[Mapbender-commits] r6822 - branches/2.4.5/http/php
svn_mapbender at osgeo.org
svn_mapbender at osgeo.org
Thu Aug 26 09:40:40 EDT 2010
Author: christoph
Date: 2010-08-26 13:40:40 +0000 (Thu, 26 Aug 2010)
New Revision: 6822
Modified:
branches/2.4.5/http/php/mod_changePassword.php
branches/2.4.5/http/php/mod_evalArea.php
branches/2.4.5/http/php/mod_getStyles.php
branches/2.4.5/http/php/mod_layerMetadata.php
branches/2.4.5/http/php/mod_printView1.php
branches/2.4.5/http/php/mod_saveWKT.php
branches/2.4.5/http/php/nestedSets.php
Log:
some bug fixes from 2.6.3
Modified: branches/2.4.5/http/php/mod_changePassword.php
===================================================================
--- branches/2.4.5/http/php/mod_changePassword.php 2010-08-26 12:47:15 UTC (rev 6821)
+++ branches/2.4.5/http/php/mod_changePassword.php 2010-08-26 13:40:40 UTC (rev 6822)
@@ -118,11 +118,14 @@
$t = array('i');
$res_user_id = db_prep_query($sql_user_id,$v,$t);
$real_user_id = db_result($res_user_id,0,"mb_user_id");
+
$sql_password = "SELECT mb_user_password, mb_user_password = $1 as new FROM mb_user where mb_user_id = $2";
$v = array($newpassword,$real_user_id);
$t = array('s','i');
$res_password = db_prep_query($sql_password,$v,$t);
- if(db_result($res_password,0,"mb_user_password") != db_result($res_password,0,"new")){
+
+ if( db_result($res_password,0,"mb_user_password") == md5($oldpassword) &&
+ db_result($res_password,0,"mb_user_password") != db_result($res_password,0,"new")){
$sql_update = "UPDATE mb_user SET mb_user_password = $1";
$v = array(md5($newpassword));
$t = array('s');
@@ -135,8 +138,12 @@
echo "alert('Password has been updated!');";
echo "</script>";
}
- else{
+ elseif (db_result($res_password,0,"mb_user_password") != md5($oldpassword)){
echo "<script language='javascript'>";
+ echo "alert('Please enter the correct current password!');";
+ echo "</script>";
+ } else {
+ echo "<script language='javascript'>";
//echo "alert('Bitte beachten Sie die unten aufgef�hrten Passwortregeln!');";
echo "alert('Please note the rules for choosing a password below!');";
echo "</script>";
@@ -147,7 +154,16 @@
echo "<fieldset><legend>Change password:</legend>";
echo "<form name='form1' action='" . $self ."' method='post'>";
echo "<table cellpadding='5' cellspacing='0' border='0'>";
+echo "<tr>";
echo "<td>";
+echo "old password:";
+echo "</td>";
+echo "<td>";
+echo "<input type='password' name='oldpassword' value=''>";
+echo "</td>";
+echo"</tr>";
+echo "<tr>";
+echo "<td>";
echo "new password:";
echo "</td>";
echo "<td>";
@@ -187,4 +203,4 @@
</ul>
</div>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: branches/2.4.5/http/php/mod_evalArea.php
===================================================================
--- branches/2.4.5/http/php/mod_evalArea.php 2010-08-26 12:47:15 UTC (rev 6821)
+++ branches/2.4.5/http/php/mod_evalArea.php 2010-08-26 13:40:40 UTC (rev 6822)
@@ -56,7 +56,16 @@
$posX = explode (",", $x);
$posY = explode (",", $y);
+$numeric = is_numeric($epsg);
+foreach($posX as $x) $numeric = $numeric && is_numeric($x);
+foreach($posY as $y) $numeric = $numeric && is_numeric($y);
+if (!$numeric) // Security check
+{
+ die("Elements of x and y, as well as srs need to be numeric!");
+}
+
+
// check if parameters are valid geometries to
// avoid SQL injections
$regExp = "/\d(,\d)*/";
@@ -114,7 +123,7 @@
}
echo "<br>";
- echo "Umfang: ". $length . " m";
+ echo "Umfang: ". htmlentities($length, ENT_QUOTES) . " m";
}
else {
$e = new mb_exception("mod_evalArea.php: invalid input geometry; coordinates not float values.");
@@ -151,4 +160,4 @@
*/
?>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: branches/2.4.5/http/php/mod_getStyles.php
===================================================================
--- branches/2.4.5/http/php/mod_getStyles.php 2010-08-26 12:47:15 UTC (rev 6821)
+++ branches/2.4.5/http/php/mod_getStyles.php 2010-08-26 13:40:40 UTC (rev 6822)
@@ -166,7 +166,7 @@
$cnt++;
}
echo "</select><br>";
-echo "<textarea class='textfield' name='url' cols='70' rows='3' wrap='virtual'>".$getStyle."</textarea><br>";
+echo "<textarea class='textfield' name='url' cols='70' rows='3' wrap='virtual'>".htmlentities($getStyle,ENT_QUOTES)."</textarea><br>";
echo "<input class='button_del' type='button' value='getStyle' onclick='validate()'><br>";
if($style_filename){
$style_file = fopen($style_filename,"r");
Modified: branches/2.4.5/http/php/mod_layerMetadata.php
===================================================================
--- branches/2.4.5/http/php/mod_layerMetadata.php 2010-08-26 12:47:15 UTC (rev 6821)
+++ branches/2.4.5/http/php/mod_layerMetadata.php 2010-08-26 13:40:40 UTC (rev 6822)
@@ -58,7 +58,7 @@
</head>
<body>
<?php
- $layer_id = $_GET['id'];
+ $layer_id = htmlentities($_GET['id'], ENT_QUOTES);
$wms_getmap = urldecode($_GET['wms']);
$layer_name = urldecode($_GET['name']);
Modified: branches/2.4.5/http/php/mod_printView1.php
===================================================================
--- branches/2.4.5/http/php/mod_printView1.php 2010-08-26 12:47:15 UTC (rev 6821)
+++ branches/2.4.5/http/php/mod_printView1.php 2010-08-26 13:40:40 UTC (rev 6822)
@@ -76,18 +76,18 @@
echo "<img class='bg_header' style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left+1)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;' src='../img/white.gif'>";
echo "<div style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left+1)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;'>";
-echo "<div style='position:relative;left:5px; font-weight:bold; font-size:20px;z-index:3;'>".$printTitle . "</div>";
+echo "<div style='position:relative;left:5px; font-weight:bold; font-size:20px;z-index:3;'>".htmlentities($printTitle, ENT_QUOTES) . "</div>";
echo "<div style='position:relative;left:5px;z-index:3;'>Datum: ".$date . "</div>";
-echo "<div style='position:relative;left:5px;z-index:3;'>Ma�stab: 1:".$map_scale . "</div>";
+echo "<div style='position:relative;left:5px;z-index:3;'>Ma�stab: 1:". htmlentities($map_scale, ENT_QUOTES) . "</div>";
echo"</div>";
echo "<img class='bg_header' style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left + $map_width/2+2)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;' src='../img/white.gif'>";
echo "<div style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left + $map_width/2+2)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;' >";
-echo "<div style='position:relative;left:5px;z-index:3;'>".$printComment . "</div>";
+echo "<div style='position:relative;left:5px;z-index:3;'>". htmlentities($printComment, ENT_QUOTES) . "</div>";
echo"</div>";
echo "<div style='position: absolute; top:".($printOffset_top + $header_height + $map_height+5)."px;left:".($printOffset_left+2)."px; z-index:3;font-size:10px' >";
-echo $footer;
+echo htmlentities($footer, ENT_QUOTES);
echo "</div>";
#$myfactor = 37.81;
#echo "<img style='position: absolute; top:".($printOffset_top + $header_height + $map_height+10)."px;left:".($printOffset_left+2)."px; ' src='../img/black.gif' height='2' width='".(10 * $myfactor)."'>";
Modified: branches/2.4.5/http/php/mod_saveWKT.php
===================================================================
--- branches/2.4.5/http/php/mod_saveWKT.php 2010-08-26 12:47:15 UTC (rev 6821)
+++ branches/2.4.5/http/php/mod_saveWKT.php 2010-08-26 13:40:40 UTC (rev 6822)
@@ -18,6 +18,9 @@
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+die("This script has many security issues and should not be used! Activate it at your own risk!");
+
require_once(dirname(__FILE__)."/../php/mb_validateSession.php");
?>
<html>
@@ -234,4 +237,4 @@
?>
</form>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: branches/2.4.5/http/php/nestedSets.php
===================================================================
--- branches/2.4.5/http/php/nestedSets.php 2010-08-26 12:47:15 UTC (rev 6821)
+++ branches/2.4.5/http/php/nestedSets.php 2010-08-26 13:40:40 UTC (rev 6822)
@@ -238,7 +238,7 @@
<!-- -->
<?php
if(isset($guiList) && $guiList != ""){
- echo "<iframe ID='foldertree' name='foldertree' height='400' width='300' src='mod_treefolderAdmin.php?guiList=".$guiList."' scrolling='auto' frameborder='1'></iframe>";
+ echo "<iframe ID='foldertree' name='foldertree' height='400' width='300' src='mod_treefolderAdmin.php?guiList=".urlencode($guiList)."' scrolling='auto' frameborder='1'></iframe>";
}
else{
echo "<iframe ID='foldertree' name='foldertree' height='400' width='300' src='../html/mod_blank.html' scrolling='auto' frameborder='1'></iframe>";
@@ -284,7 +284,7 @@
#echo "<td>Beschriftung:</td>";
echo "<td>Labeling:</td>";
echo "<td><input type='text' size='16' name='name' value='";
- echo $name;
+ echo htmlentities($name, ENT_QUOTES);
echo "'></td>";
echo "</tr>";
?>
@@ -362,7 +362,7 @@
echo "<td><input type='text' size='1' name='left' ";
if($left)
{
- echo "value='".$left."'";
+ echo "value='".htmlentities($left,ENT_QUOTES)."'";
}
echo "></td>";
?>
More information about the Mapbender_commits
mailing list