Skip to content

Commit 1d4e289

Browse files
callcenter-magnuscallcenter-magnus
committed
CHtml::encode
1 parent f896f88 commit 1d4e289

File tree

4 files changed

+31
-17
lines changed

4 files changed

+31
-17
lines changed

‎build/MagnusBilling-current.tar.gz‎

-335 Bytes
Binary file not shown.

‎protected/components/MagnusLog.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ public static function insertLOG($action, $description)
1313
$id_user = isset(Yii::app()->session['id_user']) ? Yii::app()->session['id_user'] : null;
1414
$modelLogUsers = new LogUsers();
1515
$modelLogUsers->id_user = $id_user;
16-
$modelLogUsers->description = $description;
16+
$modelLogUsers->description = CHtml::encode($description);
1717
$modelLogUsers->id_log_actions = $action;
1818
$modelLogUsers->ip = $_SERVER['REMOTE_ADDR'];
1919
try {

‎protected/components/SqlInject.php‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,10 @@ public static function sanitize($src)
6363
'pg_query',
6464
'sqlite_query',
6565
'prepare',
66-
66+
'alert',
67+
'src=',
68+
'<img',
69+
'console'
6770
];
6871

6972

@@ -75,14 +78,17 @@ public static function sanitize($src)
7578
foreach ($codes as $code) {
7679

7780
$code = strtolower($code);
81+
if (Util::isJson($value)) {
82+
$value = json_decode($value);
83+
}
7884

7985
if (is_array($value)) {
8086
foreach ($value as $key => $valuearray) {
8187

8288
if (is_array($valuearray)) {
8389
foreach ($valuearray as $key => $value) {
8490

85-
$value = strtolower($value);
91+
$value = @strtolower($value);
8692
if (strlen($value) > 250) {
8793
$info = 'Variable to long: ' . $value . '. Controller => ' . Yii::app()->controller->id;
8894
$id_user = isset(Yii::app()->session['id_user']) ? Yii::app()->session['id_user'] : 'NULL';
@@ -91,7 +97,7 @@ public static function sanitize($src)
9197
'rows' => [],
9298
'count' => 0,
9399
'sum' => [],
94-
'msg' => $info
100+
'msg' => CHtml::encode($info)
95101
]);
96102
exit;
97103
}
@@ -107,7 +113,7 @@ public static function sanitize($src)
107113
'rows' => [],
108114
'count' => 0,
109115
'sum' => [],
110-
'msg' => $info
116+
'msg' => CHtml::encode($info)
111117
]);
112118
exit;
113119
}
@@ -122,7 +128,7 @@ public static function sanitize($src)
122128
'rows' => [],
123129
'count' => 0,
124130
'sum' => [],
125-
'msg' => $info
131+
'msg' => CHtml::encode($info)
126132
]);
127133
exit;
128134
}
@@ -138,7 +144,7 @@ public static function sanitize($src)
138144
'rows' => [],
139145
'count' => 0,
140146
'sum' => [],
141-
'msg' => $info
147+
'msg' => CHtml::encode($info)
142148
]);
143149
exit;
144150
}
@@ -154,7 +160,7 @@ public static function sanitize($src)
154160
'rows' => [],
155161
'count' => 0,
156162
'sum' => [],
157-
'msg' => $info
163+
'msg' => CHtml::encode($info)
158164
]);
159165
exit;
160166
}
@@ -167,7 +173,7 @@ public static function sanitize($src)
167173
'rows' => [],
168174
'count' => 0,
169175
'sum' => [],
170-
'msg' => $info
176+
'msg' => CHtml::encode($info)
171177
]);
172178
exit;
173179
}

‎protected/components/Util.php‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
<?php
2+
23
/**
34
* =======================================
45
* ###################################
@@ -59,8 +60,10 @@ public static function getNewUsername($required = true)
5960
$length = $config['global']['generate_length'] == 0 ? 5 : $config['global']['generate_length'];
6061

6162
if (isset($_SESSION['id_group']) && Yii::app()->session['id_group'] > 0) {
62-
$modeGroupUser = GroupUser::model()->find('id = :key',
63-
[':key' => Yii::app()->session['id_group']]);
63+
$modeGroupUser = GroupUser::model()->find(
64+
'id = :key',
65+
[':key' => Yii::app()->session['id_group']]
66+
);
6467
}
6568

6669
if (isset($modeGroupUser->id) && strlen($modeGroupUser->user_prefix) > 0) {
@@ -194,7 +197,7 @@ public static function unique_multidim_array($array, $key)
194197
$key_array = [];
195198

196199
foreach ($array as $val) {
197-
if ( ! in_array($val[$key], $key_array)) {
200+
if (! in_array($val[$key], $key_array)) {
198201
$key_array[$i] = $val[$key];
199202
$temp_array[$i] = $val;
200203
}
@@ -210,7 +213,7 @@ public static function unique_multidim_obj($obj, $key)
210213
$key_array = [];
211214

212215
foreach ($obj as $val) {
213-
if ( ! in_array($val->$key, $key_array)) {
216+
if (! in_array($val->$key, $key_array)) {
214217
$key_array[$i] = $val->$key;
215218
$temp_array[$i] = $val;
216219
}
@@ -259,7 +262,6 @@ public static function number_translation($prefix_local, $destination)
259262
} elseif ($number_prefix == $grab) {
260263
$destination = $replace . substr($destination, strlen($grab));
261264
}
262-
263265
} else {
264266

265267
if (strlen($destination) == $digit) {
@@ -288,7 +290,6 @@ public static function calculation_price($buyrate, $duration, $initblock, $incre
288290
if ($mod_sec > 0) {
289291
$ratecallduration += ($increment - $mod_sec);
290292
}
291-
292293
}
293294
$ratecost = ($ratecallduration / 60) * $buyrate;
294295
$ratecost = $ratecost;
@@ -299,7 +300,7 @@ public static function valid_extension($filename, $allowed = [])
299300
{
300301
$ext = strtolower(CFileHelper::getExtension($filename));
301302

302-
if ( ! in_array($ext, $allowed)) {
303+
if (! in_array($ext, $allowed)) {
303304
echo json_encode([
304305
'success' => false,
305306
'errors' => 'File error',
@@ -308,6 +309,13 @@ public static function valid_extension($filename, $allowed = [])
308309
}
309310

310311
return $ext;
311-
312+
}
313+
public static function isJson($string)
314+
{
315+
if (!is_string($string)) {
316+
return false;
317+
}
318+
json_decode($string);
319+
return (json_last_error() === JSON_ERROR_NONE);
312320
}
313321
}

0 commit comments

Comments
 (0)