Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport security fixes for 8.5 #11765

Merged
merged 3 commits into from Nov 10, 2023
Merged

Backport security fixes for 8.5 #11765

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1fbe6f2
Backport security fix for layout sanitization
aembler Nov 9, 2023
3c7b8e6
Fix conflict
aembler Nov 10, 2023
c770ca0
validateaction on event delete
aembler Nov 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 2 additions & 1 deletion concrete/controllers/dialog/area/layout/presets.php
View file
Open in desktop
Expand Up @@ -32,7 +32,7 @@ public function view($arLayoutID)
$presets = array();
$presets['-1'] = t('** New');
foreach ($presetlist as $preset) {
$presets[$preset->getAreaLayoutPresetID()] = $preset->getAreaLayoutPresetName();
$presets[$preset->getAreaLayoutPresetID()] = h($preset->getAreaLayoutPresetName());
}

$this->set('arLayout', $arLayout);
Expand Down Expand Up @@ -64,6 +64,7 @@ public function getPresetData($cID, $arLayoutPresetID)
public function submit($arLayoutID)
{
if ($this->validateAction()) {
$existingPreset = null;
$arLayout = AreaLayout::getByID($arLayoutID);
if (!is_object($arLayout)) {
throw new Exception(t('Invalid layout object.'));
Expand Down
71 changes: 38 additions & 33 deletions concrete/controllers/dialog/event/delete.php
View file
Open in desktop
Expand Up @@ -38,42 +38,47 @@ public function __construct()

public function submit()
{
$event = $this->eventService->getByID($_REQUEST['eventID'], EventService::EVENT_VERSION_RECENT);
$e = \Core::make('error');
if (!$event) {
$e->add(t('Invalid event.'));
}
if (!$this->canAccess()) {
$e->add(t('Access Denied.'));
}
if ($this->validateAction()) {
$event = $this->eventService->getByID($_REQUEST['eventID'], EventService::EVENT_VERSION_RECENT);
$e = \Core::make('error');
if (!$event) {
$e->add(t('Invalid event.'));
}
if (!$this->canAccess()) {
$e->add(t('Access Denied.'));
}

$r = new EditResponse($e);
$year = date('Y');
$month = date('m');
$r->setRedirectURL(
\URL::to(
$this->preferences->getPreferredViewPath(),
'view',
$event->getCalendar()->getID(),
$year,
$month
)
);

if (!$e->has()) {
$u = $this->app->make(User::class);
$pkr = new DeleteCalendarEventRequest();
$pkr->setCalendarEventVersionID($event->getRecentVersion()->getID());
$pkr->setRequesterUserID($u->getUserID());
$response = $pkr->trigger();
if ($response instanceof Response) {
$this->flash('success', t('Event deleted successfully.'));
} else {
$this->flash('success', t('Event deletion pending. This request must be approved before the event is fully removed.'));
$r = new EditResponse($e);
$year = date('Y');
$month = date('m');
$r->setRedirectURL(
\URL::to(
$this->preferences->getPreferredViewPath(),
'view',
$event->getCalendar()->getID(),
$year,
$month
)
);

if (!$e->has()) {
$u = $this->app->make(User::class);
$pkr = new DeleteCalendarEventRequest();
$pkr->setCalendarEventVersionID($event->getRecentVersion()->getID());
$pkr->setRequesterUserID($u->getUserID());
$response = $pkr->trigger();
if ($response instanceof Response) {
$this->flash('success', t('Event deleted successfully.'));
} else {
$this->flash(
'success',
t('Event deletion pending. This request must be approved before the event is fully removed.')
);
}
}
}

$r->outputJSON();
$r->outputJSON();
}
}


Expand Down
8 changes: 4 additions & 4 deletions concrete/views/dialogs/area/layout/presets/manage.php
View file
Open in desktop
Expand Up @@ -10,19 +10,19 @@
<ul class="item-select-list">
<?php foreach ($presets as $preset) {
?>
<li data-preset-row="<?=$preset->getAreaLayoutPresetID()?>"><span><?=$preset->getAreaLayoutPresetName()?>
<li data-preset-row="<?=$preset->getAreaLayoutPresetID()?>"><span><?=h($preset->getAreaLayoutPresetName())?>
<a href="javascript:void(0)" class="pull-right icon-link delete-area-layout-preset" data-action="delete-area-layout-preset"><i class="fa fa-trash-o"></i></a>
</span></li>
<?php
<?php
}
?>
</ul>

<?php
<?php
} else {
?>
<p><?=t('You have no presets.')?></p>
<?php
<?php
} ?>


Expand Down