ChangeSet ID: 30860
CVSROOT: /opt/cvs-commit
Module name: appdb
Changes by: wineowner(a)winehq.org 2007/01/06 00:27:51
Modified files:
include : filter.php
unit_test : run_tests.php
Added files:
unit_test : test_filter.php
Log message:
Chris Morgan <cmorgan(a)alum.wpi.edu>
filter_gpc() should report success or failure, a higher level function should take care of calling out to an error page.
Add a unit test for filter_gpc() and test filtering success, failure and test that the filtering of html and normal strings
properly preserves tags for html strings and strips them from normal strings
Patch: http://cvs.winehq.org/patch.py?id=30860
Old revision New revision Changes Path
1.12 1.13 +29 -7 appdb/include/filter.php
1.8 1.9 +2 -0 appdb/unit_test/run_tests.php
Added 1.1 +0 -0 appdb/unit_test/test_filter.php
ChangeSet ID: 30858
CVSROOT: /opt/cvs-commit
Module name: appdb
Changes by: wineowner(a)winehq.org 2007/01/05 23:30:31
Modified files:
include : filter.php
Log message:
Chris Morgan <cmorgan(a)alum.wpi.edu>
Fix filtering of html, we shouldn't be running htmlspecialchars() on html code that needs to be
preserved without modification
Patch: http://cvs.winehq.org/patch.py?id=30858
Old revision New revision Changes Path
1.11 1.12 +1 -1 appdb/include/filter.php
Index: appdb/include/filter.php
diff -u -p appdb/include/filter.php:1.11 appdb/include/filter.php:1.12
--- appdb/include/filter.php:1.11 6 Jan 2007 5:30:31 -0000
+++ appdb/include/filter.php 6 Jan 2007 5:30:31 -0000
@@ -52,7 +52,7 @@ function filter_gpc()
switch($aKeys[$i][1])
{
case "h": // HTML string
- $aClean[$aKeys[$i]] = trim(htmlspecialchars($_REQUEST[$aKeys[$i]]));
+ $aClean[$aKeys[$i]] = trim($_REQUEST[$aKeys[$i]]);
// if there is no content and no image, make the variable empty
if(strip_tags($aClean[$aKeys[$i]],'<img>')=="")
$aClean[$aKeys[$i]] = "";
ChangeSet ID: 30857
CVSROOT: /opt/cvs-commit
Module name: appdb
Changes by: wineowner(a)winehq.org 2007/01/05 23:03:58
Modified files:
include : incl.php
Log message:
Chris Morgan <cmorgan(a)alum.wpi.edu>
Fix session errors that occur when filtering detects a problem by moving filtering to the end of
incl.php and after we setup the session.
Patch: http://cvs.winehq.org/patch.py?id=30857
Old revision New revision Changes Path
1.40 1.41 +4 -5 appdb/include/incl.php
Index: appdb/include/incl.php
diff -u -p appdb/include/incl.php:1.40 appdb/include/incl.php:1.41
--- appdb/include/incl.php:1.40 6 Jan 2007 5: 3:58 -0000
+++ appdb/include/incl.php 6 Jan 2007 5: 3:58 -0000
@@ -81,11 +81,6 @@ if(isset($_REQUEST['mode']))
}
/* End backwards compatibility code */
-
-// include filter.php to filter all REQUEST input
-require(BASE."include/filter.php");
-
-
// create arrays
$sidebar_func_list = array();
$help_list = array();
@@ -295,4 +290,8 @@ if(!isset($_SESSION['current']))
// if we are debugging we need to see all errors
if($_SESSION['current']->showDebuggingInfos()) error_reporting(E_ALL ^ E_NOTICE);
+
+// include filter.php to filter all REQUEST input
+require(BASE."include/filter.php");
+
?>
ChangeSet ID: 30856
CVSROOT: /opt/cvs-commit
Module name: appdb
Changes by: wineowner(a)winehq.org 2007/01/05 22:34:13
Modified files:
include : filter.php
Log message:
Alexander Nicolaysen Sørnes <alex(a)thehandofagony.com>
Fix filtering by comparing strpos identically with 0 using === instead of just equality with ==
Patch: http://cvs.winehq.org/patch.py?id=30856
Old revision New revision Changes Path
1.10 1.11 +2 -2 appdb/include/filter.php
Index: appdb/include/filter.php
diff -u -p appdb/include/filter.php:1.10 appdb/include/filter.php:1.11
--- appdb/include/filter.php:1.10 6 Jan 2007 4:34:13 -0000
+++ appdb/include/filter.php 6 Jan 2007 4:34:13 -0000
@@ -14,7 +14,7 @@ function filter_gpc()
// Special cases for variables that don't fit our filtering scheme
// don't filter the AppDB session cookie and MAX_FILE_SIZE
// and the DialogX values that xinha uses
- if(strpos($aKeys[$i], "Dialog") == 0) // Xinha variables
+ if(strpos($aKeys[$i], "Dialog") === 0) // Xinha variables
{
// copy the key over to the clean array
// NOTE: we do not strip html tags or trim any Xinha variables
@@ -24,7 +24,7 @@ function filter_gpc()
continue; // go to the next entry
} else if($aKeys[$i] == "whq_appdb" || ($aKeys[$i] == "MAX_FILE_SIZE")
|| ($aKeys[$i] == "PHPSESSID")
- || (strpos($aKeys[$i], "pref_") == 0)) // other variables
+ || (strpos($aKeys[$i], "pref_")) === 0) // other variables
{
// copy the key over to the clean array after stripping tags and trimming
$aClean[$aKeys[$i]] = trim(strip_tags($_REQUEST[$aKeys[$i]]));