may/1KA_F2F
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Dodan strip_tags za preprecevanje js injectiona

Browse Source
This commit is contained in:
pero1203 2021-10-18 10:41:18 +02:00
parent ccdf5af125
commit 2270154984
3 changed files with 24 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
admin/survey/BranchingAjax.php
View File

@ -865,7 +865,7 @@ class BranchingAjax {
Common::getInstance()->updateEditStamp();
}
$text = $_POST['text'];
$text = strip_tags($_POST['text']);
$operator = $_POST['operator'];
$negation = $_POST['negation'];
$conjunction = $_POST['conjunction'];
@ -1080,7 +1080,7 @@ class BranchingAjax {
}
$if = $_POST['if'];
$label = $_POST['label'];
$label = strip_tags($_POST['label']);
sisplet_query("UPDATE srv_if SET label='$label' WHERE id = '$if'");
}
@ -1453,7 +1453,7 @@ class BranchingAjax {
$id = $_POST['id'];
$text = $_POST['text'];
$opomba = $_POST['opomba'];
$opomba = strip_tags($_POST['opomba']);
if ($id == -1) {
sisplet_query("UPDATE srv_anketa SET introduction='$text', intro_opomba='$opomba' WHERE id='$this->anketa'");

12
admin/survey/SurveyAdminAjax.php
View File

@ -190,7 +190,7 @@ class SurveyAdminAjax {
if (isset ($_POST['branching']))
$this->branching = $_POST['branching'];
if (isset ($_POST['label']))
$label = $_POST['label'];
$label = strip_tags($_POST['label']);
if (isset ($_POST['cela']))
$cela = $_POST['cela'];
if (isset ($_POST['decimalna']))
@ -276,7 +276,7 @@ class SurveyAdminAjax {
if (isset ($_POST['timer']))
$timer = $_POST['timer'];
if (isset ($_POST['intro_opomba']))
$intro_opomba = $_POST['intro_opomba'];
$intro_opomba = strip_tags($_POST['intro_opomba']);
if (isset ($_POST['akronim']))
$akronim = $_POST['akronim'];
if (isset ($_POST['paramName']))
@ -392,7 +392,7 @@ class SurveyAdminAjax {
elseif ($_GET['a'] == 'edit_anketa_note') {
if ($anketa && isset ($_POST['note']) && $_POST['note'] != '' && $_POST['note'] != 'undefined') {
Common::updateEditStamp();
$sql = sisplet_query("UPDATE srv_anketa SET intro_opomba='" . $_POST['note'] . "' WHERE id='$anketa'");
$sql = sisplet_query("UPDATE srv_anketa SET intro_opomba='" . strip_tags($_POST['note']) . "' WHERE id='$anketa'");
// vsilimo refresh podatkov
SurveyInfo :: getInstance()->resetSurveyData();
@ -494,7 +494,7 @@ class SurveyAdminAjax {
$update[] = " akronim='".trim($_POST['akronim'])."'";
}
if (isset($_POST['intro_opomba']) /*&& trim($_POST['intro_opomba']) != ''*/) {
$update[] = " intro_opomba='".trim($_POST['intro_opomba'])."'";
$update[] = " intro_opomba='".strip_tags(trim($_POST['intro_opomba']))."'";
}
if (count($update) > 0 ) {
sisplet_query("UPDATE srv_anketa SET ".implode(',',$update)." WHERE id='".$this->anketa."'");
@ -528,8 +528,8 @@ class SurveyAdminAjax {
$show_intro = $_POST['show_intro'];
$show_concl = $_POST['show_concl'];
$concl_link = $_POST['concl_link'];
$intro_opomba = $_POST['intro_opomba'];
$concl_opomba = $_POST['concl_opomba'];
$intro_opomba = strip_tags($_POST['intro_opomba']);
$concl_opomba = strip_tags($_POST['concl_opomba']);
if ($_POST['concl_link'] == 1)
$concl_link = 0;
else

24
admin/survey/classes/class.Vprasanje.php
View File

@ -5541,8 +5541,12 @@ class Vprasanje {
}
if (isset($_POST['label'])) {
if ($_POST['label'] != $row['label'])
$update .= ", label='$_POST[label]' ";
if ($_POST['label'] != $row['label']){
$label_text = strip_tags($_POST['label']);
$update .= ", label='$label_text' ";
}
}
// // shrani opombo
@ -5575,11 +5579,13 @@ class Vprasanje {
// nastavitve uvoda
if ( isset($_POST['intro_opomba'])) {
if (isset($_POST['intro_opomba'])) {
$intro_opomba = $_POST['intro_opomba'];
$intro_note = $_POST['note'];
$intro_opomba = strip_tags($_POST['intro_opomba']);
$intro_note = strip_tags($_POST['note']);
$intro = " intro_opomba='".$intro_opomba."', intro_note='$intro_note'";
} else $intro = '';
}
else $intro = '';
unset($_POST['note']); // da ne gre shranjevat v srv_spremenljivka
@ -5644,11 +5650,11 @@ class Vprasanje {
SurveySetting::getInstance()->setSurveyMiscSetting('concl_url_status', $_POST['concl_url_status']);
SurveySetting::getInstance()->setSurveyMiscSetting('concl_url_recnum', $_POST['concl_url_recnum']);
$concl_opomba = $_POST['concl_opomba'];
$concl_note = $_POST['note'];
$concl_opomba = strip_tags($_POST['concl_opomba']);
$concl_note = strip_tags($_POST['note']);
$concl_back_button = $_POST['concl_back_button'];
$concl_end_button = $_POST['concl_end_button'];
$concl_back_button = strip_tags($_POST['concl_back_button']);
$concl_end_button = strip_tags($_POST['concl_end_button']);
// shrani prikaz povezave na zacetek ankete za naknadno urejanje
$concl_return_edit = $_POST['concl_return_edit'];