Changeset 230


Ignore:
Timestamp:
01/09/2010 05:02:33 PM (2 years ago)
Author:
Acinonyx
Message:

[awmn] Escape HTML special characters

Location:
branches/awmn
Files:
8 edited

Legend:

Unmodified
Added
Removed
  • branches/awmn/globals/functions.php

    r229 r230  
    44 * 
    55 * Copyright (C) 2005 Nikolaos Nikalexis <winner@cube.gr> 
    6  * Copyright (C) 2009 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
     6 * Copyright (C) 2009-2010 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
    77 *  
    88 * This program is free software; you can redistribute it and/or modify 
     
    3939} 
    4040 
    41 function get_qs() { 
     41function get_qs($htmlspecialchars=TRUE) { 
     42        $ret = ""; 
    4243        if ($_SERVER['REQUEST_METHOD'] == 'GET') { 
    43                 return $_SERVER['QUERY_STRING']; 
    44         } else { 
    45                 return $_POST['query_string']; 
    46         } 
     44                $ret = $_SERVER['QUERY_STRING']; 
     45        } else { 
     46                $ret = $_POST['query_string']; 
     47        } 
     48        return ($htmlspecialchars?htmlspecialchars($ret):$ret); 
    4749} 
    4850 
     
    105107        if(get('show_map') == "no") $o = array_merge($o,array("show_map" => "no")); 
    106108        if ($cur_qs == TRUE) { 
    107                 parse_str(get_qs(), $qs); 
     109                parse_str(get_qs(FALSE), $qs); 
    108110                $o = array_merge($o, $qs); 
    109111        } 
     
    338340        if ($gmap_key == '') return FALSE; 
    339341         
    340         $main->html->head->add_script("text/javascript", "http://".$vars['gmap']['server']."/maps?file=api&v=".$vars['gmap']['api']."&key=".$gmap_key."&hl=".$lang["iso639"]); 
     342        $main->html->head->add_script("text/javascript", htmlspecialchars("http://".$vars['gmap']['server']."/maps?file=api&v=".$vars['gmap']['api']."&key=".$gmap_key."&hl=".$lang["iso639"])); 
    341343        $main->html->head->add_script("text/javascript", $javascript); 
    342344        $main->html->head->add_extra( 
  • branches/awmn/includes/pages/gmap/gmap_fullmap.php

    r198 r230  
    44 * 
    55 * Copyright (C) 2005 Nikolaos Nikalexis <winner@cube.gr> 
     6 * Copyright (C) 2010 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
    67 *  
    78 * This program is free software; you can redistribute it and/or modify 
     
    3132                global $main, $vars; 
    3233                $main->menu->hide = true; 
    33                 $this->tpl['gmap_key_ok'] = include_gmap("?page=gmap&subpage=js&node=".get('node')); 
     34                $this->tpl['gmap_key_ok'] = include_gmap(htmlspecialchars("?page=gmap&subpage=js&node=".get('node'))); 
    3435                return template($this->tpl, __FILE__); 
    3536        } 
  • branches/awmn/includes/pages/nodes/nodes_search.php

    r198 r230  
    44 * 
    55 * Copyright (C) 2005 Nikolaos Nikalexis <winner@cube.gr> 
     6 * Copyright (C) 2010 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
    67 *  
    78 * This program is free software; you can redistribute it and/or modify 
     
    106107                $this->tpl['link_gearth'] = makelink(array("page" => "gearth", "subpage" => "download", "node" => get('node'), "show_p2p" => "1", "show_aps" => "1", "show_clients" => "1", "show_unlinked" => "1", "show_links_p2p" => "1", "show_links_client" => "1")); 
    107108                if(get('show_map') == "no") $this->tpl['gmap_key_ok'] = "nomap"; 
    108                 else $this->tpl['gmap_key_ok'] = include_gmap("?page=gmap&subpage=js&node=".get('node')); 
     109                else $this->tpl['gmap_key_ok'] = include_gmap(htmlspecialchars("?page=gmap&subpage=js&node=".get('node'))); 
    109110 
    110111                return template($this->tpl, __FILE__); 
  • branches/awmn/includes/pages/nodes/nodes_view.php

    r222 r230  
    44 * 
    55 * Copyright (C) 2005 Nikolaos Nikalexis <winner@cube.gr> 
    6  * Copyright (C) 2009 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
     6 * Copyright (C) 2009-2010 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
    77 *  
    88 * This program is free software; you can redistribute it and/or modify 
     
    318318                $this->tpl['link_gearth'] = makelink(array("page" => "gearth", "subpage" => "download", "node" => get('node'), "show_p2p" => "1", "show_aps" => "1", "show_clients" => "1", "show_unlinked" => "1", "show_links_p2p" => "1", "show_links_client" => "1")); 
    319319                if(get('show_map') == "no") $this->tpl['gmap_key_ok'] = "nomap"; 
    320                 else $this->tpl['gmap_key_ok'] = include_gmap("?page=gmap&subpage=js&node=".get('node')); 
     320                else $this->tpl['gmap_key_ok'] = include_gmap(htmlspecialchars("?page=gmap&subpage=js&node=".get('node'))); 
    321321                return template($this->tpl, __FILE__); 
    322322        } 
  • branches/awmn/includes/pages/pickup/pickup_gmap.php

    r198 r230  
    44 * 
    55 * Copyright (C) 2005 Nikolaos Nikalexis <winner@cube.gr> 
     6 * Copyright (C) 2010 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
    67 *  
    78 * This program is free software; you can redistribute it and/or modify 
     
    3435                $main->menu->hide = TRUE; 
    3536                $main->footer->hide = TRUE; 
    36                 $this->tpl['gmap_key_ok'] = include_gmap("?page=gmap&subpage=pickup_js&object_lat=".stripslashes(get('object_lat'))."&object_lon=".stripslashes(get('object_lon'))); 
     37                $this->tpl['gmap_key_ok'] = include_gmap(htmlspecialchars("?page=gmap&subpage=pickup_js&object_lat=".stripslashes(get('object_lat'))."&object_lon=".stripslashes(get('object_lon')))); 
    3738                return template($this->tpl, __FILE__); 
    3839        } 
  • branches/awmn/templates/basic/generic/plot.tpl

    r198 r230  
    44 * 
    55 * Copyright (C) 2005 Konstantinos Papadimitriou <vinilios@cube.gr> 
     6 * Copyright (C) 2010 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
    67 *  
    78 * This program is free software; you can redistribute it and/or modify 
     
    2223<tr><td colspan="3" class="plot-title">{$lang.plot}</td></tr> 
    2324<tr><td width="33%" align="left">{$data[rowl].node_name|escape} (#{$data[rowl].node_id})</td><td width="33%" align="center">-- {$data[rowl].distance|round:3}km --</td><td align="right">{$data[rowl].peer_node_name|escape} (#{$data[rowl].links__peer_node_id})</td></tr> 
    24 <tr><td colspan="3" align="center"><a href="" onclick="javascript: t = window.open('?page=nodes&subpage=plot_link&a_node={$data[rowl].node_id}&b_node={$data[rowl].links__peer_node_id}', 'popup_plot_link', 'width=600,height=450,toolbar=0,resizable=1,scrollbars=1'); t.focus(); return false;"><img src="?page=nodes&subpage=plot&a_node={$data[rowl].node_id}&b_node={$data[rowl].links__peer_node_id}&width=300&height=150" width="300" height="150" alt="{$lang.plot}" /></a></td></tr> 
     25<tr><td colspan="3" align="center"><a href="" onclick="javascript: t = window.open('?page=nodes&amp;subpage=plot_link&amp;a_node={$data[rowl].node_id}&amp;b_node={$data[rowl].links__peer_node_id}', 'popup_plot_link', 'width=600,height=450,toolbar=0,resizable=1,scrollbars=1'); t.focus(); return false;"><img src="?page=nodes&amp;subpage=plot&amp;a_node={$data[rowl].node_id}&amp;b_node={$data[rowl].links__peer_node_id}&amp;width=300&amp;height=150" width="300" height="150" alt="{$lang.plot}" /></a></td></tr> 
    2526</table> 
  • branches/awmn/templates/basic/includes/pages/gmap/gmap_js.tpl

    r198 r230  
    44 * 
    55 * Copyright (C) 2005 Nikolaos Nikalexis <winner@cube.gr> 
     6 * Copyright (C) 2010 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
    67 *  
    78 * This program is free software; you can redistribute it and/or modify 
     
    299300                        var this_node = selected[0].getAttribute("id"); 
    300301                                if(this_node != node_id) { 
    301                                         html = html + "<br /><a href=\"\" onclick=\"javascript: t = window.open('?page=nodes&subpage=plot_link&a_node="+ selected[0].getAttribute("id") +"&b_node="+ node_id +"', 'popup_plot_link', 'width=600,height=450,toolbar=0,resizable=1,scrollbars=1'); t.focus(); return false;\">{/literal}{$lang.plot}{literal}</a></div>"; 
     302                                        html = html + "<br /><a href=\"\" onclick=\"javascript: t = window.open('?page=nodes&amp;subpage=plot_link&amp;a_node="+ selected[0].getAttribute("id") +"&amp;b_node="+ node_id +"', 'popup_plot_link', 'width=600,height=450,toolbar=0,resizable=1,scrollbars=1'); t.focus(); return false;\">{/literal}{$lang.plot}{literal}</a></div>"; 
    302303                                } 
    303304                        } else { 
  • branches/awmn/templates/basic/includes/pages/nodes/nodes_plot_link.tpl

    r198 r230  
    44 * 
    55 * Copyright (C) 2005 Konstantinos Papadimitriou <vinilios@cube.gr> 
     6 * Copyright (C) 2010 Vasilis Tsiligiannis <b_tsiligiannis@silverton.gr> 
    67 *  
    78 * This program is free software; you can redistribute it and/or modify 
     
    3334                                <tr> 
    3435                                        <td width="25%" align="left"> 
    35                                                 {include file=generic/link.tpl content="`$lang.change`" onclick="javascript: t = window.open('?page=pickup&subpage=nodes&object=form_nodes_plot_link.a_node', 'popup_pickup', 'width=700,height=600,toolbar=0,resizable=1,scrollbars=1'); t.focus(); return false;"} 
     36                                                {include file=generic/link.tpl content="`$lang.change`" onclick="javascript: t = window.open('?page=pickup&amp;subpage=nodes&amp;object=form_nodes_plot_link.a_node', 'popup_pickup', 'width=700,height=600,toolbar=0,resizable=1,scrollbars=1'); t.focus(); return false;"} 
    3637                                                <br /> 
    3738                                                <input type="hidden" name="a_node" value="{$a_node}" /> 
     
    4243                                        </td> 
    4344                                        <td width="25%" align="right"> 
    44                                                 {include file=generic/link.tpl content="`$lang.change`" onclick="javascript: t = window.open('?page=pickup&subpage=nodes&object=form_nodes_plot_link.b_node', 'popup_pickup', 'width=700,height=600,toolbar=0,resizable=1,scrollbars=1'); t.focus(); return false;"} 
     45                                                {include file=generic/link.tpl content="`$lang.change`" onclick="javascript: t = window.open('?page=pickup&amp;subpage=nodes&amp;object=form_nodes_plot_link.b_node', 'popup_pickup', 'width=700,height=600,toolbar=0,resizable=1,scrollbars=1'); t.focus(); return false;"} 
    4546                                                <br /> 
    4647                                                <input type="hidden" name="b_node" value="{$b_node}" /> 
Note: See TracChangeset for help on using the changeset viewer.