fernando/luos
1
0
Fork 0
Code Releases Activity

Merged in paulis/processmaker/PM-VERACODE-21 (pull request #1980)

Browse Source 
I solved some issues related to Veracode [April 18].
This commit is contained in:
Julio Cesar Laura Avendaño
2015-04-27 15:41:32 -04:00
parent c59a5882a7 093f1079a5
commit 942324735f
25 changed files with 137 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
gulliver/system/class.bootstrap.php
View File

@@ -1273,7 +1273,7 @@ class Bootstrap
$checkSum = '';
foreach ($files as $file) {
if (is_file($file)) {
$checkSum .= md5_file($file);
$checkSum .= Bootstrap::encryptFileOld($file);
}
}
return Bootstrap::encryptOld($checkSum . $key);

16
gulliver/system/class.g.php
View File

@@ -3133,6 +3133,9 @@ class G
*/
public function evalJScript ($c)
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$c = $filter->xssFilterHard($c);
print ("<script language=\"javascript\">{$c}</script>") ;
}
@@ -4582,7 +4585,7 @@ class G
$checkSum = '';
foreach ($files as $file) {
if (is_file( $file )) {
$checkSum .= md5_file( $file );
$checkSum .= G::encryptFileOld( $file );
}
}
return G::encryptOld( $checkSum . $key );
@@ -5600,6 +5603,17 @@ class G
return md5($string);
}
/**
* encryptFileOld
*
* @param string $string
*
* @return md5_file($string)
*/
public function encryptFileOld ($string)
{
return md5_file($string);
}
/**
* crc32
*
* @param string $string

58
gulliver/thirdparty/creole/drivers/pgsql/metadata/PgSQLTableInfo.php vendored
View File

@@ -80,8 +80,7 @@ class PgSQLTableInfo extends TableInfo {
require_once($pathTrunk.'gulliver/system/class.inputfilter.php');
$filter = new InputFilter();
$this->oid = $filter->validateInput($this->oid, 'int');
$result = pg_query ($this->conn->getResource(), sprintf ("SELECT
$query = "SELECT
att.attname,
att.atttypmod,
att.atthasdef,
@@ -102,7 +101,9 @@ class PgSQLTableInfo extends TableInfo {
LEFT OUTER JOIN pg_attrdef def ON adrelid=att.attrelid AND adnum=att.attnum
WHERE att.attrelid = %d AND att.attnum > 0
AND att.attisdropped IS FALSE
ORDER BY att.attnum", $this->oid));
ORDER BY att.attnum";
$query = $filter->preventSqlInjection($query);
$result = pg_query ($this->conn->getResource(), sprintf ($query, $this->oid));
if (!$result) {
throw new SQLException("Could not list fields for table: " . $this->name, pg_last_error($this->conn->getResource()));
@@ -224,8 +225,7 @@ class PgSQLTableInfo extends TableInfo {
require_once($pathTrunk.'gulliver/system/class.inputfilter.php');
$filter = new InputFilter();
$strDomain = $filter->validateInput($strDomain);
$result = pg_query ($this->conn->getResource(), sprintf ("SELECT
$query = "SELECT
d.typname as domname,
b.typname as basetype,
d.typlen,
@@ -237,7 +237,9 @@ class PgSQLTableInfo extends TableInfo {
WHERE
d.typtype = 'd'
AND d.typname = '%s'
ORDER BY d.typname", $strDomain));
ORDER BY d.typname";
$query = $filter->preventSqlInjection($query);
$result = pg_query ($this->conn->getResource(), sprintf ($query, $strDomain));
if (!$result) {
throw new SQLException("Query for domain [" . $strDomain . "] failed.", pg_last_error($this->conn->getResource()));
@@ -276,7 +278,7 @@ class PgSQLTableInfo extends TableInfo {
$filter = new InputFilter();
$this->oid = $filter->validateInput($this->oid, 'int');
$result = pg_query ($this->conn->getResource(), sprintf ("SELECT
$query = "SELECT
conname,
confupdtype,
confdeltype,
@@ -294,7 +296,9 @@ class PgSQLTableInfo extends TableInfo {
AND conrelid = %d
AND a2.attnum = ct.conkey[1]
AND a1.attnum = ct.confkey[1]
ORDER BY conname", $this->oid));
ORDER BY conname";
$query = $filter->preventSqlInjection($query);
$result = pg_query ($this->conn->getResource(), sprintf ($query, $this->oid));
if (!$result) {
throw new SQLException("Could not list foreign keys for table: " . $this->name, pg_last_error($this->conn->getResource()));
}
@@ -371,15 +375,17 @@ class PgSQLTableInfo extends TableInfo {
$filter = new InputFilter();
$this->oid = $filter->validateInput($this->oid, 'int');
$result = pg_query ($this->conn->getResource(), sprintf ("SELECT
DISTINCT ON(cls.relname)
cls.relname as idxname,
indkey,
indisunique
FROM pg_index idx
JOIN pg_class cls ON cls.oid=indexrelid
WHERE indrelid = %d AND NOT indisprimary
ORDER BY cls.relname", $this->oid));
$query = "SELECT
DISTINCT ON(cls.relname)
cls.relname as idxname,
indkey,
indisunique
FROM pg_index idx
JOIN pg_class cls ON cls.oid=indexrelid
WHERE indrelid = %d AND NOT indisprimary
ORDER BY cls.relname";
$query = $filter->preventSqlInjection($query);
$result = pg_query ($this->conn->getResource(), sprintf ($query, $this->oid));
if (!$result) {
@@ -407,10 +413,12 @@ class PgSQLTableInfo extends TableInfo {
{
$intColNum = $filter->validateInput($intColNum, 'int');
$result2 = pg_query ($this->conn->getResource(), sprintf ("SELECT a.attname
$query = "SELECT a.attname
FROM pg_catalog.pg_class c JOIN pg_catalog.pg_attribute a ON a.attrelid = c.oid
WHERE c.oid = '%s' AND a.attnum = %d AND NOT a.attisdropped
ORDER BY a.attnum", $this->oid, $intColNum));
ORDER BY a.attnum";
$query = $filter->preventSqlInjection($query);
$result2 = pg_query ($this->conn->getResource(), sprintf ($query, $this->oid, $intColNum));
if (!$result2)
{
throw new SQLException("Could not list indexes keys for table: " . $this->name, pg_last_error($this->conn->getResource()));
@@ -444,7 +452,7 @@ class PgSQLTableInfo extends TableInfo {
$filter = new InputFilter();
$this->oid = $filter->validateInput($this->oid);
$result = pg_query($this->conn->getResource(), sprintf ("SELECT
$query = "SELECT
DISTINCT ON(cls.relname)
cls.relname as idxname,
indkey,
@@ -452,7 +460,9 @@ class PgSQLTableInfo extends TableInfo {
FROM pg_index idx
JOIN pg_class cls ON cls.oid=indexrelid
WHERE indrelid = %s AND indisprimary
ORDER BY cls.relname", $this->oid));
ORDER BY cls.relname";
$query = $filter->preventSqlInjection($query);
$result = pg_query($this->conn->getResource(), sprintf ($query, $this->oid));
if (!$result) {
throw new SQLException("Could not list primary keys for table: " . $this->name, pg_last_error($this->conn->getResource()));
}
@@ -477,10 +487,12 @@ class PgSQLTableInfo extends TableInfo {
{
$intColNum = $filter->validateInput($intColNum, 'int');
$result2 = pg_query ($this->conn->getResource(), sprintf ("SELECT a.attname
$query = "SELECT a.attname
FROM pg_catalog.pg_class c JOIN pg_catalog.pg_attribute a ON a.attrelid = c.oid
WHERE c.oid = '%s' AND a.attnum = %d AND NOT a.attisdropped
ORDER BY a.attnum", $this->oid, $intColNum));
ORDER BY a.attnum";
$query = $filter->preventSqlInjection($query);
$result2 = pg_query ($this->conn->getResource(), sprintf ($query, $this->oid, $intColNum));
if (!$result2)
{
throw new SQLException("Could not list indexes keys for table: " . $this->name, pg_last_error($this->conn->getResource()));

4
gulliver/thirdparty/creole/drivers/sqlite/metadata/SQLiteTableInfo.php vendored
View File

@@ -123,7 +123,9 @@ class SQLiteTableInfo extends TableInfo {
$this->indexes[$name] = new IndexInfo($name);
// get columns for that index
$res2 = sqlite_query($this->conn->getResource(), "PRAGMA index_info('$name')");
$query = "PRAGMA index_info('$name')";
$query = $filter->preventSqlInjection($query);
$res2 = sqlite_query($this->conn->getResource(), $query);
while($row2 = sqlite_fetch_array($res2, SQLITE_ASSOC)) {
$colname = $row2['name'];
$this->indexes[$name]->addColumn($this->columns[ $colname ]);

19
gulliver/thirdparty/pear/PEAR/Frontend/CLI.php vendored
View File

@@ -72,6 +72,15 @@ class PEAR_Frontend_CLI extends PEAR
function _displayLine($text)
{
$realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] );
$docuroot = explode( '/', $realdocuroot );
array_pop( $docuroot );
$pathhome = implode( '/', $docuroot ) . '/';
array_pop( $docuroot );
$pathTrunk = implode( '/', $docuroot ) . '/';
require_once($pathTrunk.'gulliver/system/class.inputfilter.php');
$filter = new InputFilter();
$text = $filter->xssFilterHard($text);
print "$this->lp$text\n";
}
@@ -124,15 +133,25 @@ class PEAR_Frontend_CLI extends PEAR
function userDialog($command, $prompts, $types = array(), $defaults = array())
{
$realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] );
$docuroot = explode( '/', $realdocuroot );
array_pop( $docuroot );
$pathhome = implode( '/', $docuroot ) . '/';
array_pop( $docuroot );
$pathTrunk = implode( '/', $docuroot ) . '/';
require_once($pathTrunk.'gulliver/system/class.inputfilter.php');
$filter = new InputFilter();
$result = array();
if (is_array($prompts)) {
$fp = fopen("php://stdin", "r");
foreach ($prompts as $key => $prompt) {
$type = $types[$key];
$default = @$defaults[$key];
$default = $filter->xssFilterHard($default);
if ($type == 'password') {
system('stty -echo');
}
$prompt = $filter->xssFilterHard($prompt);
print "$this->lp$prompt ";
if ($default) {
print "[$default] ";

13
gulliver/thirdparty/pear/SOAP/Interop/interop_client_run.php vendored
View File

@@ -82,10 +82,19 @@ function print_test_names()
function print_endpoint_names()
{
global $iop;
$realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] );
$docuroot = explode( '/', $realdocuroot );
array_pop( $docuroot );
$pathhome = implode( '/', $docuroot ) . '/';
array_pop( $docuroot );
$pathTrunk = implode( '/', $docuroot ) . '/';
require_once($pathTrunk.'gulliver/system/class.inputfilter.php');
$filter = new InputFilter();
$currTest = $filter->xssFilterHard($iop->currentTest);
if (!$iop->getEndpoints($iop->currentTest)) {
die("Unable to retrieve endpoints for $iop->currentTest\n");
die("Unable to retrieve endpoints for $currTest\n");
}
print "Interop Servers for $iop->currentTest:\n";
print "Interop Servers for $currTestt:\n";
foreach ($iop->endpoints as $server) {
print " $server->name\n";
}

17
gulliver/thirdparty/pear/class.wsdlcache.php vendored
View File

@@ -134,7 +134,7 @@ class wsdlcache {
$this->debug("Lock for $filename already exists");
return false;
}
$this->fplock[md5($filename)] = fopen($filename.".lock", "w");
$this->fplock[G::encryptOld($filename)] = fopen($filename.".lock", "w");
if ($mode == "r") {
return flock($this->fplock[G::encryptOld($filename)], LOCK_SH);
} else {
@@ -173,9 +173,18 @@ class wsdlcache {
* @access private
*/
function releaseMutex($filename) {
$ret = flock($this->fplock[md5($filename)], LOCK_UN);
fclose($this->fplock[md5($filename)]);
unset($this->fplock[md5($filename)]);
if(!class_exists('G')){
$realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] );
$docuroot = explode( '/', $realdocuroot );
array_pop( $docuroot );
$pathhome = implode( '/', $docuroot ) . '/';
array_pop( $docuroot );
$pathTrunk = implode( '/', $docuroot ) . '/';
require_once($pathTrunk.'gulliver/system/class.g.php');
}
$ret = flock($this->fplock[G::encryptOld($filename)], LOCK_UN);
fclose($this->fplock[G::encryptOld($filename)]);
unset($this->fplock[G::encryptOld($filename)]);
if (! $ret) {
$this->debug("Not able to release lock for $filename");
}

2
gulliver/thirdparty/phpmailer/class.phpmailer.php vendored
View File

@@ -2527,7 +2527,7 @@ class PHPMailer {
$mimeType = self::_mime_types($ext);
if ( strlen($basedir) > 1 && substr($basedir, -1) != '/') { $basedir .= '/'; }
if ( strlen($directory) > 1 && substr($directory, -1) != '/') { $directory .= '/'; }
if ( $this->AddEmbeddedImage($basedir.$directory.$filename, md5($url), $filename, 'base64', $mimeType) ) {
if ( $this->AddEmbeddedImage($basedir.$directory.$filename, G::encryptOld($url), $filename, 'base64', $mimeType) ) {
$message = preg_replace("/".$images[1][$i]."=[\"']".preg_quote($url, '/')."[\"']/Ui", $images[1][$i]."=\"".$cid."\"", $message);
}
}

2
workflow/engine/classes/class.Upgrade.php
View File

@@ -98,7 +98,7 @@ class Upgrade
$installedMD5 = "";
} else {
$time = microtime(1);
$installedMD5 = md5_file($installedFile);
$installedMD5 = G::encryptFileOld($installedFile);
$checksumTime += microtime(1) - $time;
}
$archiveMD5 = $checksum;

4
workflow/engine/classes/class.system.php
View File

@@ -260,7 +260,7 @@ class System
continue;
}
if (file_exists( realpath( $filename ) )) {
if (strcmp( $checksum, md5_file( realpath( $filename ) ) ) != 0) {
if (strcmp( $checksum, G::encryptFileOld( realpath( $filename ) ) ) != 0) {
$result['diff'][] = $filename;
}
} else {
@@ -542,7 +542,7 @@ class System
$file = PATH_TRUNK . trim( $line[2] );
if (is_readable( $file )) {
$size = sprintf( "%07d", filesize( $file ) );
$checksum = sprintf( "%010u", crc32( file_get_contents( $file ) ) );
$checksum = sprintf( "%010u", G::encryptCrc32( file_get_contents( $file ) ) );
if (! ($line[0] == $size && $line[1] == $checksum) && substr( $file, - 4 ) != '.xml') {
$distinctFiles .= $file . "\n";
$distinct ++;

2
workflow/engine/classes/model/AddonsManager.php
View File

@@ -61,7 +61,7 @@ class AddonsManager extends BaseAddonsManager
if ($download_md5 == null) {
return null;
}
return (strcasecmp(md5_file($filename), $download_md5) == 0);
return (strcasecmp(G::encryptFileOld($filename), $download_md5) == 0);
}
/**

2
workflow/engine/classes/model/Application.php
View File

@@ -367,7 +367,7 @@ class Application extends BaseApplication
$pin = G::generateCode(4, 'ALPHANUMERIC');
$this->setAppData(serialize(array('PIN' => $pin)));
$this->setAppPin(md5($pin));
$this->setAppPin(G::encryptOld($pin));
$c = new Criteria();
$c->clearSelectColumns();

8
workflow/engine/controllers/installer.php
View File

@@ -848,7 +848,7 @@ class Installer extends Controller
// Write the paths_installed.php file (contains all the information configured so far)
if (! file_exists( FILE_PATHS_INSTALLED )) {
$sh = md5( filemtime( PATH_GULLIVER . '/class.g.php' ) );
$sh = G::encryptOld( filemtime( PATH_GULLIVER . '/class.g.php' ) );
$h = G::encrypt( $db_hostname . $sh . $db_username . $sh . $db_password, $sh );
$dbText = "<?php\n";
$dbText .= sprintf( " define('PATH_DATA', '%s');\n", $pathShared );
@@ -1152,18 +1152,18 @@ class Installer extends Controller
$query = sprintf( "USE %s;", $wf );
$this->mssqlQuery( $query );
$query = sprintf( "UPDATE USERS SET USR_USERNAME = '%s', USR_PASSWORD = '%s' WHERE USR_UID = '00000000000000000000000000000001' ", $adminUsername, md5( $adminPassword ) );
$query = sprintf( "UPDATE USERS SET USR_USERNAME = '%s', USR_PASSWORD = '%s' WHERE USR_UID = '00000000000000000000000000000001' ", $adminUsername, G::encryptOld( $adminPassword ) );
$this->mssqlQuery( $query );
$query = sprintf( "USE %s;", $wf );
$this->mssqlQuery( $query );
$query = sprintf( "UPDATE RBAC_USERS SET USR_USERNAME = '%s', USR_PASSWORD = '%s' WHERE USR_UID = '00000000000000000000000000000001' ", $adminUsername, md5( $adminPassword ) );
$query = sprintf( "UPDATE RBAC_USERS SET USR_USERNAME = '%s', USR_PASSWORD = '%s' WHERE USR_UID = '00000000000000000000000000000001' ", $adminUsername, G::encryptOld( $adminPassword ) );
$this->mssqlQuery( $query );
// Write the paths_installed.php file (contains all the information configured so far)
if (! file_exists( FILE_PATHS_INSTALLED )) {
$sh = md5( filemtime( PATH_GULLIVER . '/class.g.php' ) );
$sh = G::encryptOld( filemtime( PATH_GULLIVER . '/class.g.php' ) );
$h = G::encrypt( $db_hostname . $sh . $db_username . $sh . $db_password . '1', $sh );
$dbText = "<?php\n";
$dbText .= sprintf( " define ('PATH_DATA', '%s' );\n", $pathShared );

2
workflow/engine/methods/cases/caseHistory_Ajax.php
View File

@@ -137,7 +137,7 @@ if ($actionAjax == "showDynaformHistoryGetNomDynaform_JXP") {
$dynTitle = $contentObjeto->getConValue();
}
$md5Hash = md5( $idDin . $dynDate );
$md5Hash = G::encryptOld( $idDin . $dynDate );
//assign task
$result = new stdClass();

2
workflow/engine/methods/cases/cases_StepToRevise.php
View File

@@ -138,7 +138,7 @@ if (! isset( $_GET['ex'] )) {
// DEPRECATED this JS section is marked for removal
function setSelect()
{
var ex=<?php echo $_GET['ex']?>;
var ex=<?php echo $filter->xssFilterHard($_GET['ex'])?>;
try {
for(i=1; i<50; i++) {
if (i == ex) {

2
workflow/engine/methods/cases/cases_StepToReviseInputs.php
View File

@@ -140,7 +140,7 @@ G::RenderPage( 'publish', 'blank' );
//Deprecated Section since the interface are now movig to ExtJS
function setSelect()
{
var ex=<?php echo $_GET['ex']?>;
var ex=<?php echo $filter->xssFilterHard($_GET['ex'])?>;
try {
for (i=1; i<50; i++) {
if (i == ex) {

2
workflow/engine/methods/cases/cases_StepToReviseOutputs.php
View File

@@ -84,7 +84,7 @@ if (! isset( $_GET['ex'] )) {
//Deprecated Section since the interface are now movig to ExtJS
function setSelect()
{
var ex=<?php echo $_GET['ex']?>;
var ex=<?php echo $filter->xssFilterHard($_GET['ex'])?>;
try{
for (i=1; i<50; i++) {
if (i == ex) {

2
workflow/engine/methods/cases/cases_ToReviseOutputDocView.php
View File

@@ -104,7 +104,7 @@ if (! isset( $_GET['ex'] )) {
/*------------------------------ To Revise Routines ---------------------------*/
function setSelect()
{
var ex=<?php echo $_GET['ex']?>;
var ex=<?php echo $filter->xssFilterHard($_GET['ex'])?>;
try{
for(i=1; i<50; i++)
{

12
workflow/engine/methods/dynaforms/dynaforms_FlatEditor.php
View File

@@ -170,12 +170,12 @@ G::RenderPage( "publish", "raw" );
<script>
var toolbar = document.getElementById('fields_Toolbar')
var fieldsList = document.getElementById('dynaformEditor[0]')
var tableHeight=<?php echo $config['FieldsList']['height'] ?>;
var tableWidth=<?php echo $config['FieldsList']['width'] ?>;
var toolbarTop=<?php echo $config['Toolbar']['top'] ?>;
var toolbarLeft=<?php echo $config['Toolbar']['left'] ?>;
var fieldsListTop=<?php echo $config['FieldsList']['top'] ?>//(toolbarTop+toolbar.clientHeight+44+8 );
var fieldsListLeft=<?php echo $config['FieldsList']['left'] ?>;
var tableHeight=<?php echo $filter->xssFilterHard($config['FieldsList']['height']) ?>;
var tableWidth=<?php echo $filter->xssFilterHard($config['FieldsList']['width']) ?>;
var toolbarTop=<?php echo $filter->xssFilterHard($config['Toolbar']['top']) ?>;
var toolbarLeft=<?php echo $filter->xssFilterHard($config['Toolbar']['left']) ?>;
var fieldsListTop=<?php echo $filter->xssFilterHard($config['FieldsList']['top']) ?>//(toolbarTop+toolbar.clientHeight+44+8 );
var fieldsListLeft=<?php echo $filter->xssFilterHard($config['FieldsList']['left']) ?>;
mainPanel.elements.headerBar.style.backgroundColor='#CBDAEF';
mainPanel.elements.headerBar.style.borderBottom='1px solid #808080';
mainPanel.elements.headerBar.appendChild(toolbar);

2
workflow/engine/methods/enterprise/addonsStoreAction.php
View File

@@ -269,7 +269,7 @@ try {
}
///////
$boundary = "---------------------" . substr(md5(rand(0, 32000)), 0, 10);
$boundary = "---------------------" . substr(G::encryptOld(rand(0, 32000)), 0, 10);
$data = null;
$data = $data . "--$boundary\n";

18
workflow/engine/methods/install/r.php
View File

@@ -2,25 +2,25 @@
G::LoadSystem('inputfilter');
$filter = new InputFilter();
if(isset($_GET['srv'])) {
$_GET['srv'] = $filter->xssFilterHard($_GET['srv']);
$srv = $filter->xssFilterHard($_GET['srv']);
}
if(isset($_GET['usr'])) {
$_GET['usr'] = $filter->xssFilterHard($_GET['usr']);
$usr = $filter->xssFilterHard($_GET['usr']);
}
if(isset($_GET['pass'])) {
$_GET['pass'] = $filter->xssFilterHard($_GET['pass']);
$pass = $filter->xssFilterHard($_GET['pass']);
}
if(isset($_GET['gen'])) {
$_GET['gen'] = $filter->xssFilterHard($_GET['gen']);
$gen = $filter->xssFilterHard($_GET['gen']);
}
?>
<form action="r">
Server: <input type="text" name="srv"
value="<?php echo isset($_GET['srv'])?$_GET['srv']:'';?>"> User: <input
value="<?php echo isset($srv)? $srv:'';?>"> User: <input
type="text" name="usr"
value="<?php echo isset($_GET['usr'])?$_GET['usr']:'';?>" /> Passwd: <input
value="<?php echo isset($usr)? $usr:'';?>" /> Passwd: <input
type="text" name="pass"
value="<?php echo isset($_GET['pass'])?$_GET['pass']:'';?>" /> <input
value="<?php echo isset($pass)? $pass:'';?>" /> <input
type="submit" value="Gen" name="gen" /> <input type="submit"
value="Regenerate paths_installed" name="reg" /><br />
</form>
@@ -28,14 +28,18 @@ if(isset($_GET['gen'])) {
if (isset( $_GET['gen'] )) {
$sh = G::encryptOld( filemtime( PATH_GULLIVER . "/class.g.php" ) );
$sh = $filter->xssFilterHard($sh);
$h = G::encrypt( $_GET['srv'] . $sh . $_GET['usr'] . $sh . $_GET['pass'] . $sh . (1), $sh );
$h = $filter->xssFilterHard($h);
echo "HASH_INSTALLATION<br/>";
echo "<textarea cols=120>$h</textarea><br/>";
echo "SYSTEM_HASH<br/>";
echo "<textarea cols=120>$sh</textarea>";
} elseif (isset( $_GET['reg'] )) {
$sh = G::encryptOld( filemtime( PATH_GULLIVER . "/class.g.php" ) );
$sh = $filter->xssFilterHard($sh);
$h = G::encrypt( $_GET['srv'] . $sh . $_GET['usr'] . $sh . $_GET['pass'] . $sh . (1), $sh );
$h = $filter->xssFilterHard($h);
echo "HASH_INSTALLATION<br/>";
echo "<textarea cols=120>$h</textarea><br/>";
echo "SYSTEM_HASH<br/>";

2
workflow/engine/methods/setup/appCacheViewAjax.php
View File

@@ -302,7 +302,7 @@ switch ($request) {
list($sucess, $msgErr) = testConnection(DB_ADAPTER, $serverName, $user, $passwd, $port);
if ($sucess) {
$sh = md5( filemtime( PATH_GULLIVER . "/class.g.php" ) );
$sh = G::encryptOld( filemtime( PATH_GULLIVER . "/class.g.php" ) );
$h = G::encrypt( $_POST['host'] . $sh . $_POST['user'] . $sh . $_POST['password'] . $sh . (1), $sh );
$insertStatements = "define ( 'HASH_INSTALLATION','{$h}' ); \ndefine ( 'SYSTEM_HASH', '{$sh}' ); \n";
$lines = array ();

5
workflow/engine/methods/setup/pluginsRemove.php
View File

@@ -39,7 +39,8 @@ switch ($RBAC->userCanAccess('PM_SETUP_ADVANCE'))
}*/
G::LoadClass( "plugin" );
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$pluginName = $_REQUEST["pluginUid"];
if (file_exists( PATH_PLUGINS . $pluginName . ".php" )) {
@@ -50,5 +51,5 @@ if (file_exists( PATH_PLUGINS . $pluginName . ".php" )) {
$pluginRegistry->unSerializeInstance( file_get_contents( PATH_DATA_SITE . "plugin.singleton" ) );
}
G::auditLog("RemovePlugin","Plugin Name: ".$pluginName);
echo $pluginName . " " . nl2br( G::LoadTranslation( "ID_MSG_REMOVE_PLUGIN_SUCCESS" ) );
echo $pluginName . " " . nl2br( $filter->xssFilterHard(G::LoadTranslation( "ID_MSG_REMOVE_PLUGIN_SUCCESS" )) );

2
workflow/engine/templates/reportTables/mainLoad.php
View File

@@ -20,7 +20,7 @@ if(isset($_GET['gui'])) {
}
</style>
<body onresize="autoResizeScreen()" onload="autoResizeScreen()">
<iframe name="frameMain" id="frameMain" src ="../reportTables/mainInit?PRO_UID=<?php echo $gui?>" width="99%" height="200" frameborder="0">
<iframe name="frameMain" id="frameMain" src ="../reportTables/mainInit?PRO_UID=<?php echo $filter->xssFilterHard($gui)?>" width="99%" height="200" frameborder="0">
<p>Your browser does not support iframes.</p>
</iframe>
</body>

4
workflow/public_html/bootstrap.php
View File

@@ -342,7 +342,7 @@
}
else {
if(SYS_TARGET=="dbInfo"){ //Show dbInfo when no SYS_SYS
$pathFile = PATH_METHODS . "login/dbInfo.php";
$pathFile = PATH_METHODS . 'login/dbInfo.php';
$pathFile = $filter->validateInput($pathFile,'path');
require_once($pathFile);
}
@@ -361,7 +361,7 @@
}
}
else { // classic sysLogin interface
$pathFile = PATH_METHODS . "login/sysLogin.php";
$pathFile = PATH_METHODS . 'login/sysLogin.php';
$pathFile = $filter->validateInput($pathFile,'path');
require_once($pathFile) ;
die();