changes needed for new s() and p() - see bug #2338

diff --git a/course/edit.php b/course/edit.php
index 9c22c070a245d582d3f6d6054a3b2f63b486b156..0e2bd224c69601eb7d547e6b5b461d8e8aa89ed5 100644 (file)
--- a/course/edit.php
+++ b/course/edit.php
@@ -208,8 +208,12 @@
                 $form->students = get_string("defaultcoursestudents");
             }
         }
+    } else {
+        $form = stripslashes_safe($form);
     }
 
+    // !! no db access using data from $form beyond this point !!
+
     $form->categories = get_records_select_menu("course_categories", "", "name", "id,name");
 
     $courseformats = get_list_of_plugins("course/format");

diff --git a/course/editsection.html b/course/editsection.html
index ecc813b7789321bbc9a18ac01b3d14ef0a4206f9..913d0b07af8ad2dad3c6390db64ef76ac48e1554 100644 (file)
--- a/course/editsection.html
+++ b/course/editsection.html
@@ -22,7 +22,7 @@
 </tr>
 </table>
 <input type="hidden" name="id" value="<?php echo $form->id ?>" />
-<input type="hidden" name="sesskey" value="<?php echo $form->sesskey ?>" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 <input type="submit" value="<?php print_string("savechanges") ?>" />
 </form>
 </center>

diff --git a/course/editsection.php b/course/editsection.php
index 4afb0429452fe9d5658f6f126b0da9540d4a1e9f..2e7437b06377f98f319fc7d572349373213e5ac0 100644 (file)
--- a/course/editsection.php
+++ b/course/editsection.php
@@ -41,9 +41,11 @@
 
     if (empty($form)) {
         $form = $section;
+    } else {
+        $form = stripslashes_safe($form);
     }
 
-    $form->sesskey = !empty($USER->id) ? $USER->sesskey : '';
+    // !! no db access using data from $form beyond this point !!
 
     $usehtmleditor = can_use_html_editor();
 

diff --git a/course/group-edit.html b/course/group-edit.html
index 57969bbea034b9bdff0177f52f1d81c750512d56..8802ffd3b90c118de5ed639000ad108e890febdb 100644 (file)
--- a/course/group-edit.html
+++ b/course/group-edit.html
@@ -57,5 +57,5 @@
 
 <input type="hidden" name="group" value="<?php p($group->id) ?>" /> 
 <input type="hidden" name="id" value="<?php p($course->id) ?>" /> 
-<input type="hidden" name="sesskey" value="<?php p($sesskey) ?>" /> 
+<input type="hidden" name="sesskey" value="<?php sesskey() ?>" /> 
 </form>

diff --git a/course/group.php b/course/group.php
index 2c043b207b576ae733299a2363fe999c739b3c2d..0d38ca0ae1537a21f3c0028a999fe918c42220f3 100644 (file)
--- a/course/group.php
+++ b/course/group.php
@@ -75,8 +75,6 @@
 
     $usehtmleditor = false;
 
-    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
-
     include('group-edit.html');
 
     echo "</body></html>";

diff --git a/course/importstudents.html b/course/importstudents.html
index dc9a87b75c5f09c2354eebf3502f3cdeb51394e3..ed9b879dd66b4d6ad558a730fdbc2e8975cd2e15 100644 (file)
--- a/course/importstudents.html
+++ b/course/importstudents.html
@@ -60,7 +60,7 @@
           ?>
          </select>
          <br />
-         <input type="text" name="searchtext" size="30" value="<?php p($searchtext) ?>" 
+         <input type="text" name="searchtext" size="30" value="<?php p($searchtext, true) ?>" 
                   onFocus ="document.studentform.add.disabled=true;
                             document.studentform.remove.disabled=true;
                             document.studentform.removeselect.selectedIndex=-1;

diff --git a/course/lib.php b/course/lib.php
index b7bd79e73717e454fcf9aecf9db7434358b1e497..ae287085e32083fa91acfa684581e3c84fb76721 100644 (file)
--- a/course/lib.php
+++ b/course/lib.php
@@ -1320,19 +1320,19 @@ function print_course_search($value="", $return=false, $format="plain") {
     if ($format == 'plain') {
         $output  = '<form name="coursesearch" action="'.$CFG->wwwroot.'/course/search.php" method="get">';
         $output .= '<center><p align="center" class="coursesearchbox">';
-        $output .= '<input type="text" size="30" name="search" alt="'.s($strsearchcourses).'" value="'.s($value).'" />';
+        $output .= '<input type="text" size="30" name="search" alt="'.s($strsearchcourses).'" value="'.s($value, true).'" />';
         $output .= '<input type="submit" value="'.s($strsearchcourses).'" />';
         $output .= '</p></center></form>';
     } else if ($format == 'short') {
         $output  = '<form name="coursesearch" action="'.$CFG->wwwroot.'/course/search.php" method="get">';
         $output .= '<center><p align="center" class="coursesearchbox">';
-        $output .= '<input type="text" size="12" name="search" alt="'.s($strsearchcourses).'" value="'.s($value).'" />';
+        $output .= '<input type="text" size="12" name="search" alt="'.s($strsearchcourses).'" value="'.s($value, true).'" />';
         $output .= '<input type="submit" value="'.s($strsearchcourses).'" />';
         $output .= '</p></center></form>';
     } else if ($format == 'navbar') {
         $output  = '<form name="coursesearch" action="'.$CFG->wwwroot.'/course/search.php" method="get">';
         $output .= '<table border="0" cellpadding="0" cellspacing="0"><tr><td nowrap="nowrap">';
-        $output .= '<input type="text" size="20" name="search" alt="'.s($strsearchcourses).'" value="'.s($value).'" />';
+        $output .= '<input type="text" size="20" name="search" alt="'.s($strsearchcourses).'" value="'.s($value, true).'" />';
         $output .= '<input type="submit" value="'.s($strsearchcourses).'" />';
         $output .= '</td></tr></table>';
         $output .= '</form>';

diff --git a/course/request.php b/course/request.php
index 099766403eb91dd7ae5ced5fdcd1f04831efa368..d46b100c25bc1587eb13dde5e6a5e3b6e583a355 100644 (file)
--- a/course/request.php
+++ b/course/request.php
@@ -32,7 +32,11 @@
             }
             print_footer();
             exit;
+        } else {
+            $form = stripslashes_safe($form);
         }
+
+       // !! no db access using data from $form beyond this point !!
     }
 
 //    print_simple_box(get_string('courserequestintro'),'center');

diff --git a/course/search.php b/course/search.php
index 9a10f5d76f68f38ee51b1d5f678509b1064dc5bd..2ae91a49e327e00e8964457c1f674ac81da35233 100644 (file)
--- a/course/search.php
+++ b/course/search.php
@@ -130,7 +130,7 @@
  
 
     print_header("$site->fullname : $strsearchresults", $site->fullname, 
-                 "<a href=\"index.php\">$strcourses</a> -> <a href=\"search.php\">$strsearch</a> -> '".s($search)."'", "", "", "", $searchform);
+                 "<a href=\"index.php\">$strcourses</a> -> <a href=\"search.php\">$strsearch</a> -> '".s($search, true)."'", "", "", "", $searchform);
 
 
     $lastcategory = -1;

diff --git a/course/student.html b/course/student.html
index b9e23c87070d25613c512ad3b1d9d750c4a7d0a1..a7fdf549b545885215c565ee88837ace7095cba4 100644 (file)
--- a/course/student.html
+++ b/course/student.html
@@ -74,7 +74,7 @@
           ?>
          </select>
          <br />
-         <input type="text" name="searchtext" size="30" value="<?php p($searchtext) ?>" 
+         <input type="text" name="searchtext" size="30" value="<?php p($searchtext, true) ?>" 
                   onFocus ="document.studentform.add.disabled=true;
                             document.studentform.remove.disabled=true;
                             document.studentform.removeselect.selectedIndex=-1;

diff --git a/course/teacher.php b/course/teacher.php
index dda82220555fbcb2da7d5560d189136153b74252..464dcac85438b98b0dc5181f756542e2a0316924 100644 (file)
--- a/course/teacher.php
+++ b/course/teacher.php
@@ -188,7 +188,7 @@
     } else {
 
         if ($search != '') {
-            echo "<p align=\"center\">($strsearchresults : ".s($search).")</p>";
+            echo "<p align=\"center\">($strsearchresults : ".s($search, true).")</p>";
         }
 
         if (!$users = get_users(true, $search, true, $teacherlist)) {

diff --git a/lib/weblib.php b/lib/weblib.php
index 0f4b3d16d14c72e981df297ff5838f774313c434..f71ddd4efcd72378f6dbec336e07c2e08d7c158c 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -3538,10 +3538,10 @@ function update_categories_search_button($search,$page,$perpage) {
         return "<form target=\"$CFG->framename\" method=\"get\" action=\"$CFG->wwwroot/course/search.php\">".
                "<input type=\"hidden\" name=\"edit\" value=\"$edit\" />".
                "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />".
-               "<input type=\"hidden\" name=\"search\" value=\"$search\" />".
+               "<input type=\"hidden\" name=\"search\" value=\"".s($search, true)."\" />".
                "<input type=\"hidden\" name=\"page\" value=\"$page\" />".
                "<input type=\"hidden\" name=\"perpage\" value=\"$perpage\" />".
-               "<input type=\"submit\" value=\"$string\" /></form>";
+               "<input type=\"submit\" value=\"".s($string)."\" /></form>";
     }
 }