Skip to content

Commit

Permalink
5694 added various html...decode and stripslashes to cleanup output a…
Browse files Browse the repository at this point in the history 
…ffected by superglobal filtering
  • Loading branch information
@gregrgay
gregrgay committed Jul 2, 2016
1 parent 3fbb00a commit 4f5f4de
Show file tree
Hide file tree
Showing 5 changed files with 13 additions and 14 deletions.
16 changes: 8 additions & 8 deletions mods/_standard/patcher/classes/PatchCreator.class.php
View file
Expand Up @@ -84,8 +84,8 @@ function PatchCreator($patch_info_array, $patch_id)
{
$patch_info_array["files"][$i]["directory"] = addslashes($patch_info_array["files"][$i]["directory"]);
$patch_info_array["files"][$i]["upload_tmp_name"] = addslashes($patch_info_array["files"][$i]["upload_tmp_name"]);
$patch_info_array["files"][$i]["code_from"] = addslashes($patch_info_array["files"][$i]["code_from"]);
$patch_info_array["files"][$i]["code_to"] = addslashes($patch_info_array["files"][$i]["code_to"]);
$patch_info_array["files"][$i]["code_from"] = $patch_info_array["files"][$i]["code_from"];
$patch_info_array["files"][$i]["code_to"] = $patch_info_array["files"][$i]["code_to"];
}
}

Expand Down Expand Up @@ -211,8 +211,8 @@ function saveInfo()
$file_info["action"],
my_add_null_slashes($file_info["file_name"]),
my_add_null_slashes($file_info["directory"]),
my_add_null_slashes($file_info["code_from"]),
my_add_null_slashes($file_info["code_to"]),
my_add_null_slashes(htmlspecialchars_decode($file_info["code_from"])),
my_add_null_slashes(htmlspecialchars_decode($file_info["code_to"])),
my_add_null_slashes($upload_to)), FALSE, FALSE);
}
}
Expand Down Expand Up @@ -267,8 +267,8 @@ function createXML()
{
$action_details .= str_replace(array('{TYPE}', '{CODE_FROM}', '{CODE_TO}'),
array('replace',
htmlspecialchars(stripslashes($file_info["code_from"]), ENT_QUOTES),
htmlspecialchars(stripslashes($file_info["code_to"]), ENT_QUOTES)),
htmlspecialchars(stripslashes($file_info["code_from"]), ENT_QUOTES, $double_encode =false),
htmlspecialchars(stripslashes($file_info["code_to"]), ENT_QUOTES, $double_encode =false)),
$patch_action_detail_xml);
}

Expand All @@ -287,8 +287,8 @@ function createXML()
'{FILES}'),
array($this->patch_info_array["atutor_patch_id"],
$this->patch_info_array["atutor_version_to_apply"],
htmlspecialchars(stripslashes($this->htmlNewLine($this->patch_info_array["description"])), ENT_QUOTES),
htmlspecialchars(stripslashes($this->patch_info_array["sql_statement"]), ENT_QUOTES),
htmlspecialchars_decode(stripslashes($this->htmlNewLine($this->patch_info_array["description"])), ENT_QUOTES),
htmlspecialchars_decode(stripslashes($this->patch_info_array["sql_statement"]), ENT_QUOTES),
$dependent_patches,
$xml_files),
$patch_xml);
Expand Down
1 change: 0 additions & 1 deletion mods/_standard/patcher/include/common.inc.php
View file
Expand Up @@ -132,7 +132,6 @@ function is_patch_installed($patch_id)
" and applied_version = '%s'".
" and status like '%%Installed'";
$row = queryDB($sql,array(TABLE_PREFIX, $patch_id, VERSION), TRUE);


if ($row["num_of_installed"] > 0) return true;
else return false;
Expand Down
2 changes: 1 addition & 1 deletion mods/_standard/patcher/myown_patches.php
View file
Expand Up @@ -80,7 +80,7 @@
<td width="10"><input type="radio" name="myown_patch_id" value="<?php echo $row['myown_patch_id']; ?>" id="m<?php echo $row['myown_patch_id']; ?>" <?php if ($row['myown_patch_id']==$_POST['myown_patch_id']) echo 'checked'; ?> /></td>
<td><label for="m<?php echo $row['myown_patch_id']; ?>"><?php echo $row['atutor_patch_id']; ?></label></td>
<td class="hidecol700"><?php echo $row['applied_version']; ?></td>
<td><?php echo $row['description']; ?></td>
<td><?php echo htmlspecialchars_decode(stripslashes($row['description'])); ?></td>
<td class="hidecol700"><?php echo $row['last_modified']; ?></td>
</tr>
<?php
Expand Down
4 changes: 2 additions & 2 deletions mods/_standard/patcher/patch_creator.php
View file
Expand Up @@ -111,8 +111,8 @@ function sanitizeDir($dir) {
$patch_info["files"][] = array("action"=>$action,
"file_name"=>$_POST['alter_filename'][$i],
"directory"=>$_POST['alter_dir'][$i],
"code_from"=>$_POST['alter_code_from'][$i],
"code_to"=>$_POST['alter_code_to'][$i]);
"code_from"=>htmlspecialchars_decode(stripslashes($_POST['alter_code_from'][$i])),
"code_to"=>htmlspecialchars_decode(stripslashes($_POST['alter_code_to'][$i])));
}

if ($action == "delete" && $_POST['delete_filename'][$i] <> "") {
Expand Down
4 changes: 2 additions & 2 deletions mods/_standard/patcher/patch_edit_interface.tmpl.php
View file
Expand Up @@ -36,12 +36,12 @@

<div class="row">
<label for="description"><?php echo _AT('description'); ?></label><br />
<textarea id="description" name="description" cols="40" rows="4"><?php echo $row_patches['description']; ?></textarea><br />
<textarea id="description" name="description" cols="40" rows="4"><?php echo htmlspecialchars_decode(stripslashes($row_patches['description'])); ?></textarea><br />
</div>

<div class="row">
<label for="sql_statement"><?php echo _AT('sql_statement'); ?></label><br />
<textarea id="sql_statement" name="sql_statement" cols="40" rows="8"><?php echo $row_patches['sql_statement']; ?></textarea><br />
<textarea id="sql_statement" name="sql_statement" cols="40" rows="8"><?php echo htmlspecialchars_decode(stripslashes($row_patches['sql_statement'])); ?></textarea><br />
</div>

<div class="row">
Expand Down

2 comments on commit 4f5f4de

@akehsanz
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

patch system is one by one in Atutor, what is this??
it really takes a lot of time just to patch !!
suggestion for next update: how about multiple ticks & install patches ??
(does it not make like easy??)

@atutor
Copy link
Owner

@atutor atutor commented on 4f5f4de Jun 6, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not relate to this particular commit.

Please sign in to comment.