @@ -1,10 +1,10 @@ xssFilterHard($_GET); -$_POST = $filter->xssFilterHard($_POST); -$_REQUEST = $filter->xssFilterHard($_REQUEST); -$_SESSION = $filter->xssFilterHard($_SESSION); +$_GET = $filter->xssFilterHard($_GET,"url"); +$_POST = $filter->xssFilterHard($_POST,"url"); +$_REQUEST = $filter->xssFilterHard($_REQUEST,"url"); +$_SESSION = $filter->xssFilterHard($_SESSION,"url"); $request = isset($_POST['request'])? $_POST['request']: null; if( !isset($request) ){ diff --git a/gulliver/system/class.inputfilter.php b/gulliver/system/class.inputfilter.php index 138be6c11..92abbad53 100644 --- a/gulliver/system/class.inputfilter.php +++ b/gulliver/system/class.inputfilter.php @@ -372,7 +372,7 @@ class InputFilter * @param Array or String $input * @return Array or String $input */ - public function xssFilter($input) + public function xssFilter($input, $type = "") { if(is_array($input)) { if(sizeof($input)) { @@ -380,7 +380,16 @@ class InputFilter if(is_array($val) && sizeof($val)) { $input[$i] = $this->xssFilter($val); } else { - $input[$i] = addslashes(htmlspecialchars(filter_var($val, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8')); + if(!empty($val)) { + if($type != "url") { + $inputFiltered = addslashes(htmlspecialchars(filter_var($val, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8')); + } else { + $inputFiltered = filter_var($val, FILTER_SANITIZE_STRING); + } + } else { + $inputFiltered = ""; + } + $input[$i] = $inputFiltered; } } } @@ -389,7 +398,11 @@ class InputFilter if(!isset($input) || trim($input) === '' || $input === NULL ) { return ''; } else { - return addslashes(htmlspecialchars(filter_var($input, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8')); + if($type != "url") { + return addslashes(htmlspecialchars(filter_var($input, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8')); + } else { + return filter_var($input, FILTER_SANITIZE_STRING); + } } } } @@ -401,10 +414,9 @@ class InputFilter * @param Array or String $input * @return Array or String $input */ - function xssFilterHard($input) + function xssFilterHard($input, $type = "") { require_once (PATH_THIRDPARTY . 'HTMLPurifier/HTMLPurifier.auto.php'); - //G::LoadThirdParty ('HTMLPurifier', 'HTMLPurifier.auto.php'); $config = HTMLPurifier_Config::createDefault(); $purifier = new HTMLPurifier($config); if(is_array($input)) { @@ -415,7 +427,9 @@ class InputFilter } else { if(!empty($val)) { $inputFiltered = $purifier->purify($val); - $inputFiltered = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8')); + if($type != "url") { + $inputFiltered = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8')); + } } else { $inputFiltered = ""; } @@ -429,7 +443,10 @@ class InputFilter return ''; } else { $input = $purifier->purify($input); - return addslashes(htmlspecialchars($input, ENT_COMPAT, 'UTF-8')); + if($type != "url") { + $input = addslashes(htmlspecialchars($input, ENT_COMPAT, 'UTF-8')); + } + return $input; } } } diff --git a/rbac/engine/templates/login/showDBFiles.php b/rbac/engine/templates/login/showDBFiles.php index 31682bdd9..89cab1860 100755 --- a/rbac/engine/templates/login/showDBFiles.php +++ b/rbac/engine/templates/login/showDBFiles.php @@ -30,11 +30,14 @@ die; } - + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + echo ""; echo ""; echo ""; $curPage = getenv( "REQUEST_URI" ); + $curPage = $filter->xssFilterHard($curPage,"url"); //running the while loop $first = 0; while ($file = readdir($dir_handle)) diff --git a/workflow/engine/templates/login/showDBFiles.php b/workflow/engine/templates/login/showDBFiles.php index 31682bdd9..89cab1860 100755 --- a/workflow/engine/templates/login/showDBFiles.php +++ b/workflow/engine/templates/login/showDBFiles.php @@ -30,11 +30,14 @@ die; } - + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + echo "
Please select a valid workspace to continue
"; echo ""; echo ""; $curPage = getenv( "REQUEST_URI" ); + $curPage = $filter->xssFilterHard($curPage,"url"); //running the while loop $first = 0; while ($file = readdir($dir_handle)) From 5360d31102f80d18dca72682dd3c4928b8466cde Mon Sep 17 00:00:00 2001 From: "Paula V. Quispe" Date: Wed, 11 Mar 2015 17:51:50 -0400 Subject: [PATCH 4/5] I corrected problems --- gulliver/system/class.inputfilter.php | 21 ++++++++++++------- gulliver/system/class.webResource.php | 14 ++++++++++++- .../engine/classes/model/AdditionalTables.php | 14 ++++++++----- 3 files changed, 35 insertions(+), 14 deletions(-) diff --git a/gulliver/system/class.inputfilter.php b/gulliver/system/class.inputfilter.php index 92abbad53..30f5d0de1 100644 --- a/gulliver/system/class.inputfilter.php +++ b/gulliver/system/class.inputfilter.php @@ -381,7 +381,7 @@ class InputFilter $input[$i] = $this->xssFilter($val); } else { if(!empty($val)) { - if($type != "url") { + if($type != "url" && !strpos(basename($val), "=")) { $inputFiltered = addslashes(htmlspecialchars(filter_var($val, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8')); } else { $inputFiltered = filter_var($val, FILTER_SANITIZE_STRING); @@ -423,12 +423,15 @@ class InputFilter if(sizeof($input)) { foreach($input as $i => $val) { if(is_array($val) && sizeof($val)) { - $input[$i] = $this->xssFilterHard($val); + $input[$i] = $this->xssFilterHard($val,$type); } else { if(!empty($val)) { $inputFiltered = $purifier->purify($val); - if($type != "url") { - $inputFiltered = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8')); + $pos = strpos($inputFiltered, "="); + if($type != "url" && $pos === false) { + $inputFiltered = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8')); + } else { + $inputFiltered = str_replace('&','&',$inputFiltered); } } else { $inputFiltered = ""; @@ -438,13 +441,16 @@ class InputFilter } } return $input; - } else { + } else { if(!isset($input) || trim($input) === '' || $input === NULL ) { return ''; } else { $input = $purifier->purify($input); - if($type != "url") { + $pos = strpos(basename($input), "="); + if($type != "url" && $pos === false) { $input = addslashes(htmlspecialchars($input, ENT_COMPAT, 'UTF-8')); + } else { + $input = str_replace('&','&',$input); } return $input; } @@ -521,8 +527,7 @@ class InputFilter break; default: $value = (string)filter_var($value, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH); - } - + } return $value; } } \ No newline at end of file diff --git a/gulliver/system/class.webResource.php b/gulliver/system/class.webResource.php index 021d00ba9..973fc4afb 100755 --- a/gulliver/system/class.webResource.php +++ b/gulliver/system/class.webResource.php @@ -66,7 +66,14 @@ class WebResource $paramsRef[] = '$parameters[' . $key . ']'; } } - $res = eval( 'return ($this->' . $post['function'] . '(' . implode( ',', $paramsRef ) . '));' ); + + $paramsRef = implode( ',', $paramsRef ); + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + $post['function'] = $filter->validateInput($post['function']); + $paramsRef = $filter->validateInput($paramsRef); + + $res = eval( 'return ($this->' . $post['function'] . '(' . $paramsRef . '));' ); $res = G::json_encode( $res ); print ($res) ; } else { @@ -82,13 +89,18 @@ class WebResource */ function _encode () { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); header( 'Content-Type: text/json' ); $methods = get_class_methods( get_class( $this ) ); + $methods = $filter->xssFilterHard($methods); + $this->_uri = $filter->xssFilterHard($this->_uri); print ('{') ; $first = true; foreach ($methods as $method) { //To avoid PHP version incompatibilities, put the $method name in lowercase $method = strtolower( $method ); + $method = $filter->xssFilterHard($method); if ((substr( $method, 0, 1 ) === '_') || (strcasecmp( $method, 'WebResource' ) == 0) || (strcasecmp( $method, get_class( $this ) ) == 0)) { } elseif (strcasecmp( substr( $method, 0, 3 ), 'js_' ) == 0) { if (! $first) { diff --git a/workflow/engine/classes/model/AdditionalTables.php b/workflow/engine/classes/model/AdditionalTables.php index f443d72e5..9c52cc061 100755 --- a/workflow/engine/classes/model/AdditionalTables.php +++ b/workflow/engine/classes/model/AdditionalTables.php @@ -1,4 +1,4 @@ -validateInput($_POST['sort']); + $sClassPeerName = $filter->validateInput($sClassPeerName); if (isset($_POST['sort'])) { if ($_POST['dir'] == 'ASC') { if ($keyOrderUppercase) { - eval('$oCriteria->addAscendingOrderByColumn("' . $_POST['sort'] . '");'); + eval('$oCriteria->addAscendingOrderByColumn("' . $sort . '");'); } else { - eval('$oCriteria->addAscendingOrderByColumn(' . $sClassPeerName . '::' . $_POST['sort'] . ');'); + eval('$oCriteria->addAscendingOrderByColumn(' . $sClassPeerName . '::' . $sort . ');'); } } else { if ($keyOrderUppercase) { - eval('$oCriteria->addDescendingOrderByColumn("' . $_POST['sort'] . '");'); + eval('$oCriteria->addDescendingOrderByColumn("' . $sort . '");'); } else { - eval('$oCriteria->addDescendingOrderByColumn(' . $sClassPeerName . '::' . $_POST['sort'] . ');'); + eval('$oCriteria->addDescendingOrderByColumn(' . $sClassPeerName . '::' . $sort . ');'); } } } From 8d379a2a58453590a1991cabdfb1cb98dc42d4b1 Mon Sep 17 00:00:00 2001 From: "Paula V. Quispe" Date: Thu, 12 Mar 2015 10:27:10 -0400 Subject: [PATCH 5/5] I completed the very hight issues --- workflow/engine/methods/services/soap.php | 12 ++++++++++++ workflow/engine/methods/services/soap2.php | 4 ++++ 2 files changed, 16 insertions(+) diff --git a/workflow/engine/methods/services/soap.php b/workflow/engine/methods/services/soap.php index c0e0f4ec4..d96866ed2 100755 --- a/workflow/engine/methods/services/soap.php +++ b/workflow/engine/methods/services/soap.php @@ -154,6 +154,8 @@ function getCaseInfo ($params) function SendVariables ($params) { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); ifSessionExpiredBreakThis( $params->sessionId ); $x = ifPermission( $params->sessionId, 'PM_CASES' ); if ($x == 0) { @@ -172,6 +174,8 @@ function SendVariables ($params) foreach ($variables as $key => $val) { $name = $val->name; $value = $val->value; + $val->name = $filter->validateInput($val->name); + $val->value = $filter->validateInput($val->value); eval( '$Fields[ ' . $val->name . ' ]= $val->value ;' ); } } @@ -241,6 +245,8 @@ function executeTrigger ($params) function NewCaseImpersonate ($params) { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); ifSessionExpiredBreakThis( $params->sessionId ); $x = ifPermission( $params->sessionId, 'PM_CASES' ); if ($x == 0) { @@ -254,6 +260,8 @@ function NewCaseImpersonate ($params) foreach ($variables as $key => $val) { $name = $val->name; $value = $val->value; + $val->name = $filter->validateInput($val->name); + $val->value = $filter->validateInput($val->value); eval( '$Fields[ ' . $val->name . ' ]= $val->value ;' ); } $params->variables = $Fields; @@ -265,6 +273,8 @@ function NewCase ($params) { G::LoadClass( 'wsBase' ); G::LoadClass( 'sessions' ); + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); ifSessionExpiredBreakThis( $params->sessionId ); $x = ifPermission( $params->sessionId, 'PM_CASES' ); if ($x == 0) { @@ -296,6 +306,8 @@ function NewCase ($params) $name = $val->name; $value = $val->value; if (! is_object( $val->value )) { + $val->name = $filter->validateInput($val->name); + $val->value = $filter->validateInput($val->value); eval( '$Fields[ ' . $val->name . ' ]= $val->value ;' ); } else { if (is_array( $val->value->item )) { diff --git a/workflow/engine/methods/services/soap2.php b/workflow/engine/methods/services/soap2.php index aa5d8cda4..982f97f5f 100755 --- a/workflow/engine/methods/services/soap2.php +++ b/workflow/engine/methods/services/soap2.php @@ -689,6 +689,8 @@ function NewCaseImpersonate ($params) function NewCase ($params) { G::LoadClass( "sessions" ); + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); $vsResult = isValidSession( $params->sessionId ); @@ -757,6 +759,8 @@ function NewCase ($params) if (is_array( $variables )) { foreach ($variables as $key => $val) { if (! is_object( $val->value )) { + $val->name = $filter->validateInput($val->name); + $val->value = $filter->validateInput($val->value); eval( "\$field[" . $val->name . "]= \$val->value;" ); } }
Please select a valid workspace to continue