diff --git a/gulliver/system/class.soapNtlm.php b/gulliver/system/class.soapNtlm.php index 28ff4a933..6db6bb2a9 100644 --- a/gulliver/system/class.soapNtlm.php +++ b/gulliver/system/class.soapNtlm.php @@ -184,6 +184,9 @@ class soapNtlm */ private function createBuffer ($path) { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + $path = $filter->xssFilterHard($path, "url"); if ($this->buffer) { return; } @@ -198,6 +201,7 @@ class soapNtlm //Apply proxy settings if (class_exists( 'System' )) { $sysConf = System::getSystemConfiguration(); + $sysConf = $filter->xssFilterHard($sysConf); if ($sysConf['proxy_host'] != '') { curl_setopt( $this->ch, CURLOPT_PROXY, $sysConf['proxy_host'] . ($sysConf['proxy_port'] != '' ? ':' . $sysConf['proxy_port'] : '') ); if ($sysConf['proxy_port'] != '') { diff --git a/rbac/public_html/sysUnnamed.php b/rbac/public_html/sysUnnamed.php index 1a0f16886..4733a35b6 100755 --- a/rbac/public_html/sysUnnamed.php +++ b/rbac/public_html/sysUnnamed.php @@ -5,7 +5,9 @@ // define("URL_KEY", 'c0l0s40pt1mu59r1m3' ); // define("ENABLE_ENCRYPT", 'yes' ); - $COMPLETE_URI = $_SERVER["REQUEST_URI"]; + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + $COMPLETE_URI = $filter->xssFilterHard($_SERVER["REQUEST_URI"]); $webAddress = substr($COMPLETE_URI,1); $COMPLETE_URI = strtolower ($COMPLETE_URI) . "/mNE/qsll/n9KX1Z4/n9KX1Z6hnKTd4A"; diff --git a/workflow/engine/classes/class.Upgrade.php b/workflow/engine/classes/class.Upgrade.php index b7a06ef12..48cb8a74c 100644 --- a/workflow/engine/classes/class.Upgrade.php +++ b/workflow/engine/classes/class.Upgrade.php @@ -33,6 +33,8 @@ class Upgrade public function install() { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); //echo "Starting core installation...\n"; $start = microtime(1); $filename = $this->addon->getDownloadFilename(); @@ -42,7 +44,9 @@ class Upgrade //printf("Time to open archive: %f\n", microtime(1) - $time); $time = microtime(1); $extractDir = dirname($this->addon->getDownloadFilename()) . "/extract"; + $extractDir = $filter->xssFilterHard($extractDir); $backupDir = dirname($this->addon->getDownloadFilename()) . "/backup"; + $backupDir = $filter->xssFilterHard($backupDir); if (file_exists($extractDir)) { G::rm_dir($extractDir); } @@ -85,6 +89,7 @@ class Upgrade $checksumTime = 0; foreach ($checksums as $filename => $checksum) { if (is_dir("$extractDir/$filename")) { + $filename = $filter->xssFilterHard($filename); print $filename; continue; } diff --git a/workflow/engine/includes/inc.JSForms.php b/workflow/engine/includes/inc.JSForms.php index f4b33b5aa..e1cfd4f5a 100755 --- a/workflow/engine/includes/inc.JSForms.php +++ b/workflow/engine/includes/inc.JSForms.php @@ -23,12 +23,19 @@ * */ +G::LoadSystem('inputfilter'); +$filter = new InputFilter(); global $HTTP_SESSION_VARS; global $G_FORM; +$HTTP_SESSION_VARS = $filter->xssFilterHard($HTTP_SESSION_VARS); +$HTTP_GET_VARS = $filter->xssFilterHard($HTTP_GET_VARS); +$_GET = $filter->xssFilterHard($_GET); + $path = ''; $showFieldAjax = 'showFieldAjax.php'; $serverAjax = G::encryptLink($path.$showFieldAjax); +$serverAjax = $filter->xssFilterHard($serverAjax); ?>