Changeset 10521

Show
Ignore:
Timestamp:
11/02/10 15:19:58 (3 years ago)
Author:
p_lindheimer
Message:

Merged revisions 10520 via svnmerge from
http://www.freepbx.org/v2/svn/modules/branches/2.5

................

r10520 | p_lindheimer | 2010-11-02 12:18:43 -0700 (Tue, 02 Nov 2010) | 30 lines


Merged revisions 10519 via svnmerge from
http://www.freepbx.org/v2/svn/modules/branches/2.6


................

r10519 | p_lindheimer | 2010-11-02 12:16:31 -0700 (Tue, 02 Nov 2010) | 23 lines


Merged revisions 10518 via svnmerge from
http://www.freepbx.org/v2/svn/modules/branches/2.7


................

r10518 | p_lindheimer | 2010-11-02 12:14:32 -0700 (Tue, 02 Nov 2010) | 16 lines


Merged revisions 10517 via svnmerge from
http://svn.freepbx.org/modules/branches/2.8


................

r10517 | p_lindheimer | 2010-11-02 12:12:08 -0700 (Tue, 02 Nov 2010) | 9 lines


Merged revisions 10516 via svnmerge from
http://svn.freepbx.org/modules/branches/2.9


........

r10516 | p_lindheimer | 2010-11-02 12:10:23 -0700 (Tue, 02 Nov 2010) | 1 line


fixes #4618 xss security issue and some other precations unreported

........

................

................

................

................

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • modules/branches/2.4

    • Property svnmerge-integrated changed from /modules/branches/2.3:1-5233,5245,5333,5336 /modules/branches/2.5:1-5852,5880,5930,5995,6016-6017,6030-6031,6142,6218,6291,6361,6363,6413-6414,6422,6428-6430,6442-6443,6557,6710,6714-6715,6969-6970,6984,7248,7281,7858-7859,7875,7878,7886,7890,8615,8622,10302,10342,10461 to /modules/branches/2.3:1-5233,5245,5333,5336 /modules/branches/2.5:1-5852,5880,5930,5995,6016-6017,6030-6031,6142,6218,6291,6361,6363,6413-6414,6422,6428-6430,6442-6443,6557,6710,6714-6715,6969-6970,6984,7248,7281,7858-7859,7875,7878,7886,7890,8615,8622,10302,10342,10461,10520

  • modules/branches/2.4/customappsreg/functions.inc.php

    r5500 r10521  
    114114  } 
    115115 
    116   $custom_dest = q($custom_dest); 
    117   $description = q($description); 
    118   $notes       = q($notes); 
     116  $custom_dest = sql_formattext($custom_dest); 
     117  $description = sql_formattext($description); 
     118  $notes       = sql_formattext($notes); 
    119119  $sql = "INSERT INTO custom_destinations (custom_dest, description, notes) VALUES ($custom_dest, $description, $notes)"; 
    120120  $results = $db->query($sql); 
    …… 
    142142  } 
    143143 
    144   $custom_exten = q($custom_exten); 
    145   $description  = q($description); 
    146   $notes        = q($notes); 
     144  $custom_exten = sql_formattext($custom_exten); 
     145  $description  = sql_formattext($description); 
     146  $notes        = sql_formattext($notes); 
    147147  $sql = "INSERT INTO custom_extensions (custom_exten, description, notes) VALUES ($custom_exten, $description, $notes)"; 
    148148  $results = $db->query($sql); 
    …… 
    190190 
    191191  $sql = "UPDATE custom_destinations SET ". 
    192     "custom_dest = ".q($custom_dest).", ". 
    193     "description = ".q($description).", ". 
    194     "notes = ".q($notes)." ". 
    195     "WHERE custom_dest = ".q($old_custom_dest); 
     192    "custom_dest = ".sql_formattext($custom_dest).", ". 
     193    "description = ".sql_formattext($description).", ". 
     194    "notes = ".sql_formattext($notes)." ". 
     195    "WHERE custom_dest = ".sql_formattext($old_custom_dest); 
    196196  $result = $db->query($sql); 
    197197  if(DB::IsError($result)) { 
    …… 
    204204 
    205205  $sql = "UPDATE custom_extensions SET ". 
    206     "custom_exten = ".q($custom_exten).", ". 
    207     "description = ".q($description).", ". 
    208     "notes = ".q($notes)." ". 
    209     "WHERE custom_exten = ".q($old_custom_exten); 
     206    "custom_exten = ".sql_formattext($custom_exten).", ". 
     207    "description = ".sql_formattext($description).", ". 
     208    "notes = ".sql_formattext($notes)." ". 
     209    "WHERE custom_exten = ".sql_formattext($old_custom_exten); 
    210210  $result = $db->query($sql); 
    211211  if(DB::IsError($result)) { 

  • modules/branches/2.4/customappsreg/page.customdests.php

    r5719 r10521  
    2121$old_custom_dest = isset($_REQUEST['old_custom_dest']) ? $_REQUEST['old_custom_dest'] :  ''; 
    2222$custom_dest     = isset($_REQUEST['extdisplay']) ? $_REQUEST['extdisplay'] :  ''; 
    23 $description     = isset($_REQUEST['description']) ? $_REQUEST['description'] :  ''; 
    24 $notes           = isset($_REQUEST['notes']) ? $_REQUEST['notes'] :  ''; 
     23$description     = isset($_REQUEST['description']) ? htmlentities($_REQUEST['description']) :  ''; 
     24$notes           = isset($_REQUEST['notes']) ? htmlentities($_REQUEST['notes']) :  ''; 
    2525 
    2626switch ($action) { 
    …… 
    104104  if (!empty($usage_list)) { 
    105105  ?> 
    106     <td><b><?php echo $custom_dest; ?></b></td> 
     106    <td><b><?php echo htmlentities($custom_dest); ?></b></td> 
    107107  <?php 
    108108  } else { 

  • modules/branches/2.4/customappsreg/page.customextens.php

    r5324 r10521  
    1919if (isset($_REQUEST['delete'])) $action = 'delete';  
    2020 
    21 $old_custom_exten = isset($_REQUEST['old_custom_exten']) ? $_REQUEST['old_custom_exten'] :  ''; 
    22 $custom_exten     = isset($_REQUEST['extdisplay']) ? $_REQUEST['extdisplay'] :  ''; 
    23 $description     = isset($_REQUEST['description']) ? $_REQUEST['description'] :  ''; 
    24 $notes           = isset($_REQUEST['notes']) ? $_REQUEST['notes'] :  ''; 
     21$custom_exten = preg_replace("/[^0-9*#]/" ,"", trim($custom_exten)); 
     22 
     23$old_custom_exten = isset($_REQUEST['old_custom_exten']) ? preg_replace("/[^0-9*#]/" ,"",$_REQUEST['old_custom_exten']) :  ''; 
     24$custom_exten     = isset($_REQUEST['extdisplay']) ? preg_replace("/[^0-9*#]/" ,"",$_REQUEST['extdisplay']) :  ''; 
     25$description     = isset($_REQUEST['description']) ? htmlentities($_REQUEST['description']) :  ''; 
     26$notes           = isset($_REQUEST['notes']) ? htmlentities($_REQUEST['notes']) :  ''; 
    2527 
    2628switch ($action) {