}
function detect_munged_arguments($string) {
- if (ereg('\.\.', $string)) { // check for parent URLs
+ if (substr_count($string, '..') > 1) { // We allow one '..' in a URL
return true;
}
if (ereg('[\|\`]', $string)) { // check for other bad characters
/// STANDARD WEB PAGE PARTS ///////////////////////////////////////////////////
function print_header ($title="", $heading="", $navigation="", $focus="", $meta="",
- $cache=true, $button=" ", $menu="", $usexml=false) {
+ $cache=true, $button=" ", $menu="", $usexml=false, $bodytags="") {
// $title - appears top of window
// $heading - appears top of page
// $navigation - premade navigation string
// $button - HTML code for a button (usually for module editing)
// $menu - HTML code for a popup menu
// $usexml - use XML for this page
+// $bodytags - this text will be included verbatim in the <body> tag (useful for onload() etc)
+
global $USER, $CFG, $THEME, $SESSION;
global $course; // This is a bit of an ugly hack to be gotten rid of later
<?php include("$CFG->javascript"); ?>
</head>
-<body bgcolor="#006699">
-<table align="center" width="100%" border="1" cellpadding="5" bgcolor="#739fc4" <?php
+<body bgcolor="#006699" <?php
+ echo " $bodytags";
if ($focus) {
echo " onload=setfocus()";
}
?>>
+<table align="center" width="100%" border="1" cellpadding="5" bgcolor="#739fc4">
<td>
<?php include("$CFG->javascript"); ?>
</HEAD>
-<BODY <?php if ($focus) { echo "onLoad=setfocus()"; } echo " bgcolor=\"$THEME->body\" topmargin=\"$THEME->topmargin\" leftmargin=\"$THEME->leftmargin\" marginheight=\"$THEME->marginheight\" marginwidth=\"$THEME->marginwidth\" />"; ?>
+<BODY <?php echo " $bodytags"; if ($focus) { echo "onLoad=setfocus()"; } echo " bgcolor=\"$THEME->body\" topmargin=\"$THEME->topmargin\" leftmargin=\"$THEME->leftmargin\" marginheight=\"$THEME->marginheight\" marginwidth=\"$THEME->marginwidth\" />"; ?>
<?php if ($home) { // This is what gets printed on the home page only ?>