SlatePermutate Changeset - 936c42a99c1e · protofusion repositories

Changeset - 936c42a99c1e

Parent rev.

Child rev.

[Not reviewed]

default

0 5 0

Nathan Brink (binki) - 15 years ago 2010-10-12 21:26:07
ohnobinki@ohnopublishing.net

Escape user input when rendering it so that users may input things such as ampersands and double-quotes.

5 files changed with 18 insertions and 14 deletions:

class.class.php

class.schedule.php

class.section.php

inc/class.page.php

input.php

0 comments (0 inline, 0 general)

class.class.php

➞

Show inline comments

@@ @@ -64,24 +64,24 @@ class Classes @@
+  {
     return $this->name;
+  }
   /**
    * \brief
    *   Renders this Classes into something suitable for input.php.
    */
   function input_form_render($class_key)
+  {
     $n = "\n";
     $out = '<tr title="' . $class_key . '" class="class class' . $class_key . '">' . $n
-      . '  <td><input type="text" class="required defText" title="Class Name" name="postData[' . $class_key . '][name]" value="' . str_replace('"', '&quot;', $this->getName()) . '"/></td>' . $n
+      . '  <td><input type="text" class="required defText" title="Class Name" name="postData[' . $class_key . '][name]" value="' . htmlentities($this->getName()) . '"/></td>' . $n
       . '  <td colspan="8"></td>' . $n
       . '  <td class="tdInput"><div class="addSection"><input type="button" value="Add section" /></div></td>' . $n
       . '  <td class="tdInput"><div class="deleteClass"><input type="button" value="Remove" /></div></td>' . $n
       . "</tr>\n";
     foreach ($this->sections as $key => $section)
       $out .= $section->input_form_render($class_key, $key);
     return $out;
+  }
+}

class.schedule.php

➞

Show inline comments

@@ @@ -281,25 +281,25 @@ class Schedule @@
     */
     $footcloser = '';
     if(isset($_REQUEST['print']) && $_REQUEST['print'] != ''){
       $headcode = array('jQuery', 'jQueryUI', 'uiTabsKeyboard', 'outputStyle', 'outputPrintStyle');
+    }
     else {
 /*      $footcloser .="<script type=\"text/javascript\" charset=\"utf-8\">".
 	"\n\tvar my_glider = new Glider('my-glider', {duration:0});".
 	"\n</script>"; */
       $headcode = array('outputStyle',  'jQuery', 'jQueryUI', 'uiTabsKeyboard');
+    }
-    $outputPage = new page($this->getName(), $headcode);
+    $outputPage = new Page(htmlentities($this->getName()), $headcode);
     if(isset($_REQUEST['print'])){
      echo '<script type="text/javascript">';
       echo 'jQuery(document).ready( function() {';
       /* If user entered items to print */
       if($_REQUEST['print'] != 'all'){
 	echo 'jQuery(\'.section\').hide();';
 	$items = explode(',', $_REQUEST['print']);
@@ @@ -368,29 +368,29 @@ class Schedule @@
 		//---------------MONDAY---------------
 		for($j = 0; $j < $this->nclasses; $j++)
+		  {
 		    if($M == -1)
+		      {
 			if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getM())
+			  {
 			    if(($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() >= $time[$r]) && ($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() < $time[$r+1]))
+			      {
 				if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+				  {
-				    $table .= "\n\t\t<td class=\"top class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				    $table .= "\n\t\t<td class=\"top class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				    $M = $j;
 				    $filled = true;
 				  } else {
-				  $table .= "\n\t\t<td class=\"single class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				  $table .= "\n\t\t<td class=\"single class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				  $filled = true;
+				}
+			      }
+			  }
 		      } else {
 		      if($j == $M)
+			{
 			  if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+			    {
 			      $table .= "\n\t\t<td class=\"mid class{$j}\">&nbsp;</td>";
 			      $filled = true;
 			    } else {
@@ @@ -411,29 +411,29 @@ class Schedule @@
 		//---------------TUESDAY---------------
 		for($j = 0; $j < $this->nclasses; $j++)
+		  {
 		    if($Tu == -1)
+		      {
 			if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getTu())
+			  {
 			    if(($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() >= $time[$r]) && ($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() < $time[$r+1]))
+			      {
 				if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+				  {
-				    $table .= "\n\t\t<td class=\"top class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				    $table .= "\n\t\t<td class=\"top class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				    $Tu = $j;
 				    $filled = true;
 				  } else {
-				  $table .= "\n\t\t<td class=\"single class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				  $table .= "\n\t\t<td class=\"single class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				  $filled = true;
+				}
+			      }
+			  }
 		      } else {
 		      if($j == $Tu)
+			{
 			  if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+			    {
 			      $table .= "\n\t\t<td class=\"mid class{$j}\">&nbsp;</td>";
 			      $filled = true;
 			    } else {
@@ @@ -454,29 +454,29 @@ class Schedule @@
 		//---------------WEDNESDAY---------------
 		for($j = 0; $j < $this->nclasses; $j++)
+		  {
 		    if($W == -1)
+		      {
 			if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getW())
+			  {
 			    if(($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() >= $time[$r]) && ($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() < $time[$r+1]))
+			      {
 				if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+				  {
-				    $table .= "\n\t\t<td class=\"top class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				    $table .= "\n\t\t<td class=\"top class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				    $W = $j;
 				    $filled = true;
 				  } else {
-				  $table .= "\n\t\t<td class=\"single class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				  $table .= "\n\t\t<td class=\"single class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				  $filled = true;
+				}
+			      }
+			  }
 		      } else {
 		      if($j == $W)
+			{
 			  if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+			    {
 			      $table .= "\n\t\t<td class=\"mid class{$j}\">&nbsp;</td>";
 			      $filled = true;
 			    } else {
@@ @@ -497,29 +497,29 @@ class Schedule @@
 		//---------------THURSDAY---------------
 		for($j = 0; $j < $this->nclasses; $j++)
+		  {
 		    if($Th == -1)
+		      {
 			if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getTh())
+			  {
 			    if(($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() >= $time[$r]) && ($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() < $time[$r+1]))
+			      {
 				if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+				  {
-				    $table .= "\n\t\t<td class=\"top class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				    $table .= "\n\t\t<td class=\"top class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				    $Th = $j;
 				    $filled = true;
 				  } else {
-				  $table .= "\n\t\t<td class=\"single class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				  $table .= "\n\t\t<td class=\"single class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				  $filled = true;
+				}
+			      }
+			  }
 		      } else {
 		      if($j == $Th)
+			{
 			  if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+			    {
 			      $table .= "\n\t\t<td class=\"mid class{$j}\">&nbsp;</td>";
 			      $filled = true;
 			    } else {
@@ @@ -540,29 +540,29 @@ class Schedule @@
 		//---------------FRIDAY---------------
 		for($j = 0; $j < $this->nclasses; $j++)
+		  {
 		    if($F == -1)
+		      {
 			if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getF())
+			  {
 			    if(($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() >= $time[$r]) && ($this->classStorage[$j]->getSection($this->storage[$i][$j])->getStartTime() < $time[$r+1]))
+			      {
 				if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+				  {
-				    $table .= "\n\t\t<td class=\"top class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				    $table .= "\n\t\t<td class=\"top class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				    $F = $j;
 				    $filled = true;
 				  } else {
-				  $table .= "\n\t\t<td class=\"single class{$j}\">" . $this->classStorage[$j]->getName() . " " . $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() . "</td>";
+				  $table .= "\n\t\t<td class=\"single class{$j}\">" . htmlentities($this->classStorage[$j]->getName()) . " " . htmlentities( $this->classStorage[$j]->getSection($this->storage[$i][$j])->getLetter() ) . "</td>";
 				  $filled = true;
+				}
+			      }
+			  }
 		      } else {
 		      if($j == $F)
+			{
 			  if($this->classStorage[$j]->getSection($this->storage[$i][$j])->getEndTime() > $time[$r+1])
+			    {
 			      $table .= "\n\t\t<td class=\"mid class{$j}\">&nbsp;</td>";
 			      $filled = true;
 			    } else {

class.section.php

➞

Show inline comments

@@ @@ -163,25 +163,25 @@ class Section @@
+  {
     static $n = "\n";
     $out = '<tr class="section class' . $class_key . '">' . $n
       . '  <td class="none"></td>' . $n;
     switch ($section_format)
+      {
       case 'numerous':
       default:
 	/* see customIds() in scheduleInput.js */
 	$out .= '  <td class="sectionIdentifier center">' . $n
 	. '    <input type="text" size="1" class="required" title="Section Name"' . $n
 	. '           name="postData[' . $class_key . '][' . $section_key . '][letter]"' . $n
 	. '           value="' . $this->letter . '" />' . $n
+	. '           value="' . htmlentities($this->letter) . '" />' . $n
 	. "  </td>\n";
       break;
+      }
     $out .= "  <td>\n"
       . '    <select class="selectRequired" name="postData[' . $class_key . '][' . $section_key . '][start]">' . $n;
     for ($h = 7; $h <= 21; $h ++)
+      {
 	$nm = 'p';
 	$hr = $h;
 	if ($h < 12)
 	  $nm = 'a';

inc/class.page.php

➞

Show inline comments

@@ @@ -31,24 +31,28 @@ class page @@
   /*
    * Google analytics ga.js tracking code. Expanded in __construct().
    */
   private $trackingcode = '';
   private $pagetitle = ''; // Title of page
   private $scripts = array(); // Scripts to include on page
   /* the current school. See get_school(). */
   private $school;
   /**
    * \param $ntitle
    *   Must be a valid HTML string (i.e., escaped with htmlentities()).
    */
   public function __construct($ntitle, $nscripts = array(), $immediate = TRUE)
+  {
     global $ga_trackers;
     require_once('school.inc');
     // Scripts and styles available to include
     $this->headCode['jQuery'] = '<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3/jquery.min.js" type="text/javascript" />';
     $this->headCode['jQueryUI'] = '<script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.7/jquery-ui.min.js" type="text/javascript" /><link rel="stylesheet" href="styles/jqueryui.css" type="text/css" media="screen" charset="utf-8" />';
     $this->headCode['jValidate'] = '<script type="text/javascript" src="http://ajax.microsoft.com/ajax/jquery.validate/1.7/jquery.validate.pack.js"></script>';
     $this->headCode['schedInput'] = '<script type="text/javascript" src="scripts/scheduleInput.js"></script>';
     $this->headCode['outputPrintStyle'] = '<link rel="stylesheet" href="styles/print.css" type="text/css" media="screen" charset="utf-8" />';

input.php

➞

Show inline comments

@@ @@ -70,25 +70,25 @@ if (!empty($_REQUEST['selectschool']) @@
 $inputPage->showSavedScheds($_SESSION);
 ?>
 <p>
   Welcome to SlatePermutate<?php $inputPage->addressStudent(', ', '',
   FALSE); ?>! To get started, enter in some of your
   classes, and add available sections for each class.
 </p>
 <form method="post" action="process.php" id="scheduleForm">
 <br />
 <label>Schedule Name</label><br />
 <input id="scheduleName" style="margin-bottom: 1em;" class="defText required" type="text" size="25" title="(e.g., Spring <?php echo Date('Y'); ?>)" name="postData[name]"
-<?php if ($sch) echo 'value="' . str_replace('"', '&quot;', $sch->getName()) . '"'; /*"*/ ?>
+<?php if ($sch) echo 'value="' . htmlentities($sch->getName()) . '"'; /*"*/ ?>
 />
 <table id="container">
   <tr><td>
     <table id="jsrows">
 	<!-- Header -->
 	<tr>
 		<td>Class</td>
 		<td class="center" id="letterNumber">Section</td>
 		<td class="center">Start Time</td>
 		<td class="center">End Time</td>
 		<td class="center">M</td>

0 comments (0 inline, 0 general)