diff --git a/src/admin/charts.php b/src/admin/charts.php index 91415bf..f43ff69 100644 --- a/src/admin/charts.php +++ b/src/admin/charts.php @@ -280,7 +280,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Do the final redirect - RedirectResult( GetAndReplaceLangStr( $content['LN_CHARTS_HASBEENADDED'], $content['Name'] ) , "charts.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_CHARTS_HASBEENADDED'], DB_StripSlahes($content['Name']) ) , "charts.php" ); } else if ( $_POST['op'] == "editchart" ) { @@ -309,7 +309,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Done redirect! - RedirectResult( GetAndReplaceLangStr( $content['LN_CHARTS_HASBEENEDIT'], $content['Name']) , "charts.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_CHARTS_HASBEENEDIT'], DB_StripSlahes($content['Name']) ) , "charts.php" ); } } } diff --git a/src/admin/fields.php b/src/admin/fields.php index db91fc3..23f1ffe 100644 --- a/src/admin/fields.php +++ b/src/admin/fields.php @@ -249,7 +249,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Do the final redirect - RedirectResult( GetAndReplaceLangStr( $content['LN_FIELDS_HASBEENADDED'], $content['FieldCaption'] ) , "fields.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_FIELDS_HASBEENADDED'], DB_StripSlahes($content['FieldCaption']) ) , "fields.php" ); } else { @@ -267,7 +267,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Done redirect! - RedirectResult( GetAndReplaceLangStr( $content['LN_FIELDS_HASBEENEDIT'], $content['FieldCaption']) , "fields.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_FIELDS_HASBEENEDIT'], DB_StripSlahes($content['FieldCaption']) ) , "fields.php" ); } } } diff --git a/src/admin/groups.php b/src/admin/groups.php index 18c45e5..7623d30 100644 --- a/src/admin/groups.php +++ b/src/admin/groups.php @@ -322,7 +322,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Do the final redirect - RedirectResult( GetAndReplaceLangStr( $content['LN_GROUP_HASBEENADDED'], $content['groupname'] ) , "groups.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_GROUP_HASBEENADDED'], DB_StripSlahes($content['groupname']) ) , "groups.php" ); } } else if ( $_POST['op'] == "editgroup" ) @@ -344,7 +344,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Done redirect! - RedirectResult( GetAndReplaceLangStr( $content['LN_GROUP_ERROR_HASBEENEDIT'], $content['groupname']) , "groups.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_GROUP_ERROR_HASBEENEDIT'], DB_StripSlahes($content['groupname']) ) , "groups.php" ); } } else if ( $_POST['op'] == "adduser" ) diff --git a/src/admin/searches.php b/src/admin/searches.php index 90fdd54..f8bd39d 100644 --- a/src/admin/searches.php +++ b/src/admin/searches.php @@ -235,7 +235,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Do the final redirect - RedirectResult( GetAndReplaceLangStr( $content['LN_SEARCH_HASBEENADDED'], $content['DisplayName'] ) , "searches.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_SEARCH_HASBEENADDED'], DB_StripSlahes($content['DisplayName']) ) , "searches.php" ); } else if ( $_POST['op'] == "editsearch" ) { @@ -258,7 +258,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Done redirect! - RedirectResult( GetAndReplaceLangStr( $content['LN_SEARCH_HASBEENEDIT'], $content['DisplayName']) , "searches.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_SEARCH_HASBEENEDIT'], DB_StripSlahes($content['DisplayName']) ) , "searches.php" ); } } } diff --git a/src/admin/sources.php b/src/admin/sources.php index 335da6c..490562d 100644 --- a/src/admin/sources.php +++ b/src/admin/sources.php @@ -512,7 +512,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Do the final redirect - RedirectResult( GetAndReplaceLangStr( $content['LN_SOURCE_HASBEENADDED'], $content['Name'] ) , "sources.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_SOURCE_HASBEENADDED'], DB_StripSlahes($content['Name']) ) , "sources.php" ); } else if ( $_POST['op'] == "editsource" ) { @@ -567,7 +567,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Done redirect! - RedirectResult( GetAndReplaceLangStr( $content['LN_SOURCES_HASBEENEDIT'], $content['Name']) , "sources.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_SOURCES_HASBEENEDIT'], DB_StripSlahes($content['Name']) ) , "sources.php" ); } } } diff --git a/src/admin/users.php b/src/admin/users.php index 20f91a1..09a760a 100644 --- a/src/admin/users.php +++ b/src/admin/users.php @@ -272,7 +272,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Do the final redirect - RedirectResult( GetAndReplaceLangStr( $content['LN_USER_ERROR_HASBEENADDED'], $content['USERNAME'] ) , "users.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_USER_ERROR_HASBEENADDED'], DB_StripSlahes($content['USERNAME']) ) , "users.php" ); } } } @@ -322,7 +322,7 @@ if ( isset($_POST['op']) ) } // Done redirect! - RedirectResult( GetAndReplaceLangStr( $content['LN_USER_ERROR_HASBEENEDIT'], $content['USERNAME']) , "users.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_USER_ERROR_HASBEENEDIT'], DB_StripSlahes($content['USERNAME']) ) , "users.php" ); } } } diff --git a/src/admin/views.php b/src/admin/views.php index 2f1cffd..243e8f5 100644 --- a/src/admin/views.php +++ b/src/admin/views.php @@ -275,7 +275,7 @@ if ( isset($content['ISEDITORNEWVIEW']) && $content['ISEDITORNEWVIEW'] ) if ( isset($_POST['op']) ) { if ( isset ($_POST['id']) ) { $content['VIEWID'] = DB_RemoveBadChars($_POST['id']); } else {$content['VIEWID'] = ""; } - if ( isset ($_POST['DisplayName']) ) { $content['DisplayName'] = DB_RemoveBadChars($_POST['DisplayName']); } else {$content['DisplayName'] = ""; } + if ( isset ($_POST['DisplayName']) ) { $content['DisplayName'] = DB_StripSlahes($_POST['DisplayName']); } else {$content['DisplayName'] = ""; } // User & Group handeled specially if ( isset ($_POST['isuseronly']) ) @@ -316,6 +316,9 @@ if ( isset($_POST['op']) ) // Add New entry into columnlist $content['SUBCOLUMNS'][$szColId]['ColFieldID'] = $szColId; + // Set Internal FieldID + $content['SUBCOLUMNS'][$szColId]['ColInternalID'] = $fields[$szColId]['FieldDefine']; + // Set Fieldcaption if ( isset($fields[$szColId]['FieldCaption']) ) $content['SUBCOLUMNS'][$szColId]['ColCaption'] = $fields[$szColId]['FieldCaption']; @@ -411,6 +414,9 @@ if ( isset($_POST['op']) ) } else // Now SUBOP means normal processing! { + // Now we convert fr DB insert! + $content['DisplayName'] = DB_RemoveBadChars($_POST['DisplayName']); + // Everything was alright, so we go to the next step! if ( $_POST['op'] == "addnewview" ) { @@ -437,7 +443,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Do the final redirect - RedirectResult( GetAndReplaceLangStr( $content['LN_VIEWS_HASBEENADDED'], $content['DisplayName'] ) , "views.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_VIEWS_HASBEENADDED'], DB_StripSlahes($content['DisplayName']) ) , "views.php" ); } else { @@ -447,6 +453,9 @@ if ( isset($_POST['op']) ) } else if ( $_POST['op'] == "editview" ) { + // Now we convert fr DB insert! + $content['DisplayName'] = DB_RemoveBadChars($_POST['DisplayName']); + $result = DB_Query("SELECT ID FROM " . DB_VIEWS . " WHERE ID = " . $content['VIEWID']); $myrow = DB_GetSingleRow($result, true); if ( !isset($myrow['ID']) ) @@ -480,7 +489,7 @@ if ( isset($_POST['op']) ) DB_FreeQuery($result); // Done redirect! - RedirectResult( GetAndReplaceLangStr( $content['LN_VIEWS_HASBEENEDIT'], $content['DisplayName']) , "views.php" ); + RedirectResult( GetAndReplaceLangStr( $content['LN_VIEWS_HASBEENEDIT'], DB_StripSlahes($content['DisplayName']) ) , "views.php" ); } else { diff --git a/src/convert.php b/src/convert.php index 4f77e15..c20e989 100644 --- a/src/convert.php +++ b/src/convert.php @@ -211,7 +211,7 @@ else if ( $content['CONVERT_STEP'] == 4 ) if ( isset($_GET['errormsg']) ) { $content['iserror'] = "true"; - $content['errormsg'] = DB_RemoveBadChars( urldecode($_GET['errormsg']) ); + $content['errormsg'] = DB_StripSlahes( urldecode($_GET['errormsg']) ); } } else if ( $content['CONVERT_STEP'] == 5 ) diff --git a/src/include/functions_common.php b/src/include/functions_common.php index 877f49c..6aa7942 100644 --- a/src/include/functions_common.php +++ b/src/include/functions_common.php @@ -1347,44 +1347,44 @@ function PrintSecureUserCheck( $warningtext, $yesmsg, $nomsg ) exit; } -function SaveGeneralSettingsIntoDB() +function SaveGeneralSettingsIntoDB($bForceStripSlahes = false) { - WriteConfigValue( "ViewDefaultLanguage", true ); - WriteConfigValue( "ViewDefaultTheme", true ); + WriteConfigValue( "ViewDefaultLanguage", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "ViewDefaultTheme", true, null, null,$bForceStripSlahes ); - WriteConfigValue( "ViewUseTodayYesterday", true ); - WriteConfigValue( "ViewEnableDetailPopups", true ); - WriteConfigValue( "EnableIPAddressResolve", true ); - WriteConfigValue( "MiscShowDebugMsg", true ); - WriteConfigValue( "MiscShowDebugGridCounter", true ); - WriteConfigValue( "MiscShowPageRenderStats", true ); - WriteConfigValue( "MiscEnableGzipCompression", true ); - WriteConfigValue( "SuppressDuplicatedMessages", true ); - WriteConfigValue( "TreatNotFoundFiltersAsTrue", true ); + WriteConfigValue( "ViewUseTodayYesterday", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "ViewEnableDetailPopups", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "EnableIPAddressResolve", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "MiscShowDebugMsg", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "MiscShowDebugGridCounter", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "MiscShowPageRenderStats", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "MiscEnableGzipCompression", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "SuppressDuplicatedMessages", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "TreatNotFoundFiltersAsTrue", true, null, null,$bForceStripSlahes ); - WriteConfigValue( "ViewMessageCharacterLimit", true ); - WriteConfigValue( "ViewStringCharacterLimit", true ); - WriteConfigValue( "ViewEntriesPerPage", true ); - WriteConfigValue( "ViewEnableAutoReloadSeconds", true ); - WriteConfigValue( "PopupMenuTimeout", true ); + WriteConfigValue( "ViewMessageCharacterLimit", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "ViewStringCharacterLimit", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "ViewEntriesPerPage", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "ViewEnableAutoReloadSeconds", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "PopupMenuTimeout", true, null, null,$bForceStripSlahes ); - WriteConfigValue( "PrependTitle", true ); - WriteConfigValue( "SearchCustomButtonCaption", true ); - WriteConfigValue( "SearchCustomButtonSearch", true ); + WriteConfigValue( "PrependTitle", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "SearchCustomButtonCaption", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "SearchCustomButtonSearch", true, null, null,$bForceStripSlahes ); // Extra Fields - WriteConfigValue( "DefaultViewsID", true ); - WriteConfigValue( "DefaultSourceID", true ); + WriteConfigValue( "DefaultViewsID", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "DefaultSourceID", true, null, null,$bForceStripSlahes ); // GLOBAL ONLY - WriteConfigValue( "DebugUserLogin", true ); - WriteConfigValue( "MiscDebugToSyslog", true ); - WriteConfigValue( "MiscMaxExecutionTime", true ); + WriteConfigValue( "DebugUserLogin", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "MiscDebugToSyslog", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "MiscMaxExecutionTime", true, null, null,$bForceStripSlahes ); // Custom HTML Code - WriteConfigValue( "InjectHtmlHeader", true ); - WriteConfigValue( "InjectBodyHeader", true ); - WriteConfigValue( "InjectBodyFooter", true ); + WriteConfigValue( "InjectHtmlHeader", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "InjectBodyHeader", true, null, null,$bForceStripSlahes ); + WriteConfigValue( "InjectBodyFooter", true, null, null ,$bForceStripSlahes ); } function SaveUserGeneralSettingsIntoDB() diff --git a/src/include/functions_db.php b/src/include/functions_db.php index 2629e98..49db4a0 100644 --- a/src/include/functions_db.php +++ b/src/include/functions_db.php @@ -239,17 +239,18 @@ function DB_RemoveParserSpecialBadChars($myString) return $returnstr; } -function DB_RemoveBadChars($myString, $dbEngine = DB_MYSQL) +function DB_RemoveBadChars($myString, $dbEngine = DB_MYSQL, $bForceStripSlahes = false) { if ( $dbEngine == DB_MSSQL ) { +//TODO STRIP SLASHES ?! // MSSQL needs special treatment -.- return str_replace("'","''",$myString); } else { // Replace with internal PHP Functions! - if ( !get_magic_quotes_gpc() ) + if ( !get_magic_quotes_gpc() || $bForceStripSlahes ) return addslashes($myString); // return addcslashes($myString, "'"); else @@ -322,17 +323,13 @@ function DB_Exec($query) return false; } -function PrepareValueForDB($szValue) +function PrepareValueForDB($szValue, $bForceStripSlahes = false) { -//echo "
" . $szValue . "
!" . preg_match("/[^\\\\]['\\\\][^'\\\\]/e", $szValue, $matches) . "
"; - // Copy value for DB and check for BadDB Chars! -// if ( preg_match("/(? - {LN_GEN_USERONLY} + {LN_SEARCH_QUERY}