mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

use new sanitize HTML function

This commit is contained in:
Bjoern Schiessle 2012-06-19 17:24:55 +02:00
parent d2936bd90c
commit 089ae980c4
5 changed files with 5 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
index.php
View File

@ -122,7 +122,7 @@ elseif(OC_User::isLoggedIn()) {
if(!array_key_exists('sectoken', $_SESSION) || (array_key_exists('sectoken', $_SESSION) && is_null(OC::$REQUESTEDFILE)) || substr(OC::$REQUESTEDFILE, -3) == 'php'){ if(!array_key_exists('sectoken', $_SESSION) || (array_key_exists('sectoken', $_SESSION) && is_null(OC::$REQUESTEDFILE)) || substr(OC::$REQUESTEDFILE, -3) == 'php'){
$sectoken=rand(1000000,9999999); $sectoken=rand(1000000,9999999);
$_SESSION['sectoken']=$sectoken; $_SESSION['sectoken']=$sectoken;
$redirect_url = (isset($_REQUEST['redirect_url'])) ? strip_tags($_REQUEST['redirect_url']) : $_SERVER['REQUEST_URI']; $redirect_url = (isset($_REQUEST['redirect_url'])) ? OC_Util::sanitizeHTML($_REQUEST['redirect_url']) : $_SERVER['REQUEST_URI'];
OC_Template::printGuestPage('', 'login', array('error' => $error, 'sectoken' => $sectoken, 'redirect' => $redirect_url)); OC_Template::printGuestPage('', 'login', array('error' => $error, 'sectoken' => $sectoken, 'redirect' => $redirect_url));
} }
} }

8
lib/template.php
View File

@ -308,13 +308,7 @@ class OC_Template{
* If the key existed before, it will be overwritten * If the key existed before, it will be overwritten
*/ */
public function assign( $key, $value, $sanitizeHTML=true ){ public function assign( $key, $value, $sanitizeHTML=true ){
if($sanitizeHTML == true) { if($sanitizeHTML == true) $value=OC_Util::sanitizeHTML($value);
if(is_array($value)) {
array_walk_recursive($value,'OC_Template::sanitizeHTML');
} else {
$value = OC_Template::sanitizeHTML($value);
}
}
$this->vars[$key] = $value; $this->vars[$key] = $value;
return true; return true;
} }

2
settings/admin.php
View File

@ -23,7 +23,7 @@ function compareEntries($a,$b){
usort($entries, 'compareEntries'); usort($entries, 'compareEntries');
$tmpl->assign('loglevel',OC_Config::getValue( "loglevel", 2 )); $tmpl->assign('loglevel',OC_Config::getValue( "loglevel", 2 ));
$tmpl->assign('entries',$entries,false); $tmpl->assign('entries',$entries);
$tmpl->assign('forms',array()); $tmpl->assign('forms',array());
foreach($forms as $form){ foreach($forms as $form){
$tmpl->append('forms',$form); $tmpl->append('forms',$form);

2
settings/ajax/getlog.php
View File

@ -14,4 +14,4 @@ $count=(isset($_GET['count']))?$_GET['count']:50;
$offset=(isset($_GET['offset']))?$_GET['offset']:0; $offset=(isset($_GET['offset']))?$_GET['offset']:0;
$entries=OC_Log_Owncloud::getEntries($count,$offset); $entries=OC_Log_Owncloud::getEntries($count,$offset);
OC_JSON::success(array("data" => $entries)); OC_JSON::success(array("data" => OC_Util::sanitizeHTML($entries)));

2
settings/js/log.js
View File

@ -39,7 +39,7 @@ OC.Log={
row.append(appTd); row.append(appTd);
var messageTd=$('<td/>'); var messageTd=$('<td/>');
messageTd.text(entry.message.replace(/</, "&lt;").replace(/>/, "&gt;")); messageTd.text(entry.message);
row.append(messageTd); row.append(messageTd);
var timeTd=$('<td/>'); var timeTd=$('<td/>');