From 2fd21671f150f0bcfe09e073622925b5ec2bc892 Mon Sep 17 00:00:00 2001 From: Carsten Schmitz Date: Fri, 27 Jul 2012 11:26:44 +0200 Subject: [PATCH 1/8] Fixed issue #6066: File upload fails if single oder double quotes are used --- .../helpers/expressions/em_manager_helper.php | 6 +++++ scripts/uploader.js | 22 ++++++++++++++----- 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/application/helpers/expressions/em_manager_helper.php b/application/helpers/expressions/em_manager_helper.php index bf15c992488..ce5f7cafad3 100644 --- a/application/helpers/expressions/em_manager_helper.php +++ b/application/helpers/expressions/em_manager_helper.php @@ -4554,6 +4554,12 @@ private function _UpdateValuesInDatabase($updatedValues, $finished=false) } // otherwise will already be in yyyy-mm-dd format after ProcessCurrentResponses() break; + case '|': //File upload + // This block can be removed once we require 5.3 or later + if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) { + $val=addslashes($val); + } + break; case 'N': //NUMERICAL QUESTION TYPE case 'K': //MULTIPLE NUMERICAL QUESTION if (trim($val)=='') { diff --git a/scripts/uploader.js b/scripts/uploader.js index c393cbcc4f2..c04d3225254 100644 --- a/scripts/uploader.js +++ b/scripts/uploader.js @@ -28,11 +28,11 @@ $(document).ready(function(){ previewblock += ""; if ($('#'+fieldname+'_show_title').val() == 1 && $('#'+fieldname+'_show_comment').val() == 1) - previewblock += "



"; + previewblock += "



"; else if ($('#'+fieldname+'_show_title').val() == 1) - previewblock += ""; + previewblock += ""; else if ($('#'+fieldname+'_show_comment').val() == 1) - previewblock += ""; + previewblock += ""; previewblock += ""+ ""+ @@ -202,7 +202,7 @@ function passJSON(fieldname, show_title, show_comment, pos) { var i = 1; while (i <= licount) { - + if ($("#"+fieldname+"_li_"+i).is(':visible')) { if (filecount > 0) @@ -210,9 +210,9 @@ function passJSON(fieldname, show_title, show_comment, pos) { json += '{'; if ($("#"+fieldname+"_show_title").val() == 1) - json += '"title":"' +$("#"+fieldname+"_title_" +i).val()+'",'; + json += '"title":"' +$("#"+fieldname+"_title_" +i).val().replace(/"/g, '\"')+'",'; if ($("#"+fieldname+"_show_comment").val() == 1) - json += '"comment":"'+$("#"+fieldname+"_comment_"+i).val()+'",'; + json += '"comment":"'+$("#"+fieldname+"_comment_"+i).val().replace(/"/g, '\"')+'",'; json += '"size":"' +$("#"+fieldname+"_size_" +i).val()+'",'+ '"name":"' +$("#"+fieldname+"_name_" +i).val()+'",'+ '"filename":"' +$("#"+fieldname+"_filename_" +i).val()+'",'+ @@ -297,3 +297,13 @@ function deletefile(fieldname, count) { xmlhttp.open('GET',uploadurl+'/delete/1/fieldname/'+fieldname+'/filename/'+filename+'/name/'+encodeURI(name), true); xmlhttp.send(); } + + +function escapeHtml(unsafe) { + return unsafe + .replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} From 0521fbf65a64bf5f08d7ba8bcf3f166bce13267c Mon Sep 17 00:00:00 2001 From: Carsten Schmitz Date: Fri, 27 Jul 2012 12:40:38 +0200 Subject: [PATCH 2/8] Fixed issue: Survey breaking if configured template does not exist --- application/controllers/OptinController.php | 2 +- application/controllers/OptoutController.php | 4 +- .../controllers/RegisterController.php | 2 +- application/controllers/survey/index.php | 29 +++---- application/helpers/SurveyRuntimeHelper.php | 50 ++++++------ application/helpers/common_helper.php | 34 ++++---- application/helpers/frontend_helper.php | 78 ++++++++++--------- application/helpers/qanda_helper.php | 6 +- application/helpers/replacements_helper.php | 2 +- application/libraries/Load_answers.php | 8 +- application/libraries/Save.php | 9 ++- .../views/admin/dataentry/content_view.php | 2 +- 12 files changed, 116 insertions(+), 110 deletions(-) diff --git a/application/controllers/OptinController.php b/application/controllers/OptinController.php index f9fbe1c15ec..b9d2a8fb89d 100644 --- a/application/controllers/OptinController.php +++ b/application/controllers/OptinController.php @@ -93,7 +93,7 @@ function actionLocal($surveyid, $token, $langcode = '') //PRINT COMPLETED PAGE if (!$thissurvey['templatedir']) { - $thistpl=getTemplatePath($defaulttemplate); + $thistpl=getTemplatePath(Yii::app()->getConfig("defaulttemplate")); } else { diff --git a/application/controllers/OptoutController.php b/application/controllers/OptoutController.php index 960e3e055be..e466fc6a9e6 100644 --- a/application/controllers/OptoutController.php +++ b/application/controllers/OptoutController.php @@ -96,7 +96,7 @@ function actiontokens() //PRINT COMPLETED PAGE if (!$thissurvey['templatedir']) { - $thistpl=getTemplatePath($defaulttemplate); + $thistpl=getTemplatePath(Yii::app()->getConfig("defaulttemplate")); } else { @@ -196,7 +196,7 @@ function actionparticipants() //PRINT COMPLETED PAGE if (!$thissurvey['templatedir']) { - $thistpl=getTemplatePath($defaulttemplate); + $thistpl=getTemplatePath(Yii::app()->getConfig("defaulttemplate")); } else { diff --git a/application/controllers/RegisterController.php b/application/controllers/RegisterController.php index 0dad4b36045..f54e5e1e2a6 100644 --- a/application/controllers/RegisterController.php +++ b/application/controllers/RegisterController.php @@ -29,9 +29,9 @@ function actionAJAXRegisterForm Yii::app()->loadHelper('database'); Yii::app()->loadHelper('replacements'); $redata = compact(array_keys(get_defined_vars())); - $thistpl = Yii::app()->getConfig("standardtemplaterootdir").'/default'; $surveyid = sanitize_int($surveyid); $row = Survey::model()->find('sid=:sid',array(':sid' => $surveyid)) or show_error("Can't find survey data"); + $thistpl=getTemplatePath(validateTemplateDir($row->template)); $data['sid'] = $surveyid; $data['startdate'] = $row->startdate; $data['enddate'] = $row->expires; diff --git a/application/controllers/survey/index.php b/application/controllers/survey/index.php index c3b06110ee1..a44aebf84a5 100644 --- a/application/controllers/survey/index.php +++ b/application/controllers/survey/index.php @@ -20,7 +20,7 @@ public function run() function action() { - global $surveyid, $thistpl, $totalquestions; + global $surveyid, $totalquestions; global $thissurvey, $thisstep; global $clienttoken, $tokensexist, $token; $clang = Yii::app()->lang; @@ -160,10 +160,7 @@ function action() $sDisplayLanguage = Yii::app()->getConfig('defaultlang'); } $clang = $this->_loadLimesurveyLang($sDisplayLanguage); - if(!isset($defaulttemplate)) - { - $defaulttemplate=Yii::app()->getConfig("defaulttemplate"); - } + $languagechanger = makeLanguageChanger($sDisplayLanguage); //Find out if there are any publicly available surveys $query = "SELECT sid, surveyls_title, publicstatistics, language @@ -276,24 +273,23 @@ function action() "list"=>implode("\n",$list), ); - $thissurvey['templatedir'] = $defaulttemplate; $data['thissurvey'] = $thissurvey; //$data['privacy'] = $privacy; $data['surveylist'] = $surveylist; $data['surveyid'] = $surveyid; - $data['templatedir'] = getTemplatePath($defaulttemplate); - $data['templateurl'] = getTemplateURL($defaulttemplate)."/"; - $data['templatename'] = $defaulttemplate; + $data['templatedir'] = getTemplatePath(Yii::app()->getConfig("defaulttemplate")); + $data['templateurl'] = getTemplateURL(Yii::app()->getConfig("defaulttemplate"))."/"; + $data['templatename'] = Yii::app()->getConfig("defaulttemplate"); $data['sitename'] = Yii::app()->getConfig("sitename"); $data['languagechanger'] = $languagechanger; //A nice exit sendCacheHeaders(); doHeader(); - $this->_printTemplateContent(getTemplatePath($defaulttemplate)."/startpage.pstpl", $data, __LINE__); + $this->_printTemplateContent(getTemplatePath(Yii::app()->getConfig("defaulttemplate"))."/startpage.pstpl", $data, __LINE__); - $this->_printTemplateContent(getTemplatePath($defaulttemplate)."/surveylist.pstpl", $data, __LINE__); + $this->_printTemplateContent(getTemplatePath(Yii::app()->getConfig("defaulttemplate"))."/surveylist.pstpl", $data, __LINE__); echo '\n\n"; echo "
\n"; - echo templatereplace(file_get_contents("$thistpl/load.pstpl"),array(),$redata); + echo templatereplace(file_get_contents($sTemplatePath."load.pstpl"),array(),$redata); //PRESENT OPTIONS SCREEN (Replace with Template Later) //END echo "\n"; @@ -41,7 +41,7 @@ function run($args) { } echo "
"; - echo templatereplace(file_get_contents("$thistpl/endpage.pstpl"),array(),$redata); + echo templatereplace(file_get_contents($sTemplatePath."endpage.pstpl"),array(),$redata); doFooter(); exit; diff --git a/application/libraries/Save.php b/application/libraries/Save.php index e7083da2399..771970758bb 100644 --- a/application/libraries/Save.php +++ b/application/libraries/Save.php @@ -58,11 +58,12 @@ class Save { function showsaveform() { //Show 'SAVE FORM' only when click the 'Save so far' button the first time, or when duplicate is found on SAVE FORM. - global $thistpl, $errormsg, $thissurvey, $surveyid, $clang, $clienttoken, $thisstep; + global $errormsg, $thissurvey, $surveyid, $clang, $clienttoken, $thisstep; $redata = compact(array_keys(get_defined_vars())); + $sTemplatePath=$_SESSION['survey_'.$surveyid]['templatepath']; sendCacheHeaders(); doHeader(); - echo templatereplace(file_get_contents("$thistpl/startpage.pstpl"),array(),$redata); + echo templatereplace(file_get_contents($sTemplatePath."startpage.pstpl"),array(),$redata); echo "\n\n\n" ."\t