HOR-282 Cleaned up more issues with XSS.

workflow/engine/methods/tools/ajaxListener.php

@@ -71,7 +71,7 @@ class Ajax
             }
         } catch (Exception $e) {
             $result->success = false;
-            $result->msg = $e->getMessage();
+            $result->msg = htmlspecialchars($e->getMessage());
         }
         print G::json_encode($result);
     }
@@ -93,7 +93,7 @@ class Ajax
             $result->msg = 'Deleted Successfully!';
         } catch (Exception $e) {
             $result->success = false;
-            $result->msg = $e->getMessage();
+            $result->msg = htmlspecialchars($e->getMessage());
         }
         print G::json_encode($result);
     }
@@ -106,7 +106,7 @@ class Ajax
             $result['success'] = true;
         } catch (Exception $e) {
             $result->success = false;
-            $result->msg = $e->getMessage();
+            $result->msg = htmlspecialchars($e->getMessage());
         }
         print G::json_encode($result);
     }

workflow/engine/skinEngine/base/error404.php

@@ -16,6 +16,12 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
  
     if (isset($url[1]) && preg_match("/^sys(.+)$/", $url[1], $match)) {
         $sysSys = $match[1];
+
+        // Check if sys path exists
+        $checkDir = PATH_DATA."sites/".$sysSys;
+        if(!is_dir($checkDir)) { 
+            $sysSys = '';
+        }
     }
     
     if (isset($url[2])) {
@@ -24,6 +30,12 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
 
     if (isset($url[3])) {
         $sysSkin = $url[3];
+        
+        // Check if sys path exists
+        $checkDir = PATH_SKIN_ENGINE.$sysSkin;
+        if(!is_dir($checkDir)) { 
+            $sysSkin = '';
+        }
     }
 
     if ($sysSys != "" && $sysLang != "" && $sysSkin != "") {

workflow/engine/skinEngine/neoclassic/error404.php

@@ -30,10 +30,6 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
     
     if (isset($url[2])) {
         $sysLang = $url[2];
-        
-        if($sysLang != 'en') { 
-            var_dump($sysLang);
-        }
     }
 
     if (isset($url[3])) {
@@ -44,7 +40,6 @@ if (isset($_GET["url"]) && $_GET["url"] != "") {
         if(!is_dir($checkDir)) { 
             $sysSkin = '';
         }
-
     }
 
     if ($sysSys != "" && $sysLang != "" && $sysSkin != "") {