composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-24 11:08:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixed Trac#446: XSS vulnerabilities... to be tested !

Browse Source 
Also fixed the display/download links on documents that were both doing exactly the same thing !

SVN:trunk[1443]
This commit is contained in:
Denis Flaven
2011-08-11 10:17:03 +00:00
parent a129c9814f
commit 6859326646
24 changed files with 248 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pages/ajax.csvimport.php
View File

@@ -224,13 +224,14 @@ try
case 'parser_preview':
$oPage = new ajax_page("");
$oPage->no_cache();
$sSeparator = utils::ReadParam('separator', ',');
$oPage->SetContentType('text/html');
$sSeparator = utils::ReadParam('separator', ',', false, 'raw_data');
if ($sSeparator == 'tab') $sSeparator = "\t";
$sTextQualifier = utils::ReadParam('qualifier', '"');
$sTextQualifier = utils::ReadParam('qualifier', '"', false, 'raw_data');
$iLinesToSkip = utils::ReadParam('nb_lines_skipped', 0);
$bFirstLineAsHeader = utils::ReadParam('header_line', true);
$sEncoding = utils::ReadParam('encoding', 'UTF-8');
$sData = stripslashes(utils::ReadParam('csvdata', true));
$sData = stripslashes(utils::ReadParam('csvdata', true, false, 'raw_data'));
$oCSVParser = new CSVParser($sData, $sSeparator, $sTextQualifier);
$aData = $oCSVParser->ToArray($iLinesToSkip);
$iTarget = count($aData);
@@ -284,11 +285,12 @@ try
case 'display_mapping_form':
$oPage = new ajax_page("");
$oPage->no_cache();
$sSeparator = utils::ReadParam('separator', ',');
$sTextQualifier = utils::ReadParam('qualifier', '"');
$oPage->SetContentType('text/html');
$sSeparator = utils::ReadParam('separator', ',', false, 'raw_data');
$sTextQualifier = utils::ReadParam('qualifier', '"', false, 'raw_data');
$iLinesToSkip = utils::ReadParam('nb_lines_skipped', 0);
$bFirstLineAsHeader = utils::ReadParam('header_line', false);
$sData = stripslashes(utils::ReadParam('csvdata', ''));
$sData = stripslashes(utils::ReadParam('csvdata', '', false, 'raw_data'));
$sClassName = utils::ReadParam('class_name', '');
$bAdvanced = utils::ReadParam('advanced', false);
$sEncoding = utils::ReadParam('encoding', 'UTF-8');