fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merged in mcuiza/processmaker/xss-3 (pull request #1708)

Browse Source 
xss 3
This commit is contained in:
Julio Cesar Laura Avendaño
2015-03-19 00:23:13 -04:00
parent 363ebedf2e 5f059f2fce
commit 367e69b69b
7 changed files with 85 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
workflow/engine/methods/setup/emails_Ajax.php
View File

@@ -21,6 +21,13 @@
* For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*/
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_POST = $filter->xssFilterHard($_POST);
if(isset($_SERVER['SERVER_NAME'])) {
$_SERVER['SERVER_NAME'] = $filter->xssFilterHard($_SERVER['SERVER_NAME']);
}
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP_ADVANCE' );

25
workflow/engine/methods/setup/language_Ajax.php
View File

@@ -23,11 +23,16 @@
*/
try {
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_POST = $filter->xssFilterHard($_POST);
G::LoadInclude( 'ajax' );
if (isset( $_POST['form'] )) {
$_POST = $_POST['form'];
}
$_POST['function'] = get_ajax_value( 'function' );
$_POST['function'] = $filter->xssFilterHard($_POST['function']);
switch ($_POST['function']) {
case 'savePredetermined':
require_once "classes/model/Translation.php";
@@ -155,16 +160,16 @@ try {
if($locale != "en"){ //Default Lengage 'en'
if($locale != SYS_LANG){ //Current lenguage
//THERE IS NO ANY CASE STARTED FROM THES LANGUAGE
if ($aRow[0] == 0) { //so we can delete this language
try {
Content::removeLanguageContent( $locale );
$trn->removeTranslationEnvironment( $locale );
echo G::LoadTranslation( 'ID_LANGUAGE_DELETED_SUCCESSFULLY' );
} catch (Exception $e) {
echo $e->getMessage();
}
} else {
echo str_replace( '{0}', $aRow[0], G::LoadTranslation( 'ID_LANGUAGE_CANT_DELETE' ) );
if ($aRow[0] == 0) { //so we can delete this language
try {
Content::removeLanguageContent( $locale );
$trn->removeTranslationEnvironment( $locale );
echo G::LoadTranslation( 'ID_LANGUAGE_DELETED_SUCCESSFULLY' );
} catch (Exception $e) {
echo $e->getMessage();
}
} else {
echo str_replace( '{0}', $aRow[0], G::LoadTranslation( 'ID_LANGUAGE_CANT_DELETE' ) );
}
} else {
echo str_replace( '{0}', $aRow[0], G::LoadTranslation( 'ID_LANGUAGE_CANT_DELETE_CURRENTLY' ) );

8
workflow/engine/methods/setup/webServicesAjax.php
View File

@@ -23,6 +23,10 @@
*/
ini_set( "soap.wsdl_cache_enabled", "0" ); // enabling WSDL cache
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_GET = $filter->xssFilterHard($_GET);
//$_SESSION = $filter->xssFilterHard($_SESSION);
G::LoadClass( 'ArrayPeer' );
if ($RBAC->userCanAccess( 'PM_SETUP' ) != 1 && $RBAC->userCanAccess( 'PM_FACTORY' ) != 1) {
@@ -38,6 +42,8 @@ if ($_POST['action'] == '') {
$_POST['action'] = (isset( $_GET['action'] )) ? $_GET['action'] : '';
}
$_POST = $filter->xssFilterHard($_POST);
switch ($_POST['action']) {
case 'showForm':
global $G_PUBLISH;
@@ -1504,7 +1510,7 @@ try {
die();
break;
default:
$_POST = $filter->xssFilterHard($_POST);
print_r( $_POST );
}
}