Fixed issue #8157: Pasting tokens with leading whitespace-caracters l…

…eads to various problems
LimeSurvey · Sep 26, 2013 · 331518d · 331518d
1 parent 2f450a1
commit 331518d
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/application/controllers/survey/index.php b/application/controllers/survey/index.php
@@ -447,7 +447,7 @@ function sendreq(surveyid)
         isset($_SESSION['survey_'.$surveyid]['step']) && $_SESSION['survey_'.$surveyid]['step']>0 && tableExists("tokens_{$surveyid}}}"))
         {
             //check if tokens actually haven't been already used
-            $areTokensUsed = usedTokens(trim(strip_tags(returnGlobal('token',true))),$surveyid);
+            $areTokensUsed = usedTokens(returnGlobal('token',true),$surveyid);
             // check if token actually does exist
             // check also if it is allowed to change survey after completion
             if ($thissurvey['alloweditaftercompletion'] == 'Y' ) {

diff --git a/application/helpers/frontend_helper.php b/application/helpers/frontend_helper.php
@@ -1431,9 +1431,9 @@ function buildsurveysession($surveyid,$preview=false)
         //check if token actually does exist
         // check also if it is allowed to change survey after completion
         if ($thissurvey['alloweditaftercompletion'] == 'Y' ) {
-            $oTokenEntry = Tokens_dynamic::model($surveyid)->find('token=:token', array(':token'=>trim(strip_tags($clienttoken))));
+            $oTokenEntry = Tokens_dynamic::model($surveyid)->find('token=:token', array(':token'=>$clienttoken));
         } else {
-            $oTokenEntry = Tokens_dynamic::model($surveyid)->find("token=:token AND (completed = 'N' or completed='')", array(':token'=>trim(strip_tags($clienttoken))));
+            $oTokenEntry = Tokens_dynamic::model($surveyid)->find("token=:token AND (completed = 'N' or completed='')", array(':token'=>$clienttoken));
         }
 
         if (is_null($oTokenEntry) ||  ($areTokensUsed && $thissurvey['alloweditaftercompletion'] != 'Y') )