Files @ 8d55669e05c2
Branch filter:

Location: SlatePermutate/feedback.php - annotation

binki
Add some hacks to support pure HTTPS for WebAdvisor XSS automatic registration hack.

Instead of using a JSONP callback and PHP sessions to store the
TOKENIDX, the XSS script now just updates the URL parameter for the
WebAdvisor login page so that the TOKENIDX will be transferred to
webadvisor.php by a GET variable right when it is needed instead of
asynchronously.

A separate hack to help support HTTPS is that automatic uploading of
assets to Amazon S3 (which has HTTPS access) allows the XSS script to
be served over HTTPS. This eliminates the browser warnings about
accessing mixed secure/insecure content and, thus, hopefully supports
browsers which automatically block insecure content on secure pages.
<?php 
/*
 * Copyright 2010 Nathan Gelderloos, Ethan Zonca, Nathan Phillip Brink
 *
 * This file is part of SlatePermutate.
 *
 * SlatePermutate is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * SlatePermutate is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with SlatePermutate.  If not, see <http://www.gnu.org/licenses/>.
 */

include_once 'inc/class.page.php';
require_once 'inc/class.schedule.php';

$feedbackpage = page::page_create('Feedback');
$feedbackpage->head();
$ipi = $_SERVER['REMOTE_ADDR'];
$fromdom = $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
$httpagenti = $_SERVER['HTTP_USER_AGENT'];

$referrer = '';
if (!empty($_SERVER['HTTP_REFERER']))
  $referrer = $_SERVER['HTTP_REFERER'];
if (!empty($_POST['referrer']))
  $referrer = $_POST['referrer'];

$saved_schedules = array();
if (!empty($_SESSION['saved']))
  foreach ($_SESSION['saved'] as $key => $val)
    $saved_schedules[] = '<a href="' . htmlentities(Schedule::url($key)) . '">' . htmlentities($key) . '</a>';
$saved_schedules = implode(', ', $saved_schedules);

/* some prefill support */
$school = $feedbackpage->get_school();
$feedback_text = '';
if (isset($_GET['feedback']))
  $feedback_text = $_GET['feedback'];

$n = "\n";

?>

<form action="feedback-submit.php" method="post">
<div id="feedback-form-content">
<input type="hidden" id="ip" name="ip" value="<?php echo $ipi ?>" />
<input type="hidden" id="fromdom" name="fromdom" value="<?php echo $fromdom ?>" />
<input type="hidden" id="httpagent" name="httpagent" value="<?php echo $httpagenti ?>" />

<table>
<tr><td><label for="nameis">Name: </label></td><td><input type="text" id="nameis" name="nameis" size="20" /></td></tr>
<tr><td><label for="visitormail">Email:</label></td><td><input type="text" id="visitormail" name="visitormail" size="20" /></td></tr>
<tr><td><label for="school">School: </label></td><td><input type="text" id="school" name="school" value="<?php echo htmlentities($school['id']); ?>" size="20" /> <span class="graytext">(if relevant to your feedback)</span></td></tr>
  <tr><td><label for="referrer">Relevant Page:</label></td><td><input type="text" id="referrer" name="referrer" value="<?php echo htmlentities($referrer); ?>" size="20" /> <span class="graytext">(if relevant to your feedback)</span></td></tr>
</table>
<br/>
<div id="ratings">
  <div id="ratings-label">Overall Rating:</div>
  <input checked="checked" id="rating-great" name="rating" type="radio" value="Great" /><label for="rating-great">Great</label>
  <input id="rating-usable" name="rating" type="radio" value="Usable" /><label for="rating-usable">Usable</label>
  <input id="rating-buggy" name="rating" type="radio" value="Buggy/Hard to Use" /><label for="rating-buggy">Buggy/Hard to Use</label>
  <input id="rating-unknown" name="rating" type="radio" value="Don't know" /><label for="rating-unknown">Don't Know <!-- ' --></label>
</div>
<h3>General Comments</h3>
<p>
  <textarea name="feedback" rows="6" cols="40"><?php echo htmlentities($feedback_text); ?></textarea>
</p>

<?php
    if ($use_captcha)
    {
      echo '' . $n
      . '  <h3>Captcha</h3>' . $n
      . '<p>' . $n
      . '  <img id="captcha_img" src="captcha_img.php" alt="captcha image" /><br />' . $n
      . '  <label for="captcha_code">Enter the obfuscated text from the above image:</label><br />' . $n
      . '  <input id="captcha_code" name="captcha_code" type="text" />' . $n
      . '</p>' . $n;
    }
?>

<input class="gray" type="submit" value="Send Feedback" />

<?php if (!empty($saved_schedules)): ?>
<p class="graytext" style="margin-top: 20pt;">
  The following information will also be submitted when you send feedback:
</p>
<table class="graytext">
  <tr>
    <th>Type</th>
    <th>Value</th>
  </tr>
  <tr>
  <td>Saved Schedules:</td>
    <td><?php echo $saved_schedules; ?></td>
  </tr>
</table>
<?php endif; ?>
</div>
</form>

<?php
$feedbackpage->foot();