[Mapbender-commits] r6821 - in branches/2.5/http:
extensions/datepicker php
svn_mapbender at osgeo.org
svn_mapbender at osgeo.org
Thu Aug 26 08:47:15 EDT 2010
Author: christoph
Date: 2010-08-26 12:47:15 +0000 (Thu, 26 Aug 2010)
New Revision: 6821
Modified:
branches/2.5/http/extensions/datepicker/datepicker.php
branches/2.5/http/php/mod_changePassword.php
branches/2.5/http/php/mod_evalArea.php
branches/2.5/http/php/mod_getStyles.php
branches/2.5/http/php/mod_layerMetadata.php
branches/2.5/http/php/mod_printView1.php
branches/2.5/http/php/mod_saveWKT.php
branches/2.5/http/php/mod_showGuiName.php
branches/2.5/http/php/nestedSets.php
Log:
some bug fixes from 2.6.3
Modified: branches/2.5/http/extensions/datepicker/datepicker.php
===================================================================
--- branches/2.5/http/extensions/datepicker/datepicker.php 2010-08-26 12:13:52 UTC (rev 6820)
+++ branches/2.5/http/extensions/datepicker/datepicker.php 2010-08-26 12:47:15 UTC (rev 6821)
@@ -1,9 +1,17 @@
<?php
$name_month = explode("_",$_REQUEST["m"]);
-$name_day2 = explode("_",$_REQUEST["d"]);
-$today = $_REQUEST["t"];
+foreach (array_keys($name_month) as $index) {
+ $name_month[$index] = htmlentities($name_month[$index], ENT_QUOTES);
+}
+$name_day = explode("_",$_REQUEST["d"]);
+foreach (array_keys($name_day) as $index) {
+ $name_day[$index] = htmlentities($name_day[$index], ENT_QUOTES);
+}
+
+$today = htmlentities($_REQUEST["t"], ENT_QUOTES);
+
echo "<html>
<head>
<title>Datepicker</title>
@@ -50,7 +58,7 @@
<table cellSpacing=0 cellPadding=0 width=200 border=2>
<tr id=cal>\n";
for ($i=0; $i<7; $i++){
- echo "<td>".$name_day2[$i]."</td>\n";
+ echo "<td>".$name_day[$i]."</td>\n";
}
echo "</tr><tr>\n";
for ($i=1; $i<43; $i++){
Modified: branches/2.5/http/php/mod_changePassword.php
===================================================================
--- branches/2.5/http/php/mod_changePassword.php 2010-08-26 12:13:52 UTC (rev 6820)
+++ branches/2.5/http/php/mod_changePassword.php 2010-08-26 12:47:15 UTC (rev 6821)
@@ -116,11 +116,14 @@
$t = array('i');
$res_user_id = db_prep_query($sql_user_id,$v,$t);
$real_user_id = db_result($res_user_id,0,"mb_user_id");
+
$sql_password = "SELECT mb_user_password, mb_user_password = $1 as new FROM mb_user where mb_user_id = $2";
$v = array($newpassword,$real_user_id);
$t = array('s','i');
$res_password = db_prep_query($sql_password,$v,$t);
- if(db_result($res_password,0,"mb_user_password") != db_result($res_password,0,"new")){
+
+ if( db_result($res_password,0,"mb_user_password") == md5($oldpassword) &&
+ db_result($res_password,0,"mb_user_password") != db_result($res_password,0,"new")){
$sql_update = "UPDATE mb_user SET mb_user_password = $1";
$v = array(md5($newpassword));
$t = array('s');
@@ -133,8 +136,12 @@
echo "alert('Password has been updated!');";
echo "</script>";
}
- else{
+ elseif (db_result($res_password,0,"mb_user_password") != md5($oldpassword)){
echo "<script language='javascript'>";
+ echo "alert('Please enter the correct current password!');";
+ echo "</script>";
+ } else {
+ echo "<script language='javascript'>";
//echo "alert('Bitte beachten Sie die unten aufgef�hrten Passwortregeln!');";
echo "alert('Please note the rules for choosing a password below!');";
echo "</script>";
@@ -145,7 +152,16 @@
echo "<fieldset><legend>Change password:</legend>";
echo "<form name='form1' action='" . $self ."' method='post'>";
echo "<table cellpadding='5' cellspacing='0' border='0'>";
+echo "<tr>";
echo "<td>";
+echo "old password:";
+echo "</td>";
+echo "<td>";
+echo "<input type='password' name='oldpassword' value=''>";
+echo "</td>";
+echo"</tr>";
+echo "<tr>";
+echo "<td>";
echo "new password:";
echo "</td>";
echo "<td>";
@@ -185,4 +201,4 @@
</ul>
</div>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: branches/2.5/http/php/mod_evalArea.php
===================================================================
--- branches/2.5/http/php/mod_evalArea.php 2010-08-26 12:13:52 UTC (rev 6820)
+++ branches/2.5/http/php/mod_evalArea.php 2010-08-26 12:47:15 UTC (rev 6821)
@@ -55,7 +55,16 @@
$posX = explode (",", $x);
$posY = explode (",", $y);
+$numeric = is_numeric($epsg);
+foreach($posX as $x) $numeric = $numeric && is_numeric($x);
+foreach($posY as $y) $numeric = $numeric && is_numeric($y);
+if (!$numeric) // Security check
+{
+ die("Elements of x and y, as well as srs need to be numeric!");
+}
+
+
if(SYS_DBTYPE=='pgsql'){
if(count($posX) > 3){
$sql = "SELECT area2d(GeometryFromText('MULTIPOLYGON(((";
@@ -104,7 +113,7 @@
}
echo "<br>";
-echo "Umfang: ". $length . " m";
+echo "Umfang: ". htmlentities($length,ENT_QUOTES) . " m";
#Centroid(geometry)
/*
$sql = "SELECT Centroid(GeometryFromText('MULTIPOLYGON(((";
@@ -134,4 +143,4 @@
*/
?>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: branches/2.5/http/php/mod_getStyles.php
===================================================================
--- branches/2.5/http/php/mod_getStyles.php 2010-08-26 12:13:52 UTC (rev 6820)
+++ branches/2.5/http/php/mod_getStyles.php 2010-08-26 12:47:15 UTC (rev 6821)
@@ -164,7 +164,7 @@
$cnt++;
}
echo "</select><br>";
-echo "<textarea class='textfield' name='url' cols='70' rows='3' wrap='virtual'>".$getStyle."</textarea><br>";
+echo "<textarea class='textfield' name='url' cols='70' rows='3' wrap='virtual'>".htmlentities($getStyle,ENT_QUOTES)."</textarea><br>";
echo "<input class='button_del' type='button' value='getStyle' onclick='validate()'><br>";
if($style_filename){
$style_file = fopen($style_filename,"r");
Modified: branches/2.5/http/php/mod_layerMetadata.php
===================================================================
--- branches/2.5/http/php/mod_layerMetadata.php 2010-08-26 12:13:52 UTC (rev 6820)
+++ branches/2.5/http/php/mod_layerMetadata.php 2010-08-26 12:47:15 UTC (rev 6821)
@@ -19,7 +19,7 @@
require_once(dirname(__FILE__)."/../php/mb_validateSession.php");
-$redirectToMetadataUrl = $_GET["redirectToMetadataUrl"];
+$redirectToMetadataUrl = intval($_GET["redirectToMetadataUrl"]);
function display_text($string) {
$string = mb_eregi_replace("[[:alpha:]]+://[^<>[:space:]]+[[:alnum:]/]", "<a href=\"\\0\" target=_blank>\\0</a>", $string);
@@ -54,7 +54,7 @@
'<meta http-equiv="Content-Type" content="text/html; charset='.CHARSET.'">' .
'</head>'.
'<body>';
- $layer_id = $_GET['id'];
+ $layer_id = htmlentities($_GET['id'], ENT_QUOTES);
$wms_getmap = urldecode($_GET['wms']);
$layer_name = urldecode($_GET['name']);
Modified: branches/2.5/http/php/mod_printView1.php
===================================================================
--- branches/2.5/http/php/mod_printView1.php 2010-08-26 12:13:52 UTC (rev 6820)
+++ branches/2.5/http/php/mod_printView1.php 2010-08-26 12:47:15 UTC (rev 6821)
@@ -74,18 +74,18 @@
echo "<img class='bg_header' style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left+1)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;' src='../img/white.gif'>";
echo "<div style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left+1)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;'>";
-echo "<div style='position:relative;left:5px; font-weight:bold; font-size:20px;z-index:3;'>".$printTitle . "</div>";
+echo "<div style='position:relative;left:5px; font-weight:bold; font-size:20px;z-index:3;'>".htmlentities($printTitle, ENT_QUOTES) . "</div>";
echo "<div style='position:relative;left:5px;z-index:3;'>Datum: ".$date . "</div>";
-echo "<div style='position:relative;left:5px;z-index:3;'>Ma�stab: 1:".$map_scale . "</div>";
+echo "<div style='position:relative;left:5px;z-index:3;'>Ma�stab: 1:". htmlentities($map_scale, ENT_QUOTES) . "</div>";
echo"</div>";
echo "<img class='bg_header' style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left + $map_width/2+2)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;' src='../img/white.gif'>";
echo "<div style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left + $map_width/2+2)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;' >";
-echo "<div style='position:relative;left:5px;z-index:3;'>".$printComment . "</div>";
+echo "<div style='position:relative;left:5px;z-index:3;'>". htmlentities($printComment, ENT_QUOTES) . "</div>";
echo"</div>";
echo "<div style='position: absolute; top:".($printOffset_top + $header_height + $map_height+5)."px;left:".($printOffset_left+2)."px; z-index:3;font-size:10px' >";
-echo $footer;
+echo htmlentities($footer, ENT_QUOTES);
echo "</div>";
#$myfactor = 37.81;
#echo "<img style='position: absolute; top:".($printOffset_top + $header_height + $map_height+10)."px;left:".($printOffset_left+2)."px; ' src='../img/black.gif' height='2' width='".(10 * $myfactor)."'>";
Modified: branches/2.5/http/php/mod_saveWKT.php
===================================================================
--- branches/2.5/http/php/mod_saveWKT.php 2010-08-26 12:13:52 UTC (rev 6820)
+++ branches/2.5/http/php/mod_saveWKT.php 2010-08-26 12:47:15 UTC (rev 6821)
@@ -18,6 +18,9 @@
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+die("This script has many security issues and should not be used! Activate it at your own risk!");
+
require_once(dirname(__FILE__)."/../php/mb_validateSession.php");
?>
<html>
@@ -234,4 +237,4 @@
?>
</form>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: branches/2.5/http/php/mod_showGuiName.php
===================================================================
--- branches/2.5/http/php/mod_showGuiName.php 2010-08-26 12:13:52 UTC (rev 6820)
+++ branches/2.5/http/php/mod_showGuiName.php 2010-08-26 12:47:15 UTC (rev 6821)
@@ -35,8 +35,8 @@
<?php
$guiName=$_REQUEST["gui_name"];
-echo "<div class='text4'>".$gui_id."</div>";
+echo "<div class='text4'>".htmlentities($gui_id,ENT_QUOTES)."</div>";
?>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: branches/2.5/http/php/nestedSets.php
===================================================================
--- branches/2.5/http/php/nestedSets.php 2010-08-26 12:13:52 UTC (rev 6820)
+++ branches/2.5/http/php/nestedSets.php 2010-08-26 12:47:15 UTC (rev 6821)
@@ -239,7 +239,7 @@
<!-- -->
<?php
if(isset($guiList) && $guiList != ""){
- echo "<iframe ID='foldertree' name='foldertree' height='400' width='300' src='mod_treefolderAdmin.php?guiList=".$guiList."' scrolling='auto' frameborder='1'></iframe>";
+ echo "<iframe ID='foldertree' name='foldertree' height='400' width='300' src='mod_treefolderAdmin.php?guiList=".urlencode($guiList)."' scrolling='auto' frameborder='1'></iframe>";
}
else{
echo "<iframe ID='foldertree' name='foldertree' height='400' width='300' src='../html/mod_blank.html' scrolling='auto' frameborder='1'></iframe>";
@@ -285,7 +285,7 @@
#echo "<td>Beschriftung:</td>";
echo "<td>Labeling:</td>";
echo "<td><input type='text' size='16' name='name' value='";
- echo $name;
+ echo htmlentities($name, ENT_QUOTES);
echo "'></td>";
echo "</tr>";
?>
@@ -363,7 +363,7 @@
echo "<td><input type='text' size='1' name='left' ";
if($left)
{
- echo "value='".$left."'";
+ echo "value='".htmlentities($left,ENT_QUOTES)."'";
}
echo "></td>";
?>
More information about the Mapbender_commits
mailing list