Skip to content

Commit

Permalink
XSS and XSRF security fixes
Browse files Browse the repository at this point in the history 
git-svn-id: https://projectpier.svn.sourceforge.net/svnroot/projectpier/ProjectPier/Trunk@112 5e44df70-d631-0410-a02e-f1bdc1e0250e
  • Loading branch information
miknight committed Feb 11, 2008
1 parent 0bed775 commit b706b67
Show file tree
Hide file tree
Showing 31 changed files with 461 additions and 153 deletions.
51 changes: 39 additions & 12 deletions application/controllers/CompanyController.class.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -241,6 +241,8 @@ function edit_client() {
* @return null
*/
function delete_client() {
$this->setTemplate('del_company');

if (!logged_user()->isAdministrator(owner_company())) {
flash_error(lang('no access permissions'));
$this->redirectTo('dashboard');
Expand All @@ -252,19 +254,44 @@ function delete_client() {
$this->redirectTo('administration', 'clients');
} // if

try {
DB::beginWork();
$company->delete();
ApplicationLogs::createLog($company, null, ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success delete client', $company->getName()));
} catch(Exception $e) {
DB::rollback();
$delete_data = array_var($_POST, 'deleteCompany');
tpl_assign('company',$company);
tpl_assign('delete_data',$delete_data);

if (!is_array($delete_data)) {
$delete_data = array(
'really' => 0,
'password' => '',
); // array
tpl_assign('delete_data', $delete_data);
} else if ($delete_data['really'] == 1) {
$password = $delete_data['password'];
if (trim($password) == '') {
tpl_assign('error', new Error(lang('password value missing')));
$this->render();
}
if (!logged_user()->isValidPassword($password)) {
tpl_assign('error', new Error(lang('invalid login data')));
$this->render();
} // if

try {
DB::beginWork();
$company->delete();
ApplicationLogs::createLog($company, null, ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success delete client', $company->getName()));
} catch(Exception $e) {
DB::rollback();
flash_error(lang('error delete client'));
} // try

$this->redirectTo('administration', 'clients');
} else {
flash_error(lang('error delete client'));
} // try

$this->redirectTo('administration', 'clients');
$this->redirectTo('administration', 'clients');
}
} // delete_client

/**
Expand Down
104 changes: 79 additions & 25 deletions application/controllers/FilesController.class.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -479,29 +479,55 @@ function edit_file() {
* @return null
*/
function delete_file() {
$this->setTemplate('del_file');

$file = ProjectFiles::findById(get_id());
if (!($file instanceof ProjectFile)) {
flash_error(lang('file dnx'));
$this->redirectToReferer(get_url('files'));
} // if

if (!$file->canEdit(logged_user())) {
flash_error(lang('no access permissions'));
$this->redirectToReferer(get_url('files'));
} // if

try {
DB::beginWork();
$file->delete();
ApplicationLogs::createLog($file, $file->getProject(), ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success delete file', $file->getFilename()));
} catch(Exception $e) {

$delete_data = array_var($_POST, 'deleteFile');
tpl_assign('file',$file);
tpl_assign('delete_data',$delete_data);

if (!is_array($delete_data)) {
$delete_data = array(
'really' => 0,
'password' => '',
); // array
tpl_assign('delete_data', $delete_data);
} else if ($delete_data['really'] == 1) {
$password = $delete_data['password'];
if (trim($password) == '') {
tpl_assign('error', new Error(lang('password value missing')));
return $this->render();
}
if (!logged_user()->isValidPassword($password)) {
tpl_assign('error', new Error(lang('invalid login data')));
return $this->render();
}
try {
DB::beginWork();
$file->delete();
ApplicationLogs::createLog($file, $file->getProject(), ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success delete file', $file->getFilename()));
} catch(Exception $e) {
flash_error(lang('error delete file'));
} // try

$this->redirectTo('files');
} else {
flash_error(lang('error delete file'));
} // try

$this->redirectTo('files');
$this->redirectToUrl($file->getDetailsUrl());
}
} // delete_file

// ---------------------------------------------------
Expand Down Expand Up @@ -569,6 +595,8 @@ function edit_file_revision() {
* @return null
*/
function delete_file_revision() {
$this->setTemplate('del_revision');

$revision = ProjectFileRevisions::findById(get_id());
if (!($revision instanceof ProjectFileRevision)) {
flash_error(lang('file revision dnx'));
Expand All @@ -592,19 +620,45 @@ function delete_file_revision() {
$this->redirectToReferer(get_url('files'));
} // if

try {
DB::beginWork();
$revision->delete();
ApplicationLogs::createLog($revision, $revision->getProject(), ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success delete file revision'));
} catch(Exception $e) {
DB::rollback();
$delete_data = array_var($_POST, 'deleteFileRevision');
tpl_assign('file',$file);
tpl_assign('revision',$revision);
tpl_assign('delete_data',$delete_data);

if (!is_array($delete_data)) {
$delete_data = array(
'really' => 0,
'password' => '',
); // array
tpl_assign('delete_data', $delete_data);
} else if ($delete_data['really'] == 1) {
$password = $delete_data['password'];
if (trim($password) == '') {
tpl_assign('error', new Error(lang('password value missing')));
return $this->render();
}
if (!logged_user()->isValidPassword($password)) {
tpl_assign('error', new Error(lang('invalid login data')));
return $this->render();
}

try {
DB::beginWork();
$revision->delete();
ApplicationLogs::createLog($revision, $revision->getProject(), ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success delete file revision'));
} catch(Exception $e) {
DB::rollback();
flash_error(lang('error delete file revision'));
} // try

$this->redirectToUrl($file->getDetailsUrl());
} else {
flash_error(lang('error delete file revision'));
} // try

$this->redirectToUrl($file->getDetailsUrl());
$this->redirectToUrl($file->getDetailsUrl());
}
} // delete_file_revision

// ---------------------------------------------------
Expand Down
53 changes: 40 additions & 13 deletions application/controllers/MessageController.class.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -308,6 +308,8 @@ function update_options() {
* @return null
*/
function delete() {
$this->setTemplate('del_message');

$message = ProjectMessages::findById(get_id());
if (!($message instanceof ProjectMessage)) {
flash_error(lang('message dnx'));
Expand All @@ -319,20 +321,45 @@ function delete() {
$this->redirectTo('message');
} // if

try {

DB::beginWork();
$message->delete();
ApplicationLogs::createLog($message, $message->getProject(), ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success deleted message', $message->getTitle()));
} catch(Exception $e) {
DB::rollback();
$delete_data = array_var($_POST, 'deleteMessage');
tpl_assign('message',$message);
tpl_assign('delete_data',$delete_data);

if (!is_array($delete_data)) {
$delete_data = array(
'really' => 0,
'password' => '',
); // array
tpl_assign('delete_data', $delete_data);
} else if ($delete_data['really'] == 1) {
$password = $delete_data['password'];
if (trim($password) == '') {
tpl_assign('error', new Error(lang('password value missing')));
return $this->render();
}
if (!logged_user()->isValidPassword($password)) {
tpl_assign('error', new Error(lang('invalid login data')));
return $this->render();
}
try {

DB::beginWork();
$message->delete();
ApplicationLogs::createLog($message, $message->getProject(), ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success deleted message', $message->getTitle()));
} catch(Exception $e) {
DB::rollback();
flash_error(lang('error delete message'));
} // try

$this->redirectTo('message');
} else {
flash_error(lang('error delete message'));
} // try

$this->redirectTo('message');
$this->redirectTo('message');
}

} // delete

// ---------------------------------------------------
Expand Down
52 changes: 39 additions & 13 deletions application/controllers/MilestoneController.class.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,8 @@ function edit() {
* @return null
*/
function delete() {
$this->setTemplate('del_milestone');

$milestone = ProjectMilestones::findById(get_id());
if (!($milestone instanceof ProjectMilestone)) {
flash_error(lang('milestone dnx'));
Expand All @@ -242,20 +244,44 @@ function delete() {
$this->redirectToReferer(get_url('milestone'));
} // if

try {

DB::beginWork();
$milestone->delete();
ApplicationLogs::createLog($milestone, $milestone->getProject(), ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success deleted milestone', $milestone->getName()));
} catch(Exception $e) {
DB::rollback();
$delete_data = array_var($_POST, 'deleteMilestone');
tpl_assign('milestone',$milestone);
tpl_assign('delete_data',$delete_data);

if (!is_array($delete_data)) {
$delete_data = array(
'really' => 0,
'password' => '',
); // array
tpl_assign('delete_data', $delete_data);
} else if ($delete_data['really'] == 1) {
$password = $delete_data['password'];
if (trim($password) == '') {
tpl_assign('error', new Error(lang('password value missing')));
return $this->render();
}
if (!logged_user()->isValidPassword($password)) {
tpl_assign('error', new Error(lang('invalid login data')));
return $this->render();
}
try {

DB::beginWork();
$milestone->delete();
ApplicationLogs::createLog($milestone, $milestone->getProject(), ApplicationLogs::ACTION_DELETE);
DB::commit();

flash_success(lang('success deleted milestone', $milestone->getName()));
} catch(Exception $e) {
DB::rollback();
flash_error(lang('error delete milestone'));
} // try

$this->redirectTo('milestone');
} else {
flash_error(lang('error delete milestone'));
} // try

$this->redirectTo('milestone');
$this->redirectTo('milestone');
}
} // delete

/**
Expand Down
Loading

0 comments on commit b706b67

Please sign in to comment.