Skip to content
This repository was archived by the owner on Sep 10, 2021. It is now read-only.

Commit 77eff8d

Browse files
author
Jamie Snape
committed
Escape variables in remoteprocessing module
1 parent 91034f6 commit 77eff8d

File tree

10 files changed

+50
-97
lines changed

10 files changed

+50
-97
lines changed

‎modules/remoteprocessing/Notification.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -96,15 +96,15 @@ public function getActionMenu($params)
9696
$html = "<li>
9797
<a href='".Zend_Registry::get(
9898
'webroot'
99-
)."/remoteprocessing/executable/define/?itemId=".$params['item']->getKey(
99+
)."/remoteprocessing/executable/define/?itemId=".htmlspecialchars($params['item']->getKey(), ENT_QUOTES, 'UTF-8'
100100
)."'><img alt='' src='".Zend_Registry::get(
101101
'coreWebroot'
102102
)."/public/images/icons/xml.png'/> ".$this->t('Define Executable')."</a>
103103
</li>
104104
<li>
105105
<a href='".Zend_Registry::get(
106106
'webroot'
107-
)."/remoteprocessing/job/init/?itemId=".$params['item']->getKey(
107+
)."/remoteprocessing/job/init/?itemId=".htmlspecialchars($params['item']->getKey(), ENT_QUOTES, 'UTF-8'
108108
)."'><img alt='' src='".Zend_Registry::get(
109109
'coreWebroot'
110110
)."/public/images/icons/job.png'/> ".$this->t('Create a Job')."</a>
@@ -158,10 +158,10 @@ public function getItemInfo($params)
158158
}
159159

160160
$html .= "<li>";
161-
$html .= "<a element='".$item->getKey()."' href='".Zend_Registry::get(
161+
$html .= "<a element='".htmlspecialchars($item->getKey(), ENT_QUOTES, 'UTF-8')."' href='".Zend_Registry::get(
162162
'webroot'
163-
)."/item/".$item->getKey()."'>".$component->slicename(
164-
$item->getName(),
163+
)."/item/".htmlspecialchars($item->getKey(), ENT_QUOTES, 'UTF-8')."'>".$component->slicename(
164+
htmlspecialchars($item->getName(), ENT_QUOTES, 'UTF-8'),
165165
25
166166
)."</a>";
167167
$html .= "</li>";
@@ -187,9 +187,9 @@ public function getItemInfo($params)
187187
$name = $job->getCreationDate();
188188
}
189189
$html .= "<li>";
190-
$html .= "<a element='".$job->getKey()."' href='".Zend_Registry::get(
190+
$html .= "<a element='".htmlspecialchars($job->getKey(), ENT_QUOTES, 'UTF-8')."' href='".Zend_Registry::get(
191191
'webroot'
192-
)."/remoteprocessing/job/view/?jobId=".$job->getKey()."'>".$name."</a>";
192+
)."/remoteprocessing/job/view/?jobId=".htmlspecialchars($job->getKey(), ENT_QUOTES, 'UTF-8')."'>".htmlspecialchars($name, ENT_QUOTES, 'UTF-8')."</a>";
193193
$html .= "</li>";
194194
if ($i > 3) {
195195
$html .= "<li>...</li>";

‎modules/remoteprocessing/controllers/IndexController.php‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,4 @@ public function selectactionAction()
2626
{
2727
$this->disableLayout();
2828
}
29-
30-
/** dashboard */
31-
public function dashboardAction()
32-
{
33-
}
3429
}

‎modules/remoteprocessing/public/js/index/index.selectaction.js‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@
33
$('img#processButtonImg').show();
44
$('img#processButtonLoadiing').hide();
55

6-
$('#blockDashboardLink').click(function () {
7-
'use strict';
8-
window.location.replace($('.webroot').val() + '/remoteprocessing/index/dashboard');
9-
});
106
$('#blockManageScheduledLink').click(function () {
117
'use strict';
128
window.location.replace($('.webroot').val() + '/remoteprocessing/job/manage');

‎modules/remoteprocessing/views/executable/define.phtml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ if ($this->isAjax) {
3232
<?php
3333
if (!$this->isAjax) {
3434
echo '<div style="float:right;margin-right:2px;" class="genericBigButton ">';
35-
echo "<a href='{$this->webroot}/item/{$this->itemDao->getKey(
36-
)}'><img style='float:left;margin-right:2px;' alt='' src='{$this->coreWebroot}/public/images/icons/back.png'/>";
35+
echo "<a href='{$this->webroot}/item/{$this->escape($this->itemDao->getKey(
36+
))}'><img style='float:left;margin-right:2px;' alt='' src='{$this->coreWebroot}/public/images/icons/back.png'/>";
3737
echo $this->t('Back');
3838
echo "</a>";
3939
echo '</div>';
@@ -44,7 +44,7 @@ if ($this->isAjax) {
4444
</div>
4545

4646
This page allow you to define the execution options of the item:
47-
<b><?php echo $this->itemDao->getName() ?></b>.<br/>These option are used to defined how the MIDAS Platform will use
47+
<b><?php echo $this->escape($this->itemDao->getName()); ?></b>.<br/>These option are used to defined how the Midas Platform will use
4848
the item to create remote processing tasks.
4949
<br/>
5050
<br/>
@@ -75,4 +75,4 @@ if ($this->isAjax) {
7575
</div>
7676

7777
<div id="jsonMetadataContent"><?php echo $this->jsonMetadata ?></div>
78-
<input type="hidden" id="itemIdExecutable" value="<?php echo $this->itemDao->getKey() ?>"/>
78+
<input type="hidden" id="itemIdExecutable" value="<?php echo $this->escape($this->itemDao->getKey()); ?>"/>

‎modules/remoteprocessing/views/index/dashboard.phtml‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎modules/remoteprocessing/views/index/selectaction.phtml‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -31,21 +31,6 @@
3131
</div>
3232
<br/>
3333

34-
<div class="blockSet" id="blockDashboardLink">
35-
<table>
36-
<tbody>
37-
<tr>
38-
<td class="logo">
39-
<img alt="" src="<?php echo $this->moduleWebroot ?>/public/images/bigicon-dashboard.png"/>
40-
</td>
41-
<td>
42-
<h4>Access your dashboard</h4>
43-
<span style="color:grey;">The dasboard shows the results and the status of your jobs.</span>
44-
</td>
45-
</tr>
46-
</tbody>
47-
</table>
48-
</div>
4934
<div class="blockSet" id="blockManageScheduledLink">
5035
<table>
5136
<tbody>

‎modules/remoteprocessing/views/job/getinitexecutable.phtml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,15 @@
2121
$i = 0;
2222
foreach ($this->metaContent->option as $option) {
2323
if (isset($option->field) && isset($option->field->required) && $option->field->required == 1) {
24-
echo "<div id='option_".$i."' name='".htmlentities(
24+
echo "<div id='option_".$i."' name='".$this->escape(
2525
ucfirst($option->name)
26-
)."' class='optionWrapper' isrequired ='true' tag='".htmlentities($option->tag)."'>";
27-
echo "<h4>".ucfirst($option->name)." (required)</h4>";
26+
)."' class='optionWrapper' isrequired ='true' tag='".$this->escape($option->tag)."'>";
27+
echo "<h4>".$this->escape(ucfirst($option->name))." (required)</h4>";
2828
} else {
29-
echo "<div id='option_".$i."' name='".htmlentities(
29+
echo "<div id='option_".$i."' name='".$this->escape(
3030
ucfirst($option->name)
31-
)."' class='optionWrapper' tag='".htmlentities($option->tag)."'>";
32-
echo "<h4>".ucfirst($option->name)."</h4>";
31+
)."' class='optionWrapper' tag='".$this->escape($option->tag)."'>";
32+
echo "<h4>".$this->escape(ucfirst($option->name))."</h4>";
3333
}
3434

3535
$type = 'inputParam';
@@ -66,6 +66,6 @@ function elementInputFile($i, $option, $scheduled)
6666
function elementInputParam($i, $option)
6767
{
6868
echo "Value (".ucfirst(
69-
$option->field->type
70-
)."): <input variable='".$option->field->type."' type='text' qtip='Example multiple values: <b>5;6;9</b><br/>Example range with a step of 0.5: <b>5-10(0.5)</b>' class='valueInputOption'/>";
69+
htmlspecialchars($option->field->type, ENT_QUOTES, 'UTF-8')
70+
)."): <input variable='".htmlspecialchars($option->field->type, ENT_QUOTES, 'UTF-8')."' type='text' qtip='Example multiple values: <b>5;6;9</b><br/>Example range with a step of 0.5: <b>5-10(0.5)</b>' class='valueInputOption'/>";
7171
}

‎modules/remoteprocessing/views/job/init.phtml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,9 @@ $this->headScript()->appendFile($this->coreWebroot.'/public/js/jquery/jquery.sma
8888
</div>
8989
<br/><br/>
9090
<b>Selected Item:</b>
91-
<span id="selectedExecutable"><?php echo (isset($this->itemDao)) ? $this->itemDao->getName() : 'None' ?></span>
91+
<span id="selectedExecutable"><?php echo (isset($this->itemDao)) ? $this->escape($this->itemDao->getName()) : 'None' ?></span>
9292
<input type="hidden" id="selectedExecutableId"
93-
value="<?php echo (isset($this->itemDao)) ? $this->itemDao->getKey() : '' ?>"/>
93+
value="<?php echo (isset($this->itemDao)) ? $this->escape($this->itemDao->getKey()) : '' ?>"/>
9494

9595
<div id="metaWrapper">
9696
<h3>Meta information</h3>

‎modules/remoteprocessing/views/job/manage.phtml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,9 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/job/job.manage.
5555
</thead>
5656
<?php
5757
foreach ($this->relatedJobs as $job) {
58-
echo "<tr element='".$job->getKey()."v'>";
59-
echo "<td>".$job->getName()."</td>";
60-
echo "<td>".$job->getCreationDate()."</td>";
58+
echo "<tr element='".$this->escape($job->getKey())."v'>";
59+
echo "<td>".$this->escape($job->getName())."</td>";
60+
echo "<td>".$this->escape($job->getCreationDate())."</td>";
6161
if ($job->getStatus() == MIDAS_REMOTEPROCESSING_STATUS_DONE) {
6262
echo "<td class='elementStatus'>Done</td>";
6363
} else {
@@ -104,9 +104,9 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/job/job.manage.
104104
<?php
105105
foreach ($this->scheduledJobs as $job) {
106106
$params = JsonComponent::decode($job->getParams());
107-
echo "<tr element='".$job->getKey()."v'>";
108-
echo "<td>".$params['params']['job_name']."</td>";
109-
echo "<td>".$job->getFireTime()."</td>";
107+
echo "<tr element='".$this->escape($job->getKey())."v'>";
108+
echo "<td>".$this->escape($params['params']['job_name'])."</td>";
109+
echo "<td>".$this->escape($job->getFireTime())."</td>";
110110
echo "<td>Scheduled</td>";
111111
echo "</tr>";
112112
}

‎modules/remoteprocessing/views/job/view.phtml‎

Lines changed: 23 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -57,21 +57,21 @@ if ($this->job->getStatus() == MIDAS_REMOTEPROCESSING_STATUS_DONE) {
5757
}
5858
?>
5959

60-
<h4>Job Status: <?php echo $jobStatus ?></h4>
60+
<h4>Job Status: <?php echo $this->escape($jobStatus); ?></h4>
6161

6262
<?php
6363
if ($this->executable != false) {
6464
?>
6565
<h4>Executable:
66-
<a href="<?php echo $this->webroot ?>/item/<?php echo $this->executable->getKey(
67-
) ?>"><?php echo $this->executable->getName() ?></a>
66+
<a href="<?php echo $this->webroot ?>/item/<?php echo $this->escape($this->executable->getKey(
67+
)); ?>"><?php echo $this->escape($this->executable->getName()); ?></a>
6868
</h4>
6969
<?php
7070
}
7171
if ($this->log != false) {
7272
?>
7373
<a id="showLogLink">Toggle raw xml results</a><br/>
74-
<pre id="hiddenLog"><?php echo htmlentities($this->log) ?></pre>
74+
<pre id="hiddenLog"><?php echo $this->escape($this->log) ?></pre>
7575

7676
<h4>Results and Metrics grid:</h4>
7777
<table id="tableXml">
@@ -109,29 +109,29 @@ if ($this->log != false) {
109109
foreach ($this->results['params']['parametersList'] as $key => $parameter) {
110110
if (isset($result['parameters'][$key]) && isset($this->inputs[trim($result['parameters'][$key])])
111111
) {
112-
echo "<td><a href='".$this->webroot."/item/".$this->inputs[trim(
112+
echo "<td><a href='".$this->webroot."/item/".$this->escape($this->inputs[trim(
113113
$result['parameters'][$key]
114-
)]->getKey()."' elementItem='".$this->inputs[trim($result['parameters'][$key])]->getKey(
115-
)."'>".$this->slicename(
116-
$result['parameters'][$key],
114+
)]->getKey())."' elementItem='".$this->escape($this->inputs[trim($result['parameters'][$key])]->getKey(
115+
))."'>".$this->slicename(
116+
$this->escape($result['parameters'][$key]),
117117
15
118118
)."</a></td>";
119119
} else {
120120
if (isset($result['parameters'][$key])) {
121-
echo "<td>".$this->slicename($result['parameters'][$key], 15)."</td>";
121+
echo "<td>".$this->slicename($this->escape($result['parameters'][$key]), 15)."</td>";
122122
} else {
123123
echo "<td></td>";
124124
}
125125
}
126126
}
127-
echo "<td class='xmlStatus'>".$result['status']."</td>";
127+
echo "<td class='xmlStatus'>".$this->escape($result['status'])."</td>";
128128
echo "<td>".str_replace(' seconds', 's', $this->duration($result['time']))."</td>";
129-
echo "<td class='showInDialog' output='".htmlentities($result['stdout'])."'><a>".$this->slicename(
130-
htmlentities($result['stdout']),
129+
echo "<td class='showInDialog' output='".$this->escape($result['stdout'])."'><a>".$this->slicename(
130+
$this->escape($result['stdout']),
131131
15
132132
)."</a></td>";
133-
echo "<td class='showInDialog' output='".htmlentities($result['stderr'])."'><a>".$this->slicename(
134-
htmlentities($result['stderr']),
133+
echo "<td class='showInDialog' output='".$this->escape($result['stderr'])."'><a>".$this->slicename(
134+
$this->escape($result['stderr']),
135135
15
136136
)."</a></td>";
137137

@@ -169,7 +169,7 @@ if ($this->job->getStatus() == MIDAS_REMOTEPROCESSING_STATUS_DONE && !empty($thi
169169
echo "<th><b>Thumbnail</b></th>";
170170

171171
foreach ($this->parameters as $parameter) {
172-
echo "<th><b>".ucfirst($parameter)."</b></th>";
172+
echo "<th><b>".ucfirst($this->escape($parameter))."</b></th>";
173173
}
174174
?>
175175
</tr>
@@ -179,26 +179,26 @@ if ($this->job->getStatus() == MIDAS_REMOTEPROCESSING_STATUS_DONE && !empty($thi
179179
foreach ($this->outputs as $output) {
180180
echo "<tr>";
181181
$metadata = $output->metadataParameters;
182-
echo "<td><a href='".$this->webroot."/item/".$output->getKey()."' elementItem='".$output->getKey(
183-
)."'>".$output->getName()."</a></td>";
182+
echo "<td><a href='".$this->webroot."/item/".$this->escape($output->getKey())."' elementItem='".$this->escape($output->getKey(
183+
))."'>".$this->escape($output->getName())."</a></td>";
184184
$path = $output->getThumbnail();
185185
echo "<td>";
186186
if (!empty($path) && file_exists(BASE_PATH.'/'.$path)) {
187187
echo "
188-
<img class='infoLogo' alt='' src='{$this->webroot}/{$path}'/>
188+
<img class='infoLogo' alt='' src='{$this->webroot}/{$this->escape($path)}'/>
189189
";
190190
}
191191
echo "</td>";
192192
foreach ($this->parameters as $parameter) {
193193
if (isset($metadata[$parameter]) && isset($this->inputs[trim($metadata[$parameter])])
194194
) {
195-
echo "<td><a href='".$this->webroot."/item/".$this->inputs[trim(
195+
echo "<td><a href='".$this->webroot."/item/".$this->escape($this->inputs[trim(
196196
$metadata[$parameter]
197-
)]->getKey()."' elementItem='".$this->inputs[trim($metadata[$parameter])]->getKey(
198-
)."'>".$metadata[$parameter]."</a></td>";
197+
)]->getKey())."' elementItem='".$this->escape($this->inputs[trim($metadata[$parameter])]->getKey(
198+
))."'>".$this->escape($metadata[$parameter])."</a></td>";
199199
} else {
200200
if (isset($metadata[$parameter])) {
201-
echo "<td>".$metadata[$parameter]."</td>";
201+
echo "<td>".$this->escape($metadata[$parameter])."</td>";
202202
} else {
203203
echo "<td></td>";
204204
}
@@ -216,13 +216,12 @@ if ($this->job->getStatus() == MIDAS_REMOTEPROCESSING_STATUS_DONE && !empty($thi
216216
$itemsList .= $ouput->getKey().'-';
217217
}
218218
echo '<div class="genericBigButton ">';
219-
echo "<a href='{$this->webroot}/download?items={$itemsList}'><img style='float:left;margin-right:2px;' alt='' src='{$this->coreWebroot}/public/images/icons/download.png'/>";
219+
echo "<a href='{$this->webroot}/download?items={$this->escape($itemsList)}'><img style='float:left;margin-right:2px;' alt='' src='{$this->coreWebroot}/public/images/icons/download.png'/>";
220220
echo $this->t('Download Results');
221221
echo "</a>";
222222
echo '</div>';
223223
?>
224224
<?php
225225
}
226226
?>
227-
228227
</div>

0 commit comments

Comments
 (0)