[Mapbender-commits] r6820 - in trunk/mapbender/http:
extensions/datepicker php
svn_mapbender at osgeo.org
svn_mapbender at osgeo.org
Thu Aug 26 08:13:52 EDT 2010
Author: christoph
Date: 2010-08-26 12:13:52 +0000 (Thu, 26 Aug 2010)
New Revision: 6820
Modified:
trunk/mapbender/http/extensions/datepicker/datepicker.php
trunk/mapbender/http/php/mod_changePassword.php
trunk/mapbender/http/php/mod_evalArea.php
trunk/mapbender/http/php/mod_getStyles.php
trunk/mapbender/http/php/mod_layerMetadata.php
trunk/mapbender/http/php/mod_printView1.php
trunk/mapbender/http/php/mod_saveWKT.php
trunk/mapbender/http/php/mod_showGuiName.php
trunk/mapbender/http/php/nestedSets.php
Log:
some bug fixes from 2.6.3
Modified: trunk/mapbender/http/extensions/datepicker/datepicker.php
===================================================================
--- trunk/mapbender/http/extensions/datepicker/datepicker.php 2010-08-26 12:01:35 UTC (rev 6819)
+++ trunk/mapbender/http/extensions/datepicker/datepicker.php 2010-08-26 12:13:52 UTC (rev 6820)
@@ -1,9 +1,17 @@
<?php
$name_month = explode("_",$_REQUEST["m"]);
-$name_day2 = explode("_",$_REQUEST["d"]);
-$today = $_REQUEST["t"];
+foreach (array_keys($name_month) as $index) {
+ $name_month[$index] = htmlentities($name_month[$index], ENT_QUOTES);
+}
+$name_day = explode("_",$_REQUEST["d"]);
+foreach (array_keys($name_day) as $index) {
+ $name_day[$index] = htmlentities($name_day[$index], ENT_QUOTES);
+}
+
+$today = htmlentities($_REQUEST["t"], ENT_QUOTES);
+
echo "<html>
<head>
<title>Datepicker</title>
@@ -50,7 +58,7 @@
<table cellSpacing=0 cellPadding=0 width=200 border=2>
<tr id=cal>\n";
for ($i=0; $i<7; $i++){
- echo "<td>".$name_day2[$i]."</td>\n";
+ echo "<td>".$name_day[$i]."</td>\n";
}
echo "</tr><tr>\n";
for ($i=1; $i<43; $i++){
Modified: trunk/mapbender/http/php/mod_changePassword.php
===================================================================
--- trunk/mapbender/http/php/mod_changePassword.php 2010-08-26 12:01:35 UTC (rev 6819)
+++ trunk/mapbender/http/php/mod_changePassword.php 2010-08-26 12:13:52 UTC (rev 6820)
@@ -116,11 +116,14 @@
$t = array('i');
$res_user_id = db_prep_query($sql_user_id,$v,$t);
$real_user_id = db_result($res_user_id,0,"mb_user_id");
+
$sql_password = "SELECT mb_user_password, mb_user_password = $1 as new FROM mb_user where mb_user_id = $2";
$v = array($newpassword,$real_user_id);
$t = array('s','i');
$res_password = db_prep_query($sql_password,$v,$t);
- if(db_result($res_password,0,"mb_user_password") != db_result($res_password,0,"new")){
+
+ if( db_result($res_password,0,"mb_user_password") == md5($oldpassword) &&
+ db_result($res_password,0,"mb_user_password") != db_result($res_password,0,"new")){
$sql_update = "UPDATE mb_user SET mb_user_password = $1";
$v = array(md5($newpassword));
$t = array('s');
@@ -133,8 +136,12 @@
echo "alert('Password has been updated!');";
echo "</script>";
}
- else{
+ elseif (db_result($res_password,0,"mb_user_password") != md5($oldpassword)){
echo "<script language='javascript'>";
+ echo "alert('Please enter the correct current password!');";
+ echo "</script>";
+ } else {
+ echo "<script language='javascript'>";
//echo "alert('Bitte beachten Sie die unten aufgef�hrten Passwortregeln!');";
echo "alert('Please note the rules for choosing a password below!');";
echo "</script>";
@@ -145,7 +152,16 @@
echo "<fieldset><legend>Change password:</legend>";
echo "<form name='form1' action='" . $self ."' method='post'>";
echo "<table cellpadding='5' cellspacing='0' border='0'>";
+echo "<tr>";
echo "<td>";
+echo "old password:";
+echo "</td>";
+echo "<td>";
+echo "<input type='password' name='oldpassword' value=''>";
+echo "</td>";
+echo"</tr>";
+echo "<tr>";
+echo "<td>";
echo "new password:";
echo "</td>";
echo "<td>";
@@ -185,4 +201,4 @@
</ul>
</div>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: trunk/mapbender/http/php/mod_evalArea.php
===================================================================
--- trunk/mapbender/http/php/mod_evalArea.php 2010-08-26 12:01:35 UTC (rev 6819)
+++ trunk/mapbender/http/php/mod_evalArea.php 2010-08-26 12:13:52 UTC (rev 6820)
@@ -55,7 +55,16 @@
$posX = explode (",", $x);
$posY = explode (",", $y);
+$numeric = is_numeric($epsg);
+foreach($posX as $x) $numeric = $numeric && is_numeric($x);
+foreach($posY as $y) $numeric = $numeric && is_numeric($y);
+if (!$numeric) // Security check
+{
+ die("Elements of x and y, as well as srs need to be numeric!");
+}
+
+
if(SYS_DBTYPE=='pgsql'){
if(count($posX) > 3){
$sql = "SELECT area2d(GeometryFromText('MULTIPOLYGON(((";
@@ -104,7 +113,7 @@
}
echo "<br>";
-echo "Umfang: ". $length . " m";
+echo "Umfang: ". htmlentities($length,ENT_QUOTES) . " m";
echo "<br><br><input type='button' value='Schließen' onclick='window.close()'>";
#Centroid(geometry)
@@ -136,4 +145,4 @@
*/
?>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: trunk/mapbender/http/php/mod_getStyles.php
===================================================================
--- trunk/mapbender/http/php/mod_getStyles.php 2010-08-26 12:01:35 UTC (rev 6819)
+++ trunk/mapbender/http/php/mod_getStyles.php 2010-08-26 12:13:52 UTC (rev 6820)
@@ -164,7 +164,7 @@
$cnt++;
}
echo "</select><br>";
-echo "<textarea class='textfield' name='url' cols='70' rows='3' wrap='virtual'>".$getStyle."</textarea><br>";
+echo "<textarea class='textfield' name='url' cols='70' rows='3' wrap='virtual'>".htmlentities($getStyle,ENT_QUOTES)."</textarea><br>";
echo "<input class='button_del' type='button' value='getStyle' onclick='validate()'><br>";
if($style_filename){
$style_file = fopen($style_filename,"r");
Modified: trunk/mapbender/http/php/mod_layerMetadata.php
===================================================================
--- trunk/mapbender/http/php/mod_layerMetadata.php 2010-08-26 12:01:35 UTC (rev 6819)
+++ trunk/mapbender/http/php/mod_layerMetadata.php 2010-08-26 12:13:52 UTC (rev 6820)
@@ -20,9 +20,9 @@
require_once dirname(__FILE__) . "/../../core/globalSettings.php";
require_once dirname(__FILE__) . "/../classes/class_user.php";
-$redirectToMetadataUrl = $_GET["redirectToMetadataUrl"];
+$redirectToMetadataUrl = intval($_GET["redirectToMetadataUrl"]);
$subscribe = intval($_GET["subscribe"]);
-$layer_id = $_GET['id'];
+$layer_id = htmlentities($_GET['id'], ENT_QUOTES);
$wms_getmap = urldecode($_GET['wms']);
$layer_name = urldecode($_GET['name']);
Modified: trunk/mapbender/http/php/mod_printView1.php
===================================================================
--- trunk/mapbender/http/php/mod_printView1.php 2010-08-26 12:01:35 UTC (rev 6819)
+++ trunk/mapbender/http/php/mod_printView1.php 2010-08-26 12:13:52 UTC (rev 6820)
@@ -75,18 +75,18 @@
echo "<img class='bg_header' style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left+1)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;' src='../img/white.gif'>";
echo "<div style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left+1)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;'>";
-echo "<div style='position:relative;left:5px; font-weight:bold; font-size:20px;z-index:3;'>".$printTitle . "</div>";
+echo "<div style='position:relative;left:5px; font-weight:bold; font-size:20px;z-index:3;'>".htmlentities($printTitle, ENT_QUOTES) . "</div>";
echo "<div style='position:relative;left:5px;z-index:3;'>Datum: ".$date . "</div>";
-echo "<div style='position:relative;left:5px;z-index:3;'>Ma�stab: 1:".$map_scale . "</div>";
+echo "<div style='position:relative;left:5px;z-index:3;'>Ma�stab: 1:". htmlentities($map_scale, ENT_QUOTES) . "</div>";
echo"</div>";
echo "<img class='bg_header' style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left + $map_width/2+2)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;' src='../img/white.gif'>";
echo "<div style='position: absolute; top:".($printOffset_top+1)."px;left:".($printOffset_left + $map_width/2+2)."px; z-index:1;width:".($map_width/2-1)."px; height:".($header_height -2)."px;' >";
-echo "<div style='position:relative;left:5px;z-index:3;'>".$printComment . "</div>";
+echo "<div style='position:relative;left:5px;z-index:3;'>". htmlentities($printComment, ENT_QUOTES) . "</div>";
echo"</div>";
echo "<div style='position: absolute; top:".($printOffset_top + $header_height + $map_height+5)."px;left:".($printOffset_left+2)."px; z-index:3;font-size:10px' >";
-echo $footer;
+echo htmlentities($footer, ENT_QUOTES);
echo "</div>";
#$myfactor = 37.81;
#echo "<img style='position: absolute; top:".($printOffset_top + $header_height + $map_height+10)."px;left:".($printOffset_left+2)."px; ' src='../img/black.gif' height='2' width='".(10 * $myfactor)."'>";
Modified: trunk/mapbender/http/php/mod_saveWKT.php
===================================================================
--- trunk/mapbender/http/php/mod_saveWKT.php 2010-08-26 12:01:35 UTC (rev 6819)
+++ trunk/mapbender/http/php/mod_saveWKT.php 2010-08-26 12:13:52 UTC (rev 6820)
@@ -18,6 +18,9 @@
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+die("This script has many security issues and should not be used! Activate it at your own risk!");
+
require_once(dirname(__FILE__)."/../php/mb_validateSession.php");
?>
<html>
@@ -234,4 +237,4 @@
?>
</form>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: trunk/mapbender/http/php/mod_showGuiName.php
===================================================================
--- trunk/mapbender/http/php/mod_showGuiName.php 2010-08-26 12:01:35 UTC (rev 6819)
+++ trunk/mapbender/http/php/mod_showGuiName.php 2010-08-26 12:13:52 UTC (rev 6820)
@@ -35,8 +35,8 @@
<?php
$guiName=$_REQUEST["gui_name"];
-echo "<div class='text4'>".$gui_id."</div>";
+echo "<div class='text4'>".htmlentities($gui_id,ENT_QUOTES)."</div>";
?>
</body>
-</html>
\ No newline at end of file
+</html>
Modified: trunk/mapbender/http/php/nestedSets.php
===================================================================
--- trunk/mapbender/http/php/nestedSets.php 2010-08-26 12:01:35 UTC (rev 6819)
+++ trunk/mapbender/http/php/nestedSets.php 2010-08-26 12:13:52 UTC (rev 6820)
@@ -239,7 +239,7 @@
<!-- -->
<?php
if(isset($guiList) && $guiList != ""){
- echo "<iframe ID='foldertree' name='foldertree' height='400' width='300' src='mod_treefolderAdmin.php?guiList=".$guiList."' scrolling='auto' frameborder='1'></iframe>";
+ echo "<iframe ID='foldertree' name='foldertree' height='400' width='300' src='mod_treefolderAdmin.php?guiList=".urlencode($guiList)."' scrolling='auto' frameborder='1'></iframe>";
}
else{
echo "<iframe ID='foldertree' name='foldertree' height='400' width='300' src='../html/mod_blank.html' scrolling='auto' frameborder='1'></iframe>";
@@ -285,7 +285,7 @@
#echo "<td>Beschriftung:</td>";
echo "<td>Labeling:</td>";
echo "<td><input type='text' size='16' name='name' value='";
- echo $name;
+ echo htmlentities($name, ENT_QUOTES);
echo "'></td>";
echo "</tr>";
?>
@@ -363,7 +363,7 @@
echo "<td><input type='text' size='1' name='left' ";
if($left)
{
- echo "value='".$left."'";
+ echo "value='".htmlentities($left,ENT_QUOTES)."'";
}
echo "></td>";
?>
More information about the Mapbender_commits
mailing list