Merge branch 'develop'

tecnickcom · May 6, 2020 · c179549 · c179549
2 parents a84d816 + 04cafe6
commit c179549
Show file tree

Hide file tree

Showing 44 changed files with 187 additions and 124 deletions.
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-14.2.2
+14.2.3
diff --git a/admin/code/tce_colorpicker.php b/admin/code/tce_colorpicker.php
@@ -96,6 +96,7 @@ function F_html_color_picker($callingform, $callingfield, $tag)
     $onclick = 'FJ_insert_tag(window.opener.document.getElementById(\''.$callingform.'\').'.$callingfield.', \'['.$tag.'=\'+document.getElementById(\'CSELECTED\').value+\']\');';
     echo '<input type="button" name="wclose" id="wclose" value="'.$l['w_close'].'" title="'.$l['h_close_window'].'" onclick="'.$onclick.'self.close();" />'.K_NEWLINE;
     echo '</div>'.K_NEWLINE;
+    echo F_getCSRFTokenField().K_NEWLINE;
     echo '</form>'.K_NEWLINE;
     echo '</div>'.K_NEWLINE;
 ?>

diff --git a/admin/code/tce_edit_answer.php b/admin/code/tce_edit_answer.php
@@ -2,7 +2,7 @@
 //============================================================+
 // File name   : tce_edit_answer.php
 // Begin       : 2004-04-27
-// Last Update : 2018-07-06
+// Last Update : 2020-05-06
 //
 // Description : Edit answers.
 //
@@ -15,7 +15,7 @@
 //               info@tecnick.com
 //
 // License:
-//    Copyright (C) 2004-2018 Nicola Asuni - Tecnick.com LTD
+//    Copyright (C) 2004-2020 Nicola Asuni - Tecnick.com LTD
 //    See LICENSE.TXT file for more information.
 //============================================================+
 
@@ -159,8 +159,7 @@
             // check user's authorization for parent module
             if ((!F_isAuthorizedUser(K_TABLE_MODULES, 'module_id', $m['subject_module_id'], 'module_user_id'))
                 and (!F_isAuthorizedUser(K_TABLE_SUBJECTS, 'subject_id', $m['question_subject_id'], 'subject_user_id'))) {
-                F_print_error('ERROR', $l['m_authorization_denied']);
-                    exit;
+                F_print_error('ERROR', $l['m_authorization_denied'], true);
             }
         }
     } else {
@@ -197,6 +196,7 @@
             <?php
             F_submit_button('forcedelete', $l['w_delete'], $l['h_delete']);
             F_submit_button('cancel', $l['w_cancel'], $l['h_cancel']);
+            echo F_getCSRFTokenField().K_NEWLINE;
             ?>
             </div>
             </form>
@@ -890,7 +890,7 @@
 echo '&nbsp;'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
-
+echo F_getCSRFTokenField().K_NEWLINE;
 echo '</form>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 

diff --git a/admin/code/tce_edit_backup.php b/admin/code/tce_edit_backup.php
@@ -2,7 +2,7 @@
 //============================================================+
 // File name   : tce_edit_backup.php
 // Begin       : 2009-04-06
-// Last Update : 2014-01-27
+// Last Update : 2020-05-06
 //
 // Description : Backup and Restore TCExam Database.
 //               ONLY FOR POSIX SYSTEMS
@@ -18,7 +18,7 @@
 //               info@tecnick.com
 //
 // License:
-//    Copyright (C) 2004-2014 Nicola Asuni - Tecnick.com LTD
+//    Copyright (C) 2004-2020 Nicola Asuni - Tecnick.com LTD
 //    See LICENSE.TXT file for more information.
 //============================================================+
 
@@ -52,14 +52,17 @@
     $menu_mode = 'download';
 }
 
+function F_isValidbackupFile($file)
+{
+    return ((strlen($file) === 35) and (substr($file, -3) === '.gz') and (preg_match('|\.\./|i', $file) === 0) and (preg_match('/[^a-zA-Z0-9\_\-\.]+/i', $file) === 0));
+}
+
 // check backup filename
-if (isset($backup_file) and !empty($backup_file)) {
-    if ((preg_match('/[^a-zA-Z0-9\_\-\.]+/i', $backup_file) > 0) or (strlen($backup_file) != 35) or (substr($backup_file, -3) != '.gz')) {
-        // ERROR
-        F_print_error('ERROR', 'SECURITY ERROR');
-    }
+if (!empty($backup_file) and !F_isValidbackupFile($backup_file)) {
+	F_print_error('ERROR', 'SECURITY ERROR', true);
 }
 
+
 switch ($menu_mode) { // process submitted data
 
     case 'restore':{
@@ -72,6 +75,7 @@
             F_submit_button('forcerestore', $l['w_restore'], $l['h_restore']);
             F_submit_button('cancel', $l['w_cancel'], $l['h_cancel']);
             echo '</div>'.K_NEWLINE;
+            echo F_getCSRFTokenField().K_NEWLINE;
             echo '</form>'.K_NEWLINE;
             echo '</div>'.K_NEWLINE;
         }
@@ -200,7 +204,7 @@
 // get backup files
 $files_list = array();
 while (false !== ($file = readdir($handle))) {
-    if (is_file(K_PATH_BACKUP.$file)) {
+    if (F_isValidbackupFile($file) and is_file(K_PATH_BACKUP.$file)) {
         $files_list[] = $file;
     }
 }
@@ -229,7 +233,7 @@
 }
 
 echo '</div>'.K_NEWLINE;
-
+echo F_getCSRFTokenField().K_NEWLINE;
 echo '</form>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 

diff --git a/admin/code/tce_edit_group.php b/admin/code/tce_edit_group.php
@@ -81,6 +81,7 @@
         F_submit_button('forcedelete', $l['w_delete'], $l['h_delete']);
         F_submit_button('cancel', $l['w_cancel'], $l['h_cancel']);
         echo '</div>'.K_NEWLINE;
+        echo F_getCSRFTokenField().K_NEWLINE;
         echo '</form>'.K_NEWLINE;
         echo '</div>'.K_NEWLINE;
         break;
@@ -254,7 +255,7 @@
 F_submit_button('clear', $l['w_clear'], $l['h_clear']);
 
 echo '</div>'.K_NEWLINE;
-
+echo F_getCSRFTokenField().K_NEWLINE;
 echo '</form>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 

diff --git a/admin/code/tce_edit_module.php b/admin/code/tce_edit_module.php
@@ -2,7 +2,7 @@
 //============================================================+
 // File name   : tce_edit_module.php
 // Begin       : 2008-11-28
-// Last Update : 2018-07-06
+// Last Update : 2020-05-06
 //
 // Description : Display form to edit modules.
 //
@@ -15,7 +15,7 @@
 //               info@tecnick.com
 //
 // License:
-//    Copyright (C) 2004-2018 Nicola Asuni - Tecnick.com LTD
+//    Copyright (C) 2004-2020 Nicola Asuni - Tecnick.com LTD
 //    See LICENSE.TXT file for more information.
 //============================================================+
 
@@ -61,8 +61,7 @@
     $module_id = intval($_REQUEST['module_id']);
     // check user's authorization for module
     if (!F_isAuthorizedUser(K_TABLE_MODULES, 'module_id', $module_id, 'module_user_id')) {
-        F_print_error('ERROR', $l['m_authorization_denied']);
-        exit;
+        F_print_error('ERROR', $l['m_authorization_denied'], true);
     }
 } else {
     $module_id = 0;
@@ -97,6 +96,7 @@
             <?php
             F_submit_button('forcedelete', $l['w_delete'], $l['h_delete']);
             F_submit_button('cancel', $l['w_cancel'], $l['h_cancel']);
+            echo F_getCSRFTokenField().K_NEWLINE;
             ?>
             </div>
             </form>
@@ -329,7 +329,7 @@
     $sql = 'SELECT user_id, user_lastname, user_firstname, user_name FROM '.K_TABLE_USERS.' WHERE user_id='.$module_user_id.'';
     if ($r = F_db_query($sql, $db)) {
         if ($m = F_db_fetch_array($r)) {
-            echo '<span style="font-style:italic;color:#333333;">('.$m['user_name'].') '.$m['user_lastname'].' '.$m['user_firstname'].'</span>'.K_NEWLINE;
+            echo '<span style="font-style:italic;color:#333333;">('.unhtmlentities(strip_tags($m['user_name'].') '.$m['user_lastname'].' '.$m['user_firstname'])).'</span>'.K_NEWLINE;
         }
     } else {
         echo '</select></span></div>'.K_NEWLINE;
@@ -365,7 +365,7 @@
 if ($rg = F_db_query($sqlg, $db)) {
     echo '<span style="font-style:italic;color#333333;font-size:small;">';
     while ($mg = F_db_fetch_array($rg)) {
-        echo ' · '.$mg['group_name'].'';
+        echo ' · '.unhtmlentities(strip_tags($mg['group_name'])).'';
     }
     echo '</span>';
 } else {
@@ -404,6 +404,7 @@
 echo '</span>'.K_NEWLINE;
 echo '&nbsp;'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
+echo F_getCSRFTokenField().K_NEWLINE;
 echo '</form>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 

diff --git a/admin/code/tce_edit_question.php b/admin/code/tce_edit_question.php
@@ -2,7 +2,7 @@
 //============================================================+
 // File name   : tce_edit_question.php
 // Begin       : 2004-04-27
-// Last Update : 2018-07-06
+// Last Update : 2020-05-06
 //
 // Description : Edit questions
 //
@@ -15,7 +15,7 @@
 //               info@tecnick.com
 //
 // License:
-//    Copyright (C) 2004-2018 Nicola Asuni - Tecnick.com LTD
+//    Copyright (C) 2004-2020 Nicola Asuni - Tecnick.com LTD
 //    See LICENSE.TXT file for more information.
 //============================================================+
 
@@ -161,8 +161,7 @@
             // check user's authorization for parent module
             if ((!F_isAuthorizedUser(K_TABLE_MODULES, 'module_id', $m['subject_module_id'], 'module_user_id'))
                 and (!F_isAuthorizedUser(K_TABLE_SUBJECTS, 'subject_id', $m['question_subject_id'], 'subject_user_id'))) {
-                F_print_error('ERROR', $l['m_authorization_denied']);
-                exit;
+                F_print_error('ERROR', $l['m_authorization_denied'], true);
             }
         }
     } else {
@@ -197,6 +196,7 @@
             F_submit_button('forcedelete', $l['w_delete'], $l['h_delete']);
             F_submit_button('cancel', $l['w_cancel'], $l['h_cancel']);
             echo '</div>'.K_NEWLINE;
+            echo F_getCSRFTokenField().K_NEWLINE;
             echo '</form>'.K_NEWLINE;
             echo '</div>'.K_NEWLINE;
         }
@@ -871,7 +871,7 @@
 echo '&nbsp;'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
-
+echo F_getCSRFTokenField().K_NEWLINE;
 echo '</form>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 

diff --git a/admin/code/tce_edit_rating.php b/admin/code/tce_edit_rating.php
@@ -2,7 +2,7 @@
 //============================================================+
 // File name   : tce_edit_rating.php
 // Begin       : 2004-06-09
-// Last Update : 2018-07-06
+// Last Update : 2020-05-06
 //
 // Description : Editor to manually rate free text answers.
 //
@@ -15,7 +15,7 @@
 //               info@tecnick.com
 //
 // License:
-//    Copyright (C) 2004-2018  Nicola Asuni - Tecnick.com LTD
+//    Copyright (C) 2004-2020  Nicola Asuni - Tecnick.com LTD
 //    See LICENSE.TXT file for more information.
 //============================================================+
 
@@ -54,8 +54,7 @@
     $test_id = intval($_REQUEST['test_id']);
     // check user's authorization
     if (!F_isAuthorizedUser(K_TABLE_TESTS, 'test_id', $test_id, 'test_user_id')) {
-        F_print_error('ERROR', $l['m_authorization_denied']);
-        exit;
+        F_print_error('ERROR', $l['m_authorization_denied'], true);
     }
 } else {
     $test_id = 0;
@@ -377,6 +376,7 @@
 }
 
 echo '</div>'.K_NEWLINE;
+echo F_getCSRFTokenField().K_NEWLINE;
 echo '</form>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 

diff --git a/admin/code/tce_edit_sslcerts.php b/admin/code/tce_edit_sslcerts.php
@@ -2,7 +2,7 @@
 //============================================================+
 // File name   : tce_edit_sslcerts.php
 // Begin       : 2013-07-04
-// Last Update : 2013-07-09
+// Last Update : 2020-05-06
 //
 // Description : Upload and edit SSL certificates.
 //
@@ -15,7 +15,7 @@
 //               info@tecnick.com
 //
 // License:
-//    Copyright (C) 2004-2013 Nicola Asuni - Tecnick.com LTD
+//    Copyright (C) 2004-2020 Nicola Asuni - Tecnick.com LTD
 //    See LICENSE.TXT file for more information.
 //============================================================+
 
@@ -60,8 +60,7 @@
     $ssl_id = intval($_REQUEST['ssl_id']);
     // check user's authorization for this certificate
     if (!F_isAuthorizedUser(K_TABLE_SSLCERTS, 'ssl_id', $ssl_id, 'ssl_user_id')) {
-        F_print_error('ERROR', $l['m_authorization_denied']);
-        exit;
+        F_print_error('ERROR', $l['m_authorization_denied'], true);
     }
 } else {
     $ssl_id = 0;
@@ -107,6 +106,7 @@
             F_submit_button('forcedelete', $l['w_delete'], $l['h_delete']);
             F_submit_button('cancel', $l['w_cancel'], $l['h_cancel']);
             echo '</div>'.K_NEWLINE;
+            echo F_getCSRFTokenField().K_NEWLINE;
             echo '</form>'.K_NEWLINE;
             echo '</div>'.K_NEWLINE;
         }
@@ -324,7 +324,7 @@
 F_submit_button('clear', $l['w_clear'], $l['h_clear']);
 
 echo '</div>'.K_NEWLINE;
-
+echo F_getCSRFTokenField().K_NEWLINE;
 echo '</form>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 

diff --git a/admin/code/tce_edit_subject.php b/admin/code/tce_edit_subject.php
@@ -2,7 +2,7 @@
 //============================================================+
 // File name   : tce_edit_subject.php
 // Begin       : 2004-04-26
-// Last Update : 2018-07-06
+// Last Update : 2020-05-06
 //
 // Description : Display form to edit exam subject_id (topics).
 //
@@ -15,7 +15,7 @@
 //               info@tecnick.com
 //
 // License:
-//    Copyright (C) 2004-2018 Nicola Asuni - Tecnick.com LTD
+//    Copyright (C) 2004-2020 Nicola Asuni - Tecnick.com LTD
 //    See LICENSE.TXT file for more information.
 //============================================================+
 
@@ -95,8 +95,7 @@
                 // check user's authorization for parent module
                 if ((!F_isAuthorizedUser(K_TABLE_MODULES, 'module_id', $subject_module_id, 'module_user_id'))
                     and (!F_isAuthorizedUser(K_TABLE_SUBJECTS, 'subject_id', $subject_id, 'subject_user_id'))) {
-                    F_print_error('ERROR', $l['m_authorization_denied']);
-                    exit;
+                    F_print_error('ERROR', $l['m_authorization_denied'], true);
                 }
             }
         } else {
@@ -133,6 +132,7 @@
             <?php
             F_submit_button('forcedelete', $l['w_delete'], $l['h_delete']);
             F_submit_button('cancel', $l['w_cancel'], $l['h_cancel']);
+            echo F_getCSRFTokenField().K_NEWLINE;
             ?>
             </div>
             </form>
@@ -464,7 +464,7 @@
 echo '&nbsp;'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;
-
+echo F_getCSRFTokenField().K_NEWLINE;
 echo '</form>'.K_NEWLINE;
 echo '</div>'.K_NEWLINE;