diff --git a/src/admin/charts.php b/src/admin/charts.php
index 91415bf..f43ff69 100644
--- a/src/admin/charts.php
+++ b/src/admin/charts.php
@@ -280,7 +280,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Do the final redirect
- RedirectResult( GetAndReplaceLangStr( $content['LN_CHARTS_HASBEENADDED'], $content['Name'] ) , "charts.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_CHARTS_HASBEENADDED'], DB_StripSlahes($content['Name']) ) , "charts.php" );
}
else if ( $_POST['op'] == "editchart" )
{
@@ -309,7 +309,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Done redirect!
- RedirectResult( GetAndReplaceLangStr( $content['LN_CHARTS_HASBEENEDIT'], $content['Name']) , "charts.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_CHARTS_HASBEENEDIT'], DB_StripSlahes($content['Name']) ) , "charts.php" );
}
}
}
diff --git a/src/admin/fields.php b/src/admin/fields.php
index db91fc3..23f1ffe 100644
--- a/src/admin/fields.php
+++ b/src/admin/fields.php
@@ -249,7 +249,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Do the final redirect
- RedirectResult( GetAndReplaceLangStr( $content['LN_FIELDS_HASBEENADDED'], $content['FieldCaption'] ) , "fields.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_FIELDS_HASBEENADDED'], DB_StripSlahes($content['FieldCaption']) ) , "fields.php" );
}
else
{
@@ -267,7 +267,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Done redirect!
- RedirectResult( GetAndReplaceLangStr( $content['LN_FIELDS_HASBEENEDIT'], $content['FieldCaption']) , "fields.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_FIELDS_HASBEENEDIT'], DB_StripSlahes($content['FieldCaption']) ) , "fields.php" );
}
}
}
diff --git a/src/admin/groups.php b/src/admin/groups.php
index 18c45e5..7623d30 100644
--- a/src/admin/groups.php
+++ b/src/admin/groups.php
@@ -322,7 +322,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Do the final redirect
- RedirectResult( GetAndReplaceLangStr( $content['LN_GROUP_HASBEENADDED'], $content['groupname'] ) , "groups.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_GROUP_HASBEENADDED'], DB_StripSlahes($content['groupname']) ) , "groups.php" );
}
}
else if ( $_POST['op'] == "editgroup" )
@@ -344,7 +344,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Done redirect!
- RedirectResult( GetAndReplaceLangStr( $content['LN_GROUP_ERROR_HASBEENEDIT'], $content['groupname']) , "groups.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_GROUP_ERROR_HASBEENEDIT'], DB_StripSlahes($content['groupname']) ) , "groups.php" );
}
}
else if ( $_POST['op'] == "adduser" )
diff --git a/src/admin/searches.php b/src/admin/searches.php
index 90fdd54..f8bd39d 100644
--- a/src/admin/searches.php
+++ b/src/admin/searches.php
@@ -235,7 +235,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Do the final redirect
- RedirectResult( GetAndReplaceLangStr( $content['LN_SEARCH_HASBEENADDED'], $content['DisplayName'] ) , "searches.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_SEARCH_HASBEENADDED'], DB_StripSlahes($content['DisplayName']) ) , "searches.php" );
}
else if ( $_POST['op'] == "editsearch" )
{
@@ -258,7 +258,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Done redirect!
- RedirectResult( GetAndReplaceLangStr( $content['LN_SEARCH_HASBEENEDIT'], $content['DisplayName']) , "searches.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_SEARCH_HASBEENEDIT'], DB_StripSlahes($content['DisplayName']) ) , "searches.php" );
}
}
}
diff --git a/src/admin/sources.php b/src/admin/sources.php
index 335da6c..490562d 100644
--- a/src/admin/sources.php
+++ b/src/admin/sources.php
@@ -512,7 +512,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Do the final redirect
- RedirectResult( GetAndReplaceLangStr( $content['LN_SOURCE_HASBEENADDED'], $content['Name'] ) , "sources.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_SOURCE_HASBEENADDED'], DB_StripSlahes($content['Name']) ) , "sources.php" );
}
else if ( $_POST['op'] == "editsource" )
{
@@ -567,7 +567,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Done redirect!
- RedirectResult( GetAndReplaceLangStr( $content['LN_SOURCES_HASBEENEDIT'], $content['Name']) , "sources.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_SOURCES_HASBEENEDIT'], DB_StripSlahes($content['Name']) ) , "sources.php" );
}
}
}
diff --git a/src/admin/users.php b/src/admin/users.php
index 20f91a1..09a760a 100644
--- a/src/admin/users.php
+++ b/src/admin/users.php
@@ -272,7 +272,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Do the final redirect
- RedirectResult( GetAndReplaceLangStr( $content['LN_USER_ERROR_HASBEENADDED'], $content['USERNAME'] ) , "users.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_USER_ERROR_HASBEENADDED'], DB_StripSlahes($content['USERNAME']) ) , "users.php" );
}
}
}
@@ -322,7 +322,7 @@ if ( isset($_POST['op']) )
}
// Done redirect!
- RedirectResult( GetAndReplaceLangStr( $content['LN_USER_ERROR_HASBEENEDIT'], $content['USERNAME']) , "users.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_USER_ERROR_HASBEENEDIT'], DB_StripSlahes($content['USERNAME']) ) , "users.php" );
}
}
}
diff --git a/src/admin/views.php b/src/admin/views.php
index 2f1cffd..243e8f5 100644
--- a/src/admin/views.php
+++ b/src/admin/views.php
@@ -275,7 +275,7 @@ if ( isset($content['ISEDITORNEWVIEW']) && $content['ISEDITORNEWVIEW'] )
if ( isset($_POST['op']) )
{
if ( isset ($_POST['id']) ) { $content['VIEWID'] = DB_RemoveBadChars($_POST['id']); } else {$content['VIEWID'] = ""; }
- if ( isset ($_POST['DisplayName']) ) { $content['DisplayName'] = DB_RemoveBadChars($_POST['DisplayName']); } else {$content['DisplayName'] = ""; }
+ if ( isset ($_POST['DisplayName']) ) { $content['DisplayName'] = DB_StripSlahes($_POST['DisplayName']); } else {$content['DisplayName'] = ""; }
// User & Group handeled specially
if ( isset ($_POST['isuseronly']) )
@@ -316,6 +316,9 @@ if ( isset($_POST['op']) )
// Add New entry into columnlist
$content['SUBCOLUMNS'][$szColId]['ColFieldID'] = $szColId;
+ // Set Internal FieldID
+ $content['SUBCOLUMNS'][$szColId]['ColInternalID'] = $fields[$szColId]['FieldDefine'];
+
// Set Fieldcaption
if ( isset($fields[$szColId]['FieldCaption']) )
$content['SUBCOLUMNS'][$szColId]['ColCaption'] = $fields[$szColId]['FieldCaption'];
@@ -411,6 +414,9 @@ if ( isset($_POST['op']) )
}
else // Now SUBOP means normal processing!
{
+ // Now we convert fr DB insert!
+ $content['DisplayName'] = DB_RemoveBadChars($_POST['DisplayName']);
+
// Everything was alright, so we go to the next step!
if ( $_POST['op'] == "addnewview" )
{
@@ -437,7 +443,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Do the final redirect
- RedirectResult( GetAndReplaceLangStr( $content['LN_VIEWS_HASBEENADDED'], $content['DisplayName'] ) , "views.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_VIEWS_HASBEENADDED'], DB_StripSlahes($content['DisplayName']) ) , "views.php" );
}
else
{
@@ -447,6 +453,9 @@ if ( isset($_POST['op']) )
}
else if ( $_POST['op'] == "editview" )
{
+ // Now we convert fr DB insert!
+ $content['DisplayName'] = DB_RemoveBadChars($_POST['DisplayName']);
+
$result = DB_Query("SELECT ID FROM " . DB_VIEWS . " WHERE ID = " . $content['VIEWID']);
$myrow = DB_GetSingleRow($result, true);
if ( !isset($myrow['ID']) )
@@ -480,7 +489,7 @@ if ( isset($_POST['op']) )
DB_FreeQuery($result);
// Done redirect!
- RedirectResult( GetAndReplaceLangStr( $content['LN_VIEWS_HASBEENEDIT'], $content['DisplayName']) , "views.php" );
+ RedirectResult( GetAndReplaceLangStr( $content['LN_VIEWS_HASBEENEDIT'], DB_StripSlahes($content['DisplayName']) ) , "views.php" );
}
else
{
diff --git a/src/convert.php b/src/convert.php
index 4f77e15..c20e989 100644
--- a/src/convert.php
+++ b/src/convert.php
@@ -211,7 +211,7 @@ else if ( $content['CONVERT_STEP'] == 4 )
if ( isset($_GET['errormsg']) )
{
$content['iserror'] = "true";
- $content['errormsg'] = DB_RemoveBadChars( urldecode($_GET['errormsg']) );
+ $content['errormsg'] = DB_StripSlahes( urldecode($_GET['errormsg']) );
}
}
else if ( $content['CONVERT_STEP'] == 5 )
diff --git a/src/include/functions_common.php b/src/include/functions_common.php
index 877f49c..6aa7942 100644
--- a/src/include/functions_common.php
+++ b/src/include/functions_common.php
@@ -1347,44 +1347,44 @@ function PrintSecureUserCheck( $warningtext, $yesmsg, $nomsg )
exit;
}
-function SaveGeneralSettingsIntoDB()
+function SaveGeneralSettingsIntoDB($bForceStripSlahes = false)
{
- WriteConfigValue( "ViewDefaultLanguage", true );
- WriteConfigValue( "ViewDefaultTheme", true );
+ WriteConfigValue( "ViewDefaultLanguage", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "ViewDefaultTheme", true, null, null,$bForceStripSlahes );
- WriteConfigValue( "ViewUseTodayYesterday", true );
- WriteConfigValue( "ViewEnableDetailPopups", true );
- WriteConfigValue( "EnableIPAddressResolve", true );
- WriteConfigValue( "MiscShowDebugMsg", true );
- WriteConfigValue( "MiscShowDebugGridCounter", true );
- WriteConfigValue( "MiscShowPageRenderStats", true );
- WriteConfigValue( "MiscEnableGzipCompression", true );
- WriteConfigValue( "SuppressDuplicatedMessages", true );
- WriteConfigValue( "TreatNotFoundFiltersAsTrue", true );
+ WriteConfigValue( "ViewUseTodayYesterday", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "ViewEnableDetailPopups", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "EnableIPAddressResolve", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "MiscShowDebugMsg", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "MiscShowDebugGridCounter", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "MiscShowPageRenderStats", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "MiscEnableGzipCompression", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "SuppressDuplicatedMessages", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "TreatNotFoundFiltersAsTrue", true, null, null,$bForceStripSlahes );
- WriteConfigValue( "ViewMessageCharacterLimit", true );
- WriteConfigValue( "ViewStringCharacterLimit", true );
- WriteConfigValue( "ViewEntriesPerPage", true );
- WriteConfigValue( "ViewEnableAutoReloadSeconds", true );
- WriteConfigValue( "PopupMenuTimeout", true );
+ WriteConfigValue( "ViewMessageCharacterLimit", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "ViewStringCharacterLimit", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "ViewEntriesPerPage", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "ViewEnableAutoReloadSeconds", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "PopupMenuTimeout", true, null, null,$bForceStripSlahes );
- WriteConfigValue( "PrependTitle", true );
- WriteConfigValue( "SearchCustomButtonCaption", true );
- WriteConfigValue( "SearchCustomButtonSearch", true );
+ WriteConfigValue( "PrependTitle", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "SearchCustomButtonCaption", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "SearchCustomButtonSearch", true, null, null,$bForceStripSlahes );
// Extra Fields
- WriteConfigValue( "DefaultViewsID", true );
- WriteConfigValue( "DefaultSourceID", true );
+ WriteConfigValue( "DefaultViewsID", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "DefaultSourceID", true, null, null,$bForceStripSlahes );
// GLOBAL ONLY
- WriteConfigValue( "DebugUserLogin", true );
- WriteConfigValue( "MiscDebugToSyslog", true );
- WriteConfigValue( "MiscMaxExecutionTime", true );
+ WriteConfigValue( "DebugUserLogin", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "MiscDebugToSyslog", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "MiscMaxExecutionTime", true, null, null,$bForceStripSlahes );
// Custom HTML Code
- WriteConfigValue( "InjectHtmlHeader", true );
- WriteConfigValue( "InjectBodyHeader", true );
- WriteConfigValue( "InjectBodyFooter", true );
+ WriteConfigValue( "InjectHtmlHeader", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "InjectBodyHeader", true, null, null,$bForceStripSlahes );
+ WriteConfigValue( "InjectBodyFooter", true, null, null ,$bForceStripSlahes );
}
function SaveUserGeneralSettingsIntoDB()
diff --git a/src/include/functions_db.php b/src/include/functions_db.php
index 2629e98..49db4a0 100644
--- a/src/include/functions_db.php
+++ b/src/include/functions_db.php
@@ -239,17 +239,18 @@ function DB_RemoveParserSpecialBadChars($myString)
return $returnstr;
}
-function DB_RemoveBadChars($myString, $dbEngine = DB_MYSQL)
+function DB_RemoveBadChars($myString, $dbEngine = DB_MYSQL, $bForceStripSlahes = false)
{
if ( $dbEngine == DB_MSSQL )
{
+//TODO STRIP SLASHES ?!
// MSSQL needs special treatment -.-
return str_replace("'","''",$myString);
}
else
{
// Replace with internal PHP Functions!
- if ( !get_magic_quotes_gpc() )
+ if ( !get_magic_quotes_gpc() || $bForceStripSlahes )
return addslashes($myString);
// return addcslashes($myString, "'");
else
@@ -322,17 +323,13 @@ function DB_Exec($query)
return false;
}
-function PrepareValueForDB($szValue)
+function PrepareValueForDB($szValue, $bForceStripSlahes = false)
{
-//echo "
" . $szValue . "
!" . preg_match("/[^\\\\]['\\\\][^'\\\\]/e", $szValue, $matches) . "
";
- // Copy value for DB and check for BadDB Chars!
-// if ( preg_match("/(?