fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

I reviewed the XSS - MEDIUM in 7 files

Browse Source
This commit is contained in:
Paula V. Quispe
2015-03-16 15:24:35 -04:00
parent 73995ac40b
commit 4bc49c7568
7 changed files with 48 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
workflow/engine/methods/appFolder/appFolderAjax.php
View File

@@ -1,4 +1,9 @@
<?php
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_POST = $filter->xssFilterHard($_POST);
$_GET = $filter->xssFilterHard($_GET);
$_REQUEST = $filter->xssFilterHard($_REQUEST);
if (! isset ($_SESSION ['USER_LOGGED'])) {
$res ['success'] = false;
$res ['error'] = G::LoadTranslation('ID_LOGIN_AGAIN');

5
workflow/engine/methods/setup/appCacheViewAjax.php
View File

@@ -1,6 +1,9 @@
<?php
require_once ('classes/model/AppCacheView.php');
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_POST = $filter->xssFilterHard($_POST);
$_GET = $filter->xssFilterHard($_GET);
$request = isset( $_POST['request'] ) ? $_POST['request'] : (isset( $_GET['request'] ) ? $_GET['request'] : null);
function testConnection($type, $server, $user, $passwd, $port = 'none', $dbName = "")

4
workflow/engine/templates/appFolder/appFolderTree.php
View File

@@ -56,7 +56,9 @@ $html = '
}
return 'Unknown';
}
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_SERVER['HTTP_USER_AGENT'] = $filter->xssFilterHard($_SERVER['HTTP_USER_AGENT']);
if((looking_for_browser($_SERVER['HTTP_USER_AGENT'])=='Internet Explorer 8')||(looking_for_browser($_SERVER['HTTP_USER_AGENT'])=='Internet Explorer 7')||(looking_for_browser($_SERVER['HTTP_USER_AGENT'])=='Internet Explorer 6')){
$html.="
<div class='content' style='width:360px;height: expression( this.scrollHeight > 319 ? \'320px\' : \'auto\' ); /* sets max-height for IE */ max-height: 320px; /* sets max-height value for all standards-compliant browsers */ overflow:hidden;'>

7
workflow/engine/templates/oauth2/authorize.php
View File

@@ -1,6 +1,9 @@
<?php
require_once PATH_CORE . 'src/ProcessMaker/Services/OAuth2/PmPdo.php';
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_GET = $filter->xssFilterHard($_GET,"url");
$_SERVER["QUERY_STRING"] = $filter->xssFilterHard($_SERVER["QUERY_STRING"],"url");
list($host, $port) = strpos(DB_HOST, ':') !== false ? explode(':', DB_HOST) : array(DB_HOST, '');
$port = empty($port) ? '' : ";port=$port";
@@ -34,7 +37,7 @@ $response = array(
'supportedScope' => $this->scope,
'requestedScope' => $requestedScope
);
$response = $filter->xssFilterHard($response,"url");
?>
<table width="100%" cellspacing="0" cellpadding="0" border="0">