relative+cleaned paths

diff --git a/admin/xmldb/actions/new_statement/new_statement.class.php b/admin/xmldb/actions/new_statement/new_statement.class.php
index 8dfc3137dbe98416d7b1748889a1ac7e93e43c4d..526d58d0efc6d46c3a368eb2fc796b07cf3ef9ea 100644 (file)
--- a/admin/xmldb/actions/new_statement/new_statement.class.php
+++ b/admin/xmldb/actions/new_statement/new_statement.class.php
@@ -64,8 +64,8 @@ class new_statement extends XMLDBAction {
 
     /// Do the job, setting result as needed
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dirs
         if (!empty($XMLDB->dbdirs)) {
@@ -103,13 +103,13 @@ class new_statement extends XMLDBAction {
             }
         /// Now build the form
             $o = '<form id="form" action="index.php" method="post">';
-            $o.= '    <input type="hidden" name ="dir" value="' . $dirpath . '" />';
+            $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_statement" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
             $o.= '    <table id="formelements" align="center" cellpadding="5">';
             $o.= '      <tr><td><label for="type" accesskey="t">' . $this->str['statementtype'] .' </label>' . choose_from_menu($typeoptions, 'type', '', 'choose', '', 0, true) . '<label for="table" accesskey="a">' . $this->str['statementtable'] . ' </label>' .choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';
-            $o.= '      <tr><td colspan="2" align="center"><a href="index.php?action=edit_xml_file&amp;dir=' . urlencode($dirpath) . '">[' . $this->str['back'] . ']</a></td></tr>';
+            $o.= '      <tr><td colspan="2" align="center"><a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a></td></tr>';
             $o.= '    </table>';
             $o.= '</form>';
 

diff --git a/admin/xmldb/actions/new_table/new_table.class.php b/admin/xmldb/actions/new_table/new_table.class.php
index 98cabf87080f2d32b70215e76f21db2e3193bbbc..da7b34228742a333d176ad10cda3cdf5a96cefa7 100644 (file)
--- a/admin/xmldb/actions/new_table/new_table.class.php
+++ b/admin/xmldb/actions/new_table/new_table.class.php
@@ -61,8 +61,8 @@ class new_table extends XMLDBAction {
 
     /// Do the job, setting result as needed
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dirs
         if (!empty($XMLDB->dbdirs)) {

diff --git a/admin/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php b/admin/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php
index 549a920c6ea8a9a3f9bfe03a0b5043171c731e01..162cb70f1fff022c84fc1e24df8d699355e0f600 100644 (file)
--- a/admin/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php
+++ b/admin/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php
@@ -64,8 +64,8 @@ class new_table_from_mysql extends XMLDBAction {
 
     /// Do the job, setting result as needed
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dirs
         if (!empty($XMLDB->dbdirs)) {
@@ -107,13 +107,13 @@ class new_table_from_mysql extends XMLDBAction {
             }
         /// Now build the form
             $o = '<form id="form" action="index.php" method="post">';
-            $o.= '    <input type="hidden" name ="dir" value="' . $dirpath . '" />';
+            $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_table_from_mysql" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
             $o.= '    <table id="formelements" align="center" cellpadding="5">';
             $o.= '      <tr><td><label for="table" accesskey="t">' . $this->str['createtable'] .' </label>' . choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '<label for="after" accesskey="a">' . $this->str['aftertable'] . ' </label>' .choose_from_menu($aftertables, 'after', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';
-            $o.= '      <tr><td colspan="2" align="center"><a href="index.php?action=edit_xml_file&amp;dir=' . urlencode($dirpath) . '">[' . $this->str['back'] . ']</a></td></tr>';
+            $o.= '      <tr><td colspan="2" align="center"><a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a></td></tr>';
             $o.= '    </table>';
             $o.= '</form>';
 

diff --git a/admin/xmldb/actions/view_structure_sql/view_structure_sql.class.php b/admin/xmldb/actions/view_structure_sql/view_structure_sql.class.php
index 81ad972b1cca9d5bf94338a884de210ecbf91d53..36fbb8e753275c6e593e4adba2bd041e404de944 100644 (file)
--- a/admin/xmldb/actions/view_structure_sql/view_structure_sql.class.php
+++ b/admin/xmldb/actions/view_structure_sql/view_structure_sql.class.php
@@ -62,8 +62,8 @@ class view_structure_sql extends XMLDBAction {
 
     /// Do the job, setting result as needed
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dirs
         if (!empty($XMLDB->dbdirs)) {
@@ -78,7 +78,7 @@ class view_structure_sql extends XMLDBAction {
     /// ADD YOUR CODE HERE
 
     /// Get parameters
-        $generatorparam = optional_param('generator', null, PARAM_CLEAN);
+        $generatorparam = optional_param('generator', null, PARAM_ALPHANUM);
         if (empty($generatorparam)) {
             $generatorparam = $CFG->dbtype;
         }
@@ -96,7 +96,7 @@ class view_structure_sql extends XMLDBAction {
 
         /// The back to edit table button
         $b = ' <p align="center" class="buttons">';
-        $b .= '<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode($dirpath) . '">[' . $this->str['back'] . ']</a>';
+        $b .= '<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
         $o = $b;
 
@@ -104,7 +104,7 @@ class view_structure_sql extends XMLDBAction {
         $o.= '      <tr><td align="center">' . $this->str['selectdb'];
 
     /// Show the popup of generators
-        $url = 'index.php?action=view_structure_sql&amp;dir=' . urlencode($dirpath) . '&amp;generator=';
+        $url = 'index.php?action=view_structure_sql&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;generator=';
         $o.= popup_form($url, $generators, 'selectgenerator', $generatorparam, '', '', '' , true);
         $o.= '      </td></tr>';
         $o.= '      <tr><td><textarea cols="80" rows="32">';

diff --git a/admin/xmldb/actions/view_structure_xml/view_structure_xml.class.php b/admin/xmldb/actions/view_structure_xml/view_structure_xml.class.php
index d35e059b05ca0cc988d52bf08855fc4ae67f94c1..bdae8e3eb74a2ddf354d11fa384afbd0dd169a87 100644 (file)
--- a/admin/xmldb/actions/view_structure_xml/view_structure_xml.class.php
+++ b/admin/xmldb/actions/view_structure_xml/view_structure_xml.class.php
@@ -61,10 +61,10 @@ class view_structure_xml extends XMLDBAction {
     /// Do the job, setting result as needed
 
     /// Get the file parameter
-        $select = required_param('select', PARAM_ALPHAEXT); //original/edited
+        $select = required_param('select', PARAM_ALPHA); //original/edited
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dir
         if ($select == 'original') {

diff --git a/admin/xmldb/actions/view_xml/view_xml.class.php b/admin/xmldb/actions/view_xml/view_xml.class.php
index ea41484d8b291783c3cc746a4fae8a8d034feabb..e1bd483e33ddf6ab919f98e9f31fc5f7cd54f0de 100644 (file)
--- a/admin/xmldb/actions/view_xml/view_xml.class.php
+++ b/admin/xmldb/actions/view_xml/view_xml.class.php
@@ -64,8 +64,8 @@ class view_xml extends XMLDBAction {
     /// Do the job, setting result as needed
 
     /// Get the file parameter
-        $file = required_param('file', PARAM_CLEAN);
-        $file = stripslashes_safe($file);
+        $file = required_param('file', PARAM_PATH);
+        $file = $CFG->dirroot . stripslashes_safe($file);
     /// File must be under $CFG->wwwroot and 
     ///  under one db directory (simple protection)
         if (substr($file, 0, strlen($CFG->dirroot)) == $CFG->dirroot &&