From f8a89ed4b6da4b1440fac6922ad3ae3ce19f3cf8 Mon Sep 17 00:00:00 2001 From: FusionPBX Date: Sat, 30 Jun 2018 10:09:35 -0600 Subject: [PATCH] Update domain_settings.php --- core/domain_settings/domain_settings.php | 51 ++++++++++++------------ 1 file changed, 25 insertions(+), 26 deletions(-) diff --git a/core/domain_settings/domain_settings.php b/core/domain_settings/domain_settings.php index ff39fa9581..ec09f5c5d5 100644 --- a/core/domain_settings/domain_settings.php +++ b/core/domain_settings/domain_settings.php @@ -17,7 +17,7 @@ The Initial Developer of the Original Code is Mark J Crane - Portions created by the Initial Developer are Copyright (C) 2008-2015 + Portions created by the Initial Developer are Copyright (C) 2008-2018 the Initial Developer. All Rights Reserved. Contributor(s): @@ -82,7 +82,7 @@ messages::add($text['message-delete_failed'], 'negative'); } - header("Location: domain_edit.php?id=".check_str($_REQUEST["domain_uuid"])); + header("Location: domain_edit.php?id=".escape($_REQUEST["domain_uuid"])); exit; } } @@ -97,7 +97,7 @@ //show the content echo "
"; echo ""; - echo ""; + echo ""; //prepare to page the results $sql = "select count(*) as num_rows from v_domain_settings "; @@ -174,7 +174,7 @@ && permission_exists("domain_setting_add") && count($_SESSION['domains']) > 1) || permission_exists('domain_setting_delete')) { - echo ""; + echo ""; } echo "".$text['label-subcategory'].""; echo "".$text['label-type'].""; @@ -183,7 +183,7 @@ echo "".$text['label-description'].""; echo ""; if (permission_exists('domain_setting_add')) { - echo "".$v_link_label_add.""; + echo "".$v_link_label_add.""; } if (permission_exists('domain_setting_delete')) { echo "".$v_link_label_delete.""; @@ -191,24 +191,23 @@ echo "\n"; echo "\n"; } - $tr_link = (permission_exists('domain_setting_edit')) ? " href='domain_setting_edit.php?domain_uuid=".$row['domain_uuid']."&id=".$row['domain_setting_uuid']."'" : null; + $tr_link = (permission_exists('domain_setting_edit')) ? " href='domain_setting_edit.php?domain_uuid=".escape($row['domain_uuid'])."&id=".escape($row['domain_setting_uuid'])."'" : null; echo "\n"; - if ( - (permission_exists("domain_select") && permission_exists("domain_setting_add") && count($_SESSION['domains']) > 1) || - permission_exists("domain_setting_delete") - ) { - echo " \n"; - $subcat_ids[strtolower($row['domain_setting_category'])][] = 'checkbox_'.$row['domain_setting_uuid']; + if ((permission_exists("domain_select") && permission_exists("domain_setting_add") + && count($_SESSION['domains']) > 1) || + permission_exists("domain_setting_delete")) { + echo " \n"; + $subcat_ids[strtolower($row['domain_setting_category'])][] = 'checkbox_'.escape($row['domain_setting_uuid']); } echo " "; if (permission_exists('domain_setting_edit')) { - echo "".$row['domain_setting_subcategory'].""; + echo "".escape($row['domain_setting_subcategory']).""; } else { echo $row['domain_setting_subcategory']; } echo " \n"; - echo " ".$row['domain_setting_name']." \n"; + echo " ".escape($row['domain_setting_name'])." \n"; echo " \n"; $category = $row['domain_setting_category']; @@ -222,7 +221,7 @@ $sub_result = $sub_prep_statement->fetchAll(PDO::FETCH_NAMED); unset ($prep_statement, $sql); foreach ($sub_result as &$sub_row) { - echo $sub_row["menu_language"]." - ".$sub_row["menu_name"]."\n"; + echo escape($sub_row["menu_language"])." - ".escape($sub_row["menu_name"])."\n"; } } else if ($category == "domain" && $subcategory == "template" && $name == "name" ) { @@ -242,31 +241,31 @@ ( $category == "theme" && $subcategory == "menu_position" && $name == "text" ) || ( $category == "theme" && $subcategory == "logo_align" && $name == "text" ) ) { - echo " ".$text['label-'.$row['domain_setting_value']]; + echo " ".$text['label-'.escape($row['domain_setting_value'])]; } else if ($subcategory == 'password' || substr_count($subcategory, '_password') > 0 || $category == "login" && $subcategory == "password_reset_key" && $name == "text") { - echo " ".str_repeat('*', strlen($row['domain_setting_value'])); + echo " ".str_repeat('*', strlen(escape($row['domain_setting_value']))); } else { if ($category == "theme" && substr_count($subcategory, "_color") > 0 && ($name == "text" || $name == 'array')) { - echo " ".(img_spacer('15px', '15px', 'background: '.$row['domain_setting_value'].'; margin-right: 4px; vertical-align: middle; border: 1px solid '.(color_adjust($row['domain_setting_value'], -0.18)).'; padding: -1px;')); - echo "".htmlspecialchars($row['domain_setting_value'])."\n"; + echo " ".(img_spacer('15px', '15px', 'background: '.escape($row['domain_setting_value']).'; margin-right: 4px; vertical-align: middle; border: 1px solid '.(color_adjust($row['domain_setting_value'], -0.18)).'; padding: -1px;')); + echo "".escape($row['domain_setting_value'])."\n"; } else { - echo " ".htmlspecialchars($row['domain_setting_value'])."\n"; + echo " ".escape($row['domain_setting_value'])."\n"; } } echo " \n"; echo " \n"; - echo " ".$text['label-'.$row['domain_setting_enabled']]."\n"; + echo " ".$text['label-'.escape($row['domain_setting_enabled'])]."\n"; echo " \n"; - echo " ".$row['domain_setting_description']." \n"; + echo " ".escape($row['domain_setting_description'])." \n"; echo " "; if (permission_exists('domain_setting_edit')) { - echo "$v_link_label_edit"; + echo "$v_link_label_edit"; } if (permission_exists('domain_setting_delete')) { - echo "$v_link_label_delete"; + echo "$v_link_label_delete"; } echo " \n"; echo "\n"; @@ -284,7 +283,7 @@ echo " $paging_controls\n"; echo " "; if (permission_exists('domain_setting_add')) { - echo "$v_link_label_add"; + echo "$v_link_label_add"; } if (permission_exists('domain_setting_delete') && $result_count > 0) { echo "".$v_link_label_delete.""; @@ -307,7 +306,7 @@ foreach ($subcat_ids as $domain_setting_category => $checkbox_ids) { echo "if (category == '".$domain_setting_category."') {\n"; foreach ($checkbox_ids as $index => $checkbox_id) { - echo "document.getElementById('".$checkbox_id."').checked = (what == 'all') ? true : false;\n"; + echo "document.getElementById('".escape($checkbox_id)."').checked = (what == 'all') ? true : false;\n"; } echo "}\n"; }