fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HOR-282 Cleaned up more issues with XSS.

Browse Source
This commit is contained in:
Chloe Deguzman
2016-03-03 13:23:23 +00:00
parent 3bf9e110db
commit 67812cc2f3
3 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
workflow/engine/methods/tools/ajaxListener.php
View File

@@ -71,7 +71,7 @@ class Ajax
} }
} catch (Exception $e) { } catch (Exception $e) {
$result->success = false; $result->success = false;
$result->msg = $e->getMessage(); $result->msg = htmlspecialchars($e->getMessage());
} }
print G::json_encode($result); print G::json_encode($result);
} }
@@ -93,7 +93,7 @@ class Ajax
$result->msg = 'Deleted Successfully!'; $result->msg = 'Deleted Successfully!';
} catch (Exception $e) { } catch (Exception $e) {
$result->success = false; $result->success = false;
$result->msg = $e->getMessage(); $result->msg = htmlspecialchars($e->getMessage());
} }
print G::json_encode($result); print G::json_encode($result);
} }
@@ -106,7 +106,7 @@ class Ajax
$result['success'] = true; $result['success'] = true;
} catch (Exception $e) { } catch (Exception $e) {
$result->success = false; $result->success = false;
$result->msg = $e->getMessage(); $result->msg = htmlspecialchars($e->getMessage());
} }
print G::json_encode($result); print G::json_encode($result);
} }

16
workflow/engine/skinEngine/base/error404.php
View File

@@ -13,17 +13,29 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
$sysSys = ""; $sysSys = "";
$sysLang = ""; $sysLang = "";
$sysSkin = ""; $sysSkin = "";
if (isset($url[1]) && preg_match("/^sys(.+)$/", $url[1], $match)) { if (isset($url[1]) && preg_match("/^sys(.+)$/", $url[1], $match)) {
$sysSys = $match[1]; $sysSys = $match[1];
}
// Check if sys path exists
$checkDir = PATH_DATA."sites/".$sysSys;
if(!is_dir($checkDir)) {
$sysSys = '';
}
}
if (isset($url[2])) { if (isset($url[2])) {
$sysLang = $url[2]; $sysLang = $url[2];
} }
if (isset($url[3])) { if (isset($url[3])) {
$sysSkin = $url[3]; $sysSkin = $url[3];
// Check if sys path exists
$checkDir = PATH_SKIN_ENGINE.$sysSkin;
if(!is_dir($checkDir)) {
$sysSkin = '';
}
} }
if ($sysSys != "" && $sysLang != "" && $sysSkin != "") { if ($sysSys != "" && $sysLang != "" && $sysSkin != "") {

5
workflow/engine/skinEngine/neoclassic/error404.php
View File

@@ -30,10 +30,6 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
if (isset($url[2])) { if (isset($url[2])) {
$sysLang = $url[2]; $sysLang = $url[2];
if($sysLang != 'en') {
var_dump($sysLang);
}
} }
if (isset($url[3])) { if (isset($url[3])) {
@@ -44,7 +40,6 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
if(!is_dir($checkDir)) { if(!is_dir($checkDir)) {
$sysSkin = ''; $sysSkin = '';
} }
} }
if ($sysSys != "" && $sysLang != "" && $sysSkin != "") { if ($sysSys != "" && $sysLang != "" && $sysSkin != "") {