Skip to content

Commit 4a58770

Browse files
AngelFQCAngelFQC
committed
Add html filter to form fields
1 parent fe28c31 commit 4a58770

File tree

9 files changed

+62
-13
lines changed

9 files changed

+62
-13
lines changed

‎main/admin/configure_homepage.php

Lines changed: 37 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
* @package chamilo.admin
88
*/
99

10+
use Symfony\Component\HttpFoundation\Request as HttpRequest;
11+
1012
/**
1113
* Creates menu tabs for logged and anonymous users.
1214
*
@@ -58,6 +60,8 @@ function home_tabs($file_logged_in)
5860

5961
api_protect_admin_script();
6062

63+
$httpRequest = HttpRequest::createFromGlobals();
64+
6165
$htmlHeadXtra[] = '<script>
6266
$(function() {
6367
$("#all_langs").change(function() {
@@ -382,14 +386,14 @@ function home_tabs($file_logged_in)
382386
case 'edit_tabs':
383387
case 'insert_link':
384388
case 'edit_link':
385-
$link_index = (isset($_POST['link_index']) ? intval($_POST['link_index']) : 0);
386-
$insert_where = (isset($_POST['insert_where']) ? intval($_POST['insert_where']) : 0);
387-
$link_name = trim(stripslashes($_POST['link_name']));
388-
$link_url = trim(stripslashes($_POST['link_url']));
389-
$add_in_tab = (isset($_POST['add_in_tab']) ? intval($_POST['add_in_tab']) : 0);
390-
$link_html = trim(stripslashes($_POST['link_html']));
391-
$filename = trim(stripslashes($_POST['filename']));
392-
$target_blank = isset($_POST['target_blank']);
389+
$link_index = $httpRequest->request->getInt('link_index');
390+
$insert_where = $httpRequest->request->getInt('insert_where');
391+
$link_name = Security::remove_XSS($httpRequest->request->get('link_name'));
392+
$link_url = Security::remove_XSS($_POST['link_url']);
393+
$add_in_tab = $httpRequest->request->getInt('add_in_tab');
394+
$link_html = Security::remove_XSS($_POST['link_html']);
395+
$filename = Security::remove_XSS($_POST['filename']);
396+
$target_blank = $httpRequest->request->has('target_blank');
393397

394398
if ($link_url == 'http://' || $link_url == 'https://') {
395399
$link_url = '';
@@ -895,12 +899,14 @@ class="form-control"><?php echo $notice_text; ?></textarea>
895899
$form->addElement('hidden', 'filename', ($action == 'edit_link' || $action == 'edit_tabs') ? (!empty($filename) ? $filename : '') : '');
896900

897901
$form->addElement('text', 'link_name', get_lang('LinkName'), ['size' => '30', 'maxlength' => '50']);
902+
$form->applyFilter('text', 'html_filter');
898903
if (!empty($link_name)) {
899904
$default['link_name'] = $link_name;
900905
}
901906
$default['link_url'] = empty($link_url) ? 'http://' : api_htmlentities($link_url, ENT_QUOTES);
902907
$linkUrlComment = ($action == 'insert_tabs') ? get_lang('Optional').'<br />'.get_lang('GlobalLinkUseDoubleColumnPrivateToShowPrivately') : '';
903908
$form->addElement('text', 'link_url', [get_lang('LinkURL'), $linkUrlComment], ['size' => '30', 'maxlength' => '100', 'style' => 'width: 350px;']);
909+
$form->applyFilter('link_url', 'html_filter');
904910

905911
$options = ['-1' => get_lang('FirstPlace')];
906912

@@ -1139,12 +1145,32 @@ class="form-control"><?php echo $notice_text; ?></textarea>
11391145
$home_menu = explode("\n", $home_menu);
11401146
}
11411147
$i = 0;
1148+
1149+
$editIcon = Display::return_icon('edit.png', get_lang('Edit'));
1150+
$deleteIcon = Display::return_icon('delete.png', get_lang('Delete'));
1151+
11421152
foreach ($home_menu as $enreg) {
11431153
$enreg = trim($enreg);
11441154
if (!empty($enreg)) {
1145-
$edit_link = '<a href="'.$selfUrl.'?action=edit_link&amp;link_index='.$i.'">'.Display::return_icon('edit.png', get_lang('Edit')).'</a>';
1146-
$delete_link = '<a href="'.$selfUrl.'?action=delete_link&amp;link_index='.$i.'" onclick="javascript:if(!confirm(\''.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES)).'\')) return false;">'.Display::return_icon('delete.png', get_lang('Delete')).'</a>';
1147-
echo str_replace(['href="'.api_get_path(WEB_PATH).'index.php?include=', '</li>'], ['href="'.api_get_path(WEB_CODE_PATH).'admin/'.basename($selfUrl).'?action=open_link&link=', $edit_link.' '.$delete_link.'</li>'], $enreg);
1155+
$edit_link = Display::url(
1156+
$editIcon,
1157+
"$selfUrl?".http_build_query(['action' => 'edit_link', 'link_index' => $i])
1158+
);
1159+
$delete_link = Display::url(
1160+
$deleteIcon,
1161+
"$selfUrl?".http_build_query(['action' => 'delete_link', 'link_index' => $i]),
1162+
[
1163+
'onclick' => 'javascript:if(!confirm(\''.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES)).'\')) return false;',
1164+
]
1165+
);
1166+
echo str_replace(
1167+
['href="'.api_get_path(WEB_PATH).'index.php?include=', '</li>'],
1168+
[
1169+
'href="'.api_get_path(WEB_CODE_PATH).'admin/'.basename($selfUrl).'?action=open_link&link=',
1170+
$edit_link.PHP_EOL.$delete_link.PHP_EOL.'</li>'
1171+
],
1172+
$enreg
1173+
);
11481174
$i++;
11491175
}
11501176
}

‎main/admin/resource_sequence.php

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
use Chamilo\CoreBundle\Entity\Sequence;
66
use Chamilo\CoreBundle\Entity\SequenceResource;
77
use ChamiloSession as Session;
8+
use Symfony\Component\HttpFoundation\Request as HttpRequest;
89

910
$cidReset = true;
1011

@@ -14,10 +15,14 @@
1415

1516
Session::erase('sr_vertex');
1617

18+
$httpRequest = HttpRequest::createFromGlobals();
19+
1720
// setting breadcrumbs
1821
$interbreadcrumb[] = ['url' => 'index.php', 'name' => get_lang('PlatformAdmin')];
1922

20-
$type = isset($_REQUEST['type']) ? (int) $_REQUEST['type'] : SequenceResource::SESSION_TYPE;
23+
$type = $httpRequest->query->has('type')
24+
? $httpRequest->query->getInt('type', SequenceResource::SESSION_TYPE)
25+
: $httpRequest->request->getInt('type', SequenceResource::SESSION_TYPE);
2126

2227
$tpl = new Template(get_lang('ResourcesSequencing'));
2328
$em = Database::getManager();
@@ -27,6 +32,7 @@
2732

2833
$formSequence = new FormValidator('sequence_form', 'post', $currentUrl, null, null, FormValidator::LAYOUT_INLINE);
2934
$formSequence->addText('name', get_lang('Sequence'), true, ['cols-size' => [3, 8, 1]]);
35+
$formSequence->applyFilter('name', 'html_filter');
3036
$formSequence->addButtonCreate(get_lang('AddSequence'), 'submit_sequence', false, ['cols-size' => [3, 8, 1]]);
3137

3238
$em = Database::getManager();

‎main/admin/system_announcements.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,7 @@
185185

186186
$form->addHeader($form_title);
187187
$form->addText('title', get_lang('Title'), true);
188+
$form->applyFilter('title', 'html_filter');
188189

189190
$extraOption = [];
190191
$extraOption['all'] = get_lang('All');

‎main/forum/forumfunction.inc.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,7 @@ function show_add_forumcategory_form($lp_id)
201201
// Setting the form elements.
202202
$form->addElement('header', get_lang('AddForumCategory'));
203203
$form->addElement('text', 'forum_category_title', get_lang('Title'), ['autofocus']);
204+
$form->applyFilter('forum_category_title', 'html_filter');
204205
$form->addElement(
205206
'html_editor',
206207
'forum_category_comment',
@@ -279,6 +280,7 @@ function show_add_forum_form($inputvalues = [], $lp_id = 0)
279280

280281
// The title of the forum
281282
$form->addElement('text', 'forum_title', get_lang('Title'), ['autofocus']);
283+
$form->applyFilter('forum_title', 'html_filter');
282284

283285
// The comment of the forum.
284286
$form->addElement(
@@ -529,6 +531,7 @@ function show_edit_forumcategory_form($inputvalues = [])
529531
$form->addElement('header', '', get_lang('EditForumCategory'));
530532
$form->addElement('hidden', 'forum_category_id');
531533
$form->addElement('text', 'forum_category_title', get_lang('Title'));
534+
$form->applyFilter('forum_category_title', 'html_filter');
532535

533536
$form->addElement(
534537
'html_editor',
@@ -3197,6 +3200,7 @@ function show_add_post_form($current_forum, $action, $form_values = [], $showPre
31973200
}
31983201

31993202
$form->addElement('text', 'post_title', get_lang('Title'));
3203+
$form->applyFilter('post_title', 'post_filter');
32003204
$form->addHtmlEditor(
32013205
'post_text',
32023206
get_lang('Text'),

‎main/inc/lib/extra_field.lib.php

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1098,6 +1098,10 @@ public function set_extra_fields_in_form(
10981098
'extra_'.$field_details['variable'],
10991099
'trim'
11001100
);
1101+
$form->applyFilter(
1102+
'extra_'.$field_details['variable'],
1103+
'html_filter'
1104+
);
11011105
if ($freezeElement) {
11021106
$form->freeze('extra_'.$field_details['variable']);
11031107
}
@@ -1523,6 +1527,7 @@ public function set_extra_fields_in_form(
15231527
);
15241528
$form->applyFilter('extra_'.$field_details['variable'], 'stripslashes');
15251529
$form->applyFilter('extra_'.$field_details['variable'], 'trim');
1530+
$form->applyFilter('extra_'.$field_details['variable'], 'html_filter');
15261531
if ($freezeElement) {
15271532
$form->freeze('extra_'.$field_details['variable']);
15281533
}
@@ -1537,6 +1542,7 @@ public function set_extra_fields_in_form(
15371542
$form->applyFilter('extra_'.$field_details['variable'], 'stripslashes');
15381543
$form->applyFilter('extra_'.$field_details['variable'], 'trim');
15391544
$form->applyFilter('extra_'.$field_details['variable'], 'mobile_phone_number_filter');
1545+
$form->applyFilter('extra_'.$field_details['variable'], 'html_filter');
15401546
$form->addRule(
15411547
'extra_'.$field_details['variable'],
15421548
get_lang('MobilePhoneNumberWrong'),

‎main/inc/lib/formvalidator/FormValidator.class.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,7 @@ public function addText($name, $label, $required = true, $attributes = [], $crea
216216
}
217217

218218
$this->applyFilter($name, 'trim');
219+
$this->applyFilter($name, 'html_filter');
219220
if ($required) {
220221
$this->addRule($name, get_lang('ThisFieldIsRequired'), 'required');
221222
}

‎main/mySpace/access_details.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,9 @@
5454
['id' => 'type']
5555
);
5656
$form->addElement('hidden', 'student', $user_id);
57+
$form->applyFilter('student', 'html_filter');
5758
$form->addElement('hidden', 'course', $course_code);
59+
$form->applyFilter('course', 'html_filter');
5860
$form->addRule('from', get_lang('ThisFieldIsRequired'), 'required');
5961
$form->addRule('to', get_lang('ThisFieldIsRequired'), 'required');
6062
$group = [
@@ -73,7 +75,7 @@
7375
$to = null;
7476
$course = $course_code;
7577
if ($form->validate()) {
76-
$values = $form->getSubmitValues();
78+
$values = $form->exportValues();
7779
$from = $values['from'];
7880
$to = $values['to'];
7981
$type = $values['type'];

‎main/notebook/index.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ function setFocus(){
8989
// Setting the form elements
9090
$form->addElement('header', '', get_lang('NoteAddNew'));
9191
$form->addElement('text', 'note_title', get_lang('NoteTitle'), ['id' => 'note_title']);
92+
$form->applyFilter('text', 'html_filter');
9293
$form->addElement(
9394
'html_editor',
9495
'note_comment',
@@ -146,6 +147,7 @@ function setFocus(){
146147
$form->addElement('header', '', get_lang('ModifyNote'));
147148
$form->addElement('hidden', 'notebook_id');
148149
$form->addElement('text', 'note_title', get_lang('NoteTitle'), ['size' => '100']);
150+
$form->applyFilter('text', 'html_filter');
149151
$form->addElement(
150152
'html_editor',
151153
'note_comment',

‎plugin/notebookteacher/src/NotebookTeacher.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -511,6 +511,7 @@ public static function getForm($form, $studentId)
511511
);
512512

513513
$form->addElement('text', 'note_title', get_lang('NoteTitle'), ['id' => 'note_title']);
514+
$form->applyFilter('text', 'html_filter');
514515
$form->addElement(
515516
'html_editor',
516517
'note_comment',

0 commit comments

Comments
 (0)