From 63cba2c26297f25e060c43be310d4ab495376689 Mon Sep 17 00:00:00 2001 From: "marcelo.cuiza" Date: Tue, 5 May 2015 09:55:39 -0400 Subject: [PATCH] correcciones --- gulliver/system/class.dbMaintenance.php | 4 +- gulliver/system/class.g.php | 16 ++++-- .../thirdparty/pear/PEAR/Command/Package.php | 2 +- workflow/engine/controllers/installer.php | 51 +++++++++++-------- workflow/engine/methods/cases/cases_Ajax.php | 32 ++++++------ .../BusinessModel/Consolidated.php | 4 +- 6 files changed, 64 insertions(+), 45 deletions(-) diff --git a/gulliver/system/class.dbMaintenance.php b/gulliver/system/class.dbMaintenance.php index 1e6022198..c0f1ece02 100755 --- a/gulliver/system/class.dbMaintenance.php +++ b/gulliver/system/class.dbMaintenance.php @@ -450,7 +450,7 @@ class DataBaseMaintenance } } - $sQuery = "LOCK TABLES " . implode( " READ, ", $aTables ) . " READ; "; + $sQuery = 'LOCK TABLES ' . implode( ' READ, ', $aTables ) . ' READ; '; $sQuery = $filter->preventSqlInjection($sQuery); if (@mysql_query( $sQuery )) { @@ -664,7 +664,7 @@ class DataBaseMaintenance $filter = new InputFilter(); $tablename = $filter->validateInput($tablename, 'nosql'); $tableSchema = ""; - $sql = "show create table `%s`; "; + $sql = 'show create table `%s`; '; $sql = $filter->preventSqlInjection($sql, array($tablename)); $result = @mysql_query( $sql ); if ($result) { diff --git a/gulliver/system/class.g.php b/gulliver/system/class.g.php index 3c3277435..fbf793c00 100644 --- a/gulliver/system/class.g.php +++ b/gulliver/system/class.g.php @@ -310,8 +310,12 @@ class G while (! @is_dir( dirname( end( $folder_path ) ) ) && dirname( end( $folder_path ) ) != '/' && dirname( end( $folder_path ) ) != '.' && dirname( end( $folder_path ) ) != '') { array_push( $folder_path, dirname( end( $folder_path ) ) ); //var_dump($folder_path); die; } + + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); while ($parent_folder_path = array_pop( $folder_path )) { + $parent_folder_path = $filter->validateInput($parent_folder_path,"path"); if (! @is_dir( $parent_folder_path )) { if (! @mkdir( $parent_folder_path, $rights)) { error_log( "Can't create folder \"$parent_folder_path\""); @@ -2718,6 +2722,12 @@ class G $image = $inputFn( $path ); imagecopyresampled( $image_p, $image, 0, 0, 0, 0, $resWidth, $resHeight, $width, $height ); $outputFn( $image_p, $saveTo ); + + if(!is_null($saveTo)) { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + $saveTo = $filter->validateInput($saveTo, "path"); + } @chmod( $saveTo, 0666 ); } @@ -2792,7 +2802,7 @@ class G /** * Generate a numeric or alphanumeric code * - * @author Julio Cesar Laura Avendaힼjuliocesar@colosa.com> + * @author Julio Cesar Laura Avenda?juliocesar@colosa.com> * @access public * @return string */ @@ -3137,7 +3147,7 @@ class G /*G::LoadSystem('inputfilter'); $filter = new InputFilter(); $c = $filter->xssFilterHard($c);*/ - print ("") ; + print ('') ; } /** @@ -3158,7 +3168,7 @@ class G $quotedReplacement = preg_quote( $replacement, '/' ); - $default = array ('/à|á|å|â/' => 'a','/è|é|ê|ẽ|ë/' => 'e','/ì|í|î/' => 'i','/ò|ó|ô|ø/' => 'o','/ù|ú|ů|û/' => 'u','/ç/' => 'c','/ñ/' => 'n','/ä|æ/' => 'ae','/ö/' => 'oe','/ü/' => 'ue','/Ä/' => 'Ae','/Ü/' => 'Ue','/Ö/' => 'Oe','/ß/' => 'ss','/\.|\,|\:|\-|\\|\//' => " ",'/\\s+/' => $replacement + $default = array ('/à|á|å|â/' => 'a','/è|é|ê|?|ë/' => 'e','/ì|í|î/' => 'i','/ò|ó|ô|ø/' => 'o','/ù|ú|u|û/' => 'u','/ç/' => 'c','/ñ/' => 'n','/ä|æ/' => 'ae','/ö/' => 'oe','/ü/' => 'ue','/Ä/' => 'Ae','/Ü/' => 'Ue','/Ö/' => 'Oe','/ß/' => 'ss','/\.|\,|\:|\-|\\|\//' => " ",'/\\s+/' => $replacement ); $map = array_merge( $default, $map ); diff --git a/gulliver/thirdparty/pear/PEAR/Command/Package.php b/gulliver/thirdparty/pear/PEAR/Command/Package.php index 2db434e3f..9dec74734 100755 --- a/gulliver/thirdparty/pear/PEAR/Command/Package.php +++ b/gulliver/thirdparty/pear/PEAR/Command/Package.php @@ -465,7 +465,7 @@ Wrote: /usr/src/redhat/RPMS/i386/PEAR::Net_Socket-1.0-1.i386.rpm } } $plist = implode(" ", $params); - $cmd = "$php -C -d include_path=$cwd$ps$ip -f $run_tests -- $plist"; + $cmd = $php.' -C -d include_path='.$cwd.$ps.$ip.' -f '.$run_tests.' -- '.$plist; if (!class_exists('G')) { $realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] ); diff --git a/workflow/engine/controllers/installer.php b/workflow/engine/controllers/installer.php index e0248996e..3ea60b913 100644 --- a/workflow/engine/controllers/installer.php +++ b/workflow/engine/controllers/installer.php @@ -321,8 +321,13 @@ class Installer extends Controller G::verifyPath( $aux['dirname'], true ); if (is_dir( $aux['dirname'] )) { if (! file_exists( $_REQUEST['pathLogFile'] )) { - @file_put_contents( $_REQUEST['pathLogFile'], '' ); - @chmod($_REQUEST['pathShared'], 0770); + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + $pathLogFile = $filter->validateInput($_REQUEST['pathLogFile'], "path"); + $pathShared = $filter->validateInput($_REQUEST['pathShared'], "path"); + + @file_put_contents( $pathLogFile, '' ); + @chmod($pathShared, 0770); } } } @@ -843,10 +848,10 @@ class Installer extends Controller $query = sprintf( "USE %s;", $wf_workpace ); $this->mysqlQuery( $query ); - $query = sprintf( "UPDATE USERS SET USR_USERNAME = '%s', USR_LASTNAME = '%s', USR_PASSWORD = '%s' WHERE USR_UID = '00000000000000000000000000000001' ", $adminUsername, $adminUsername, md5( $adminPassword ) ); + $query = sprintf( "UPDATE USERS SET USR_USERNAME = '%s', USR_LASTNAME = '%s', USR_PASSWORD = '%s' WHERE USR_UID = '00000000000000000000000000000001' ", $adminUsername, $adminUsername, G::encryptOld( $adminPassword ) ); $this->mysqlQuery( $query ); - $query = sprintf( "UPDATE RBAC_USERS SET USR_USERNAME = '%s', USR_LASTNAME = '%s', USR_PASSWORD = '%s' WHERE USR_UID = '00000000000000000000000000000001' ", $adminUsername, $adminUsername, md5( $adminPassword ) ); + $query = sprintf( "UPDATE RBAC_USERS SET USR_USERNAME = '%s', USR_LASTNAME = '%s', USR_PASSWORD = '%s' WHERE USR_UID = '00000000000000000000000000000001' ", $adminUsername, $adminUsername, G::encryptOld( $adminPassword ) ); $this->mysqlQuery( $query ); // Write the paths_installed.php file (contains all the information configured so far) @@ -1091,6 +1096,8 @@ class Installer extends Controller } $this->installLog( G::LoadTranslation('ID_CREATING', SYS_LANG, Array($db_file) )); + + $db_file = $filter->validateInput($db_file, "path"); file_put_contents( $db_file, $dbText ); // Generate the databases.php file @@ -1111,6 +1118,8 @@ class Installer extends Controller $databasesText = str_replace( '{dbData}', $dbData, @file_get_contents( PATH_HOME . 'engine/templates/installer/databases.tpl' ) ); $this->installLog( G::LoadTranslation('ID_CREATING', SYS_LANG, Array($databases_file) )); + + $databases_file = $filter->validateInput($databases_file, "path"); file_put_contents( $databases_file, $databasesText ); //execute scripts to create and populates databases @@ -1237,35 +1246,35 @@ class Installer extends Controller $info = new stdclass(); if ($_REQUEST['db_engine'] == 'mysql') { - $_REQUEST['db_hostname'] = $filter->validateInput($_REQUEST['db_hostname']); - $_REQUEST['db_username'] = $filter->validateInput($_REQUEST['db_username']); - $_REQUEST['db_password'] = $filter->validateInput($_REQUEST['db_password']); - $link = @mysql_connect( $_REQUEST['db_hostname'], $_REQUEST['db_username'], $_REQUEST['db_password'] ); - $_REQUEST['wfDatabase'] = $filter->validateInput($_REQUEST['wfDatabase'], 'nosql'); + $db_hostname = $filter->validateInput($_REQUEST['db_hostname']); + $db_username = $filter->validateInput($_REQUEST['db_username']); + $db_password = $filter->validateInput($_REQUEST['db_password']); + $link = @mysql_connect( $db_hostname, $db_username, $db_password ); + $wfDatabase = $filter->validateInput($_REQUEST['wfDatabase'], 'nosql'); $query = "show databases like '%s' "; - $query = $filter->preventSqlInjection( $query, array($_REQUEST['wfDatabase']) ); + $query = $filter->preventSqlInjection( $query, array($wfDatabase) ); $dataset = @mysql_query( $query, $link ); $info->wfDatabaseExists = (@mysql_num_rows( $dataset ) > 0); } else if ($_REQUEST['db_engine'] == 'mssql') { - $link = @mssql_connect( $_REQUEST['db_hostname'], $_REQUEST['db_username'], $_REQUEST['db_password'] ); - $_REQUEST['wfDatabase'] = $filter->validateInput($_REQUEST['wfDatabase'], 'nosql'); + $link = @mssql_connect( $db_hostname, $db_username, $db_password ); + $wfDatabase = $filter->validateInput($_REQUEST['wfDatabase'], 'nosql'); $query = "select * from sys.databases where name = '%s' "; - $query = $filter->preventSqlInjection( $query, array($_REQUEST['wfDatabase']) ); + $query = $filter->preventSqlInjection( $query, array($wfDatabase) ); $dataset = @mssql_query( $query , $link ); $info->wfDatabaseExists = (@mssql_num_rows( $dataset ) > 0); } else if ($_REQUEST['db_engine'] == 'sqlsrv') { - $arguments = array("UID" => $_REQUEST['db_username'], "PWD" => $_REQUEST['db_password']); - $link = @sqlsrv_connect( $_REQUEST['db_hostname'], $arguments); - $_REQUEST['wfDatabase'] = $filter->validateInput($_REQUEST['wfDatabase'], 'nosql'); + $arguments = array("UID" => $db_username, "PWD" => $db_password); + $link = @sqlsrv_connect( $db_hostname, $arguments); + $wfDatabase = $filter->validateInput($_REQUEST['wfDatabase'], 'nosql'); $query = "select * from sys.databases where name = '%s' "; - $query = $filter->preventSqlInjection( $query, array($_REQUEST['wfDatabase']) ); + $query = $filter->preventSqlInjection( $query, array($wfDatabase) ); $dataset = @sqlsrv_query( $link, $query ); $info->wfDatabaseExists = (@sqlsrv_num_rows( $dataset ) > 0); } else { - $link = @mssql_connect( $_REQUEST['db_hostname'], $_REQUEST['db_username'], $_REQUEST['db_password'] ); - $_REQUEST['wfDatabase'] = $filter->validateInput($_REQUEST['wfDatabase'], 'nosql'); + $link = @mssql_connect( $db_hostname, $db_username, $db_password ); + $wfDatabase = $filter->validateInput($_REQUEST['wfDatabase'], 'nosql'); $query = "select * from sys.databases where name = '%s' "; - $query = $filter->preventSqlInjection( $query, array($_REQUEST['wfDatabase']) ); + $query = $filter->preventSqlInjection( $query, array($wfDatabase) ); $dataset = @mssql_query( $query , $link ); $info->wfDatabaseExists = (@mssql_num_rows( $dataset ) > 0); } @@ -1670,6 +1679,7 @@ class Installer extends Controller $db_password = trim( $_REQUEST['db_password'] ); $db_password = $filter->validateInput($db_password); $wf = trim( $_REQUEST['wfDatabase'] ); + $wf = $filter->validateInput($wf); $db_host = ($db_port != '' && $db_port != 3306) ? $db_hostname . ':' . $db_port : $db_hostname; @@ -1701,4 +1711,3 @@ class Installer extends Controller } } } - diff --git a/workflow/engine/methods/cases/cases_Ajax.php b/workflow/engine/methods/cases/cases_Ajax.php index 9dfa86859..aa4c46c30 100644 --- a/workflow/engine/methods/cases/cases_Ajax.php +++ b/workflow/engine/methods/cases/cases_Ajax.php @@ -254,13 +254,13 @@ switch (($_POST['action']) ? $_POST['action'] : $_REQUEST['action']) { switch ($_POST['TAS_ASSIGN_TYPE']) { // switch verify $_POST['TAS_ASSIGN_TYPE'] case 'BALANCED': - $_POST['USR_UID'] = $filter->xssFilterHard($_POST['USR_UID']); + $USR_UID = $filter->xssFilterHard($_POST['USR_UID']); G::LoadClass( 'user' ); $oUser = new User( new DBConnection() ); - $oUser->load( $_POST['USR_UID'] ); + $oUser->load( $USR_UID ); $oUser->Fields['USR_FIRSTNAME'] = $filter->xssFilterHard($oUser->Fields['USR_FIRSTNAME']); $oUser->Fields['USR_LASTNAME'] = $filter->xssFilterHard($oUser->Fields['USR_LASTNAME']); - echo $oUser->Fields['USR_FIRSTNAME'] . ' ' . $oUser->Fields['USR_LASTNAME'] . ''; + echo $oUser->Fields['USR_FIRSTNAME'] . ' ' . $oUser->Fields['USR_LASTNAME'] . ''; break; case 'MANUAL': $sAux = ''; } else { $ID_EMPTY = $filter->xssFilterHard(G::LoadTranslation( 'ID_EMPTY' )); - echo 'Error: ' . $_POST['TAS_ASSIGN_VARIABLE'] . ' ' . $ID_EMPTY; + echo 'Error: ' . $TAS_ASSIGN_VARIABLE . ' ' . $ID_EMPTY; echo ''; } break; @@ -461,14 +461,15 @@ switch (($_POST['action']) ? $_POST['action'] : $_REQUEST['action']) { $cases->reassignCase( $_SESSION['APPLICATION'], $_SESSION['INDEX'], $_SESSION['USER_LOGGED'], $_POST['USR_UID'], $_POST['THETYPE'] ); break; case 'toRevisePanel': - $_POST['APP_UID'] = $filter->xssFilterHard($_POST['APP_UID']); - $_POST['DEL_INDEX'] = $filter->xssFilterHard($_POST['DEL_INDEX']); + $APP_UID = $filter->xssFilterHard($_POST['APP_UID']); + $DEL_INDEX = $filter->xssFilterHard($_POST['DEL_INDEX']); - $_GET['APP_UID'] = $_POST['APP_UID']; - $_GET['DEL_INDEX'] = $_POST['DEL_INDEX']; + $_GET['APP_UID'] = $APP_UID + $_GET['DEL_INDEX'] = $DEL_INDEX; $G_PUBLISH = new Publisher(); - echo ''; + + echo ""; // $G_PUBLISH->AddContent( 'smarty', 'cases/cases_toRevise' ); // $G_PUBLISH->AddContent('smarty', 'cases/cases_toReviseIn', '', '', array()); G::RenderPage( 'publish', 'raw' ); @@ -1025,4 +1026,3 @@ function getCasesTypeIds () $aTypes = Array ('to_do','draft','cancelled','sent','paused','completed','selfservice','to_revise','to_reassign'); return $aTypesID; } - diff --git a/workflow/engine/src/ProcessMaker/BusinessModel/Consolidated.php b/workflow/engine/src/ProcessMaker/BusinessModel/Consolidated.php index 89bd6ea95..8e590b361 100644 --- a/workflow/engine/src/ProcessMaker/BusinessModel/Consolidated.php +++ b/workflow/engine/src/ProcessMaker/BusinessModel/Consolidated.php @@ -334,9 +334,9 @@ class Consolidated $sort = $filter->validateInput($sort); if (in_array($sort, $arrayReportTableVar)) { $sort = strtoupper($sort); - eval("\$field = " . $tableName . "Peer::" . $sort . ";"); + eval('$field = ' . $tableName . 'Peer::' . $sort . ';'); } else { - eval("\$field = AppCacheViewPeer::" . $sort . ";"); + eval('$field = AppCacheViewPeer::' . $sort . ';'); } if ($dir == "ASC") {