fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG-FILES Upload files templates IMPROVEMENT

Browse Source 
- Al subir los templates no se valida el tipo.

- Se agrego la validacion del PRO_UID, ademas de tener el permiso PM_FACTORY y se quita cualquier tipo de codigo que no sea html en los archivos processes_doUpload.php, processes_Ajax.php, processes_UploadFiles.php.
This commit is contained in:
Marco Antonio Nina
2013-12-19 10:32:26 -04:00
parent 5cf9716f0b
commit ec860a320d
3 changed files with 10 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
workflow/engine/methods/processes/processes_Ajax.php
View File

@@ -526,26 +526,10 @@ try {
$content = stripslashes($_REQUEST['fcontent']);
$content = str_replace("@amp@", "&", $content);
$content = base64_decode($content);
$fields = array('!--', '--', '!DOCTYPE', 'a', 'abbr', 'acronym', 'address', 'applet', 'area',
'article', 'aside', 'audio', 'b', 'base', 'basefont', 'bdi', 'bdo', 'big',
'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite',
'code', 'col', 'colgroup', 'command', 'datalist', 'dd', 'del', 'details', 'dfn',
'dialog', 'dir', 'div', 'dl', 'dt', 'em', 'embed', 'fieldset', 'figcaption',
'figure', 'font', 'footer', 'form', 'frame', 'frameset', 'h1', 'h2', 'h3', 'h4',
'h5', 'h6', 'head', 'header', 'hr', 'html', 'i', 'iframe', 'img', 'input', 'ins',
'kbd', 'keygen', 'label', 'legend', 'li', 'link', 'map', 'mark', 'menu', 'meta',
'meter', 'nav', 'noframes', 'noscript', 'object', 'ol', 'optgroup', 'option',
'output', 'p', 'param', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp',
'script', 'section', 'select', 'small', 'source', 'span', 'strike', 'strong', 'style',
'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'textarea', 'tfoot', 'th', 'thead',
'time', 'title', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr');
$content = G::sanitizeInput($content, $fields, array(), 0, 1, 0);
fwrite($fp, $content);
fclose($fp);
echo 'saved: ' . $sDirectory;
}
break;
case 'events':
$oProcessMap->eventsList($oData->pro_uid, $oData->type);