relative+cleaned paths

diff --git a/admin/xmldb/actions/delete_field/delete_field.class.php b/admin/xmldb/actions/delete_field/delete_field.class.php
index b7b7ba5e3b61b5d16e2b5475f0c2fa567df16e9a..409d1073d2e12e5ee50e78e272a2fff9baf4305c 100644 (file)
--- a/admin/xmldb/actions/delete_field/delete_field.class.php
+++ b/admin/xmldb/actions/delete_field/delete_field.class.php
@@ -63,8 +63,8 @@ class delete_field extends XMLDBAction {
     /// Do the job, setting result as needed
 
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
         $tableparam = required_param('table', PARAM_CLEAN);
         $fieldparam = required_param('field', PARAM_CLEAN);
 
@@ -77,11 +77,11 @@ class delete_field extends XMLDBAction {
             $o.= '    <p align="center">' . $this->str['confirmdeletefield'] . '<br /><br />' . $fieldparam . '</p>';
             $o.= '    <table align="center" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_field&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode($dirpath) . '" method="post">';
+            $o.= '        <form action="index.php?action=delete_field&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=edit_table&amp;table=' . $tableparam . '&amp;dir=' . urlencode($dirpath) . '" method="post">';
+            $o.= '        <form action="index.php?action=edit_table&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post">';
             $o.= '          <input type="submit" value="'. $this->str['no'] .'" /></form></div>';
             $o.= '      </td></tr>';
             $o.= '    </table>';

diff --git a/admin/xmldb/actions/edit_field/edit_field.class.php b/admin/xmldb/actions/edit_field/edit_field.class.php
index f21f4b690a4276f916ecbbb789d27c072a4c4719..a257436c92c4f299cc67e466e45968bd3d25a9ad 100644 (file)
--- a/admin/xmldb/actions/edit_field/edit_field.class.php
+++ b/admin/xmldb/actions/edit_field/edit_field.class.php
@@ -65,8 +65,8 @@ class edit_field extends XMLDBAction {
 
     /// Do the job, setting result as needed
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dirs
         if (!empty($XMLDB->dbdirs)) {
@@ -99,7 +99,7 @@ class edit_field extends XMLDBAction {
 
     /// Add the main form
         $o = '<form name="form" id="form" action="index.php" method="post">';
-        $o.= '    <input type="hidden" name ="dir" value="' . $dirpath . '" />';
+        $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="field" value="' . $fieldparam .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_field_save" />';
@@ -175,18 +175,18 @@ class edit_field extends XMLDBAction {
         $b = ' <p align="center" class="buttons">';
     /// The view original XML button
         if ($table->getField($fieldparam)) {
-            $b .= '&nbsp;<a href="index.php?action=view_field_xml&amp;dir=' . urlencode($dirpath) . '&amp;select=original&amp;table=' . $tableparam . '&amp;field=' . $fieldparam . '" target="_blank">[' . $this->str['vieworiginal'] . ']</a>';
+            $b .= '&nbsp;<a href="index.php?action=view_field_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;select=original&amp;table=' . $tableparam . '&amp;field=' . $fieldparam . '" target="_blank">[' . $this->str['vieworiginal'] . ']</a>';
         } else {
             $b .= '&nbsp;[' . $this->str['vieworiginal'] . ']';
         }
     /// The view edited XML button
         if ($field->hasChanged()) {
-            $b .= '&nbsp;<a href="index.php?action=view_field_xml&amp;dir=' . urlencode($dirpath) . '&amp;select=edited&amp;table=' . $tableparam . '&amp;field=' . $fieldparam . '" target="_blank">[' . $this->str['viewedited'] . ']</a>';
+            $b .= '&nbsp;<a href="index.php?action=view_field_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;select=edited&amp;table=' . $tableparam . '&amp;field=' . $fieldparam . '" target="_blank">[' . $this->str['viewedited'] . ']</a>';
         } else {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The back to edit table button
-        $b .= '&nbsp;<a href="index.php?action=edit_table&amp;table=' . $tableparam . '&amp;dir=' . urlencode($dirpath) . '">[' . $this->str['back'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=edit_table&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
         $o .= $b;
 

diff --git a/admin/xmldb/actions/edit_table_save/edit_table_save.class.php b/admin/xmldb/actions/edit_table_save/edit_table_save.class.php
index 5ce2705ad256ccdf670c6b97428ad075fb92d078..ca7698308bc8f79e935e9a2697839e7bda4882dd 100644 (file)
--- a/admin/xmldb/actions/edit_table_save/edit_table_save.class.php
+++ b/admin/xmldb/actions/edit_table_save/edit_table_save.class.php
@@ -65,6 +65,10 @@ class edit_table_save extends XMLDBAction {
 
     /// Do the job, setting result as needed
 
+        if (!data_submitted('nomatch')) { ///Basic prevention
+            error('Wrong action call');
+        }
+
     /// Get parameters
         $dirpath = required_param('dir', PARAM_PATH);
         $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);

diff --git a/admin/xmldb/actions/move_updown_field/move_updown_field.class.php b/admin/xmldb/actions/move_updown_field/move_updown_field.class.php
index 1355109e4e5836d9d8f47a38812d6fee9188d807..a66a3fb413e6d65d0d9f7611959a1b138bf838ec 100644 (file)
--- a/admin/xmldb/actions/move_updown_field/move_updown_field.class.php
+++ b/admin/xmldb/actions/move_updown_field/move_updown_field.class.php
@@ -61,8 +61,8 @@ class move_updown_field extends XMLDBAction {
 
     /// Do the job, setting result as needed
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dirs
         if (!empty($XMLDB->dbdirs)) {

diff --git a/admin/xmldb/actions/new_field/new_field.class.php b/admin/xmldb/actions/new_field/new_field.class.php
index 32376799afb322b1e3f78d709d1b5b5eff98e372..d4b8425207b9ea4bfe951a731e77ad9b66492ee6 100644 (file)
--- a/admin/xmldb/actions/new_field/new_field.class.php
+++ b/admin/xmldb/actions/new_field/new_field.class.php
@@ -61,8 +61,8 @@ class new_field extends XMLDBAction {
 
     /// Do the job, setting result as needed
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dirs
         if (!empty($XMLDB->dbdirs)) {

diff --git a/admin/xmldb/actions/view_field_xml/view_field_xml.class.php b/admin/xmldb/actions/view_field_xml/view_field_xml.class.php
index 34e0f136288c69d3d7ca2bee3e5bc1946fff142b..0fbba22f0e7efe8b61dbf71ea58172a90aac4704 100644 (file)
--- a/admin/xmldb/actions/view_field_xml/view_field_xml.class.php
+++ b/admin/xmldb/actions/view_field_xml/view_field_xml.class.php
@@ -61,12 +61,12 @@ class view_field_xml extends XMLDBAction {
     /// Do the job, setting result as needed
 
     /// Get the file parameter
-        $field =  required_param('field', PARAM_CLEAN);
-        $table =  required_param('table', PARAM_CLEAN);
+        $field =  required_param('field', PARAM_PATH);
+        $table =  required_param('table', PARAM_PATH);
         $select = required_param('select', PARAM_ALPHA); //original/edited
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dir
         if ($select == 'original') {

diff --git a/admin/xmldb/actions/view_table_sql/view_table_sql.class.php b/admin/xmldb/actions/view_table_sql/view_table_sql.class.php
index f6c8896f6d1a13b051cfe91f2a9c9013142c01fd..cb6de34e75116a5e3edde41e8c9ebdb5a90f15ad 100644 (file)
--- a/admin/xmldb/actions/view_table_sql/view_table_sql.class.php
+++ b/admin/xmldb/actions/view_table_sql/view_table_sql.class.php
@@ -62,8 +62,8 @@ class view_table_sql extends XMLDBAction {
 
     /// Do the job, setting result as needed
     /// Get the dir containing the file
-        $dirpath = required_param('dir', PARAM_CLEAN);
-        $dirpath = stripslashes_safe($dirpath);
+        $dirpath = required_param('dir', PARAM_PATH);
+        $dirpath = $CFG->dirroot . stripslashes_safe($dirpath);
 
     /// Get the correct dirs
         if (!empty($XMLDB->dbdirs)) {
@@ -78,12 +78,12 @@ class view_table_sql extends XMLDBAction {
     /// ADD YOUR CODE HERE
 
     /// Get parameters
-        $tableparam = required_param('table', PARAM_CLEAN);
+        $tableparam = required_param('table', PARAM_PATH);
         if (!$table =& $structure->getTable($tableparam)) {
             $this->errormsg = 'Wrong table specified: ' . $tableparm;
             return false;
         }
-        $generatorparam = optional_param('generator', null, PARAM_CLEAN);
+        $generatorparam = optional_param('generator', null, PARAM_ALPHANUM);
         if (empty($generatorparam)) {
             $generatorparam = $CFG->dbtype;
         }
@@ -101,7 +101,7 @@ class view_table_sql extends XMLDBAction {
 
         /// The back to edit table button
         $b = ' <p align="center" class="buttons">';
-        $b .= '<a href="index.php?action=edit_table&amp;table=' . $tableparam . '&amp;dir=' . urlencode($dirpath) . '">[' . $this->str['back'] . ']</a>';
+        $b .= '<a href="index.php?action=edit_table&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
         $o = $b;
 
@@ -109,7 +109,7 @@ class view_table_sql extends XMLDBAction {
         $o.= '      <tr><td align="center">' . $this->str['selectdb'];
 
     /// Show the popup of generators
-        $url = 'index.php?action=view_table_sql&amp;table=' . $tableparam . '&amp;dir=' . urlencode($dirpath) . '&amp;generator=';
+        $url = 'index.php?action=view_table_sql&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;generator=';
         $o.= popup_form($url, $generators, 'selectgenerator', $generatorparam, '', '', '' , true);
         $o.= '      </td></tr>';
         $o.= '      <tr><td><textarea cols="80" rows="32">';