From 01023e5fb256028bb39999665b9a60e6f9a3c1c6 Mon Sep 17 00:00:00 2001 From: wangyidong Date: Tue, 12 Aug 2014 08:14:52 +0000 Subject: [PATCH] * finish task #1793. --- lib/filter/filter.class.php | 133 ++++++++++++++++++++--- module/bug/model.php | 28 ++--- module/build/model.php | 5 +- module/company/model.php | 2 +- module/doc/model.php | 10 +- module/file/model.php | 2 + module/group/model.php | 6 +- module/product/model.php | 4 +- module/productplan/model.php | 4 +- module/project/model.php | 4 +- module/release/model.php | 6 +- module/search/model.php | 1 - module/story/model.php | 38 +++---- module/task/model.php | 43 ++++---- module/testcase/model.php | 43 ++++---- module/testcase/view/showimport.html.php | 2 +- module/testtask/model.php | 7 +- module/todo/model.php | 27 ++--- module/tree/model.php | 2 +- module/user/model.php | 1 - 20 files changed, 237 insertions(+), 131 deletions(-) diff --git a/lib/filter/filter.class.php b/lib/filter/filter.class.php index 77923cec59..17df909708 100755 --- a/lib/filter/filter.class.php +++ b/lib/filter/filter.class.php @@ -122,7 +122,7 @@ class validater */ public static function checkIP($var, $range = 'all') { - if($range == 'all') return filter_var($var, FILTER_VALIDATE_IP); + if($range == 'all') return filter_var($var, FILTER_VALIDATE_IP); if($range == 'public static') return filter_var($var, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE); if($range == 'private') { @@ -215,6 +215,20 @@ class validater return self::checkREG($var, '|^[a-zA-Z0-9_]{1}[a-zA-Z0-9_\.]{1,}[a-zA-Z0-9_]{1}$|'); } + /** + * Check captcha. + * + * @param mixed $var + * @static + * @access public + * @return bool + */ + public static function checkCaptcha($var) + { + if(!isset($_SESSION['captcha'])) return false; + return $var == $_SESSION['captcha']; + } + /** * Must equal a value. * @@ -232,8 +246,8 @@ class validater /** * Must greater than a value. * - * @param mixed $var - * @param mixed $value + * @param mixed $var + * @param mixed $value * @static * @access public * @return bool @@ -242,12 +256,26 @@ class validater { return $var > $value; } - + /** - * Must greater than or equal a value. + * Must less than a value. * - * @param mixed $var - * @param mixed $value + * @param mixed $var + * @param mixed $value + * @static + * @access public + * @return bool + */ + public static function checkLT($var, $value) + { + return $var < $value; + } + + /** + * Must greater than a value or equal a value. + * + * @param mixed $var + * @param mixed $value * @static * @access public * @return bool @@ -257,6 +285,35 @@ class validater return $var >= $value; } + /** + * Must less than a value or equal a value. + * + * @param mixed $var + * @param mixed $value + * @static + * @access public + * @return bool + */ + public static function checkLE($var, $value) + { + return $var <= $value; + } + + /** + * Must in value list. + * + * @param mixed $var + * @param mixed $value + * @static + * @access public + * @return bool + */ + public static function checkIn($var, $value) + { + if(!is_array($value)) $value = explode(',', $value); + return in_array($var, $value); + } + /** * Call a function to check it. * @@ -287,6 +344,7 @@ class fixer */ private $data; + private $stripedFields = array(); /** * The construction function, according the scope, convert it to object. * @@ -421,11 +479,29 @@ class fixer public function specialChars($fieldName) { $fields = $this->processFields($fieldName); - foreach($fields as $fieldName) $this->data->$fieldName = htmlspecialchars($this->data->$fieldName, ENT_QUOTES); + foreach($fields as $fieldName) + { + if(empty($this->stripedFields) or !in_array($fieldName, $this->stripedFields)) $this->data->$fieldName = $this->specialArray($this->data->$fieldName); + } return $this; } - + /** + * Special array + * + * @param mix $data + * @access public + * @return mix + */ + public function specialArray($data) + { + if(!is_array($data)) return htmlspecialchars($data, ENT_QUOTES); + + foreach($data as &$value) $value = $this->specialArray($value); + + return $data; + } + /** * Strip tags * @@ -441,6 +517,20 @@ class fixer return $this; } + /** + * Skip special chars. + * + * @param string $filename + * @access public + * @return object fixer object + */ + public function skipSpecial($fieldName) + { + $fields = $this->processFields($fieldName); + foreach($fields as $fieldName) $this->stripedFields[] = $fieldName; + return $this; + } + /** * Quote * @@ -589,15 +679,30 @@ class fixer /** * Get the data after fixing. + * + * If only one field, return it's value directly. + * More fields, remove other fields not in the list and return $data. * - * @param string $fieldName + * @param string $fields the fields list. * @access public - * @return object + * @return mix */ - public function get($fieldName = '') + public function get($fields = '') { - if(empty($fieldName)) return $this->data; - return $this->data->$fieldName; + $fields = str_replace(' ', '', trim($fields)); + foreach($this->data as $field => $value) $this->specialChars($field); + + if(empty($fields)) return $this->data; + if(strpos($fields, ',') === false) return $this->data->$fields; + + $fields = array_flip(explode(',', $fields)); + foreach($this->data as $field => $value) + { + if(!isset($fields[$field])) unset($this->data->$field); + if(!in_array($field, $this->stripedFields)) $this->data->$field = $this->specialChars($this->data->field); + } + + return $this->data; } /** diff --git a/module/bug/model.php b/module/bug/model.php index 1cfeee80e3..4ff8d00aac 100644 --- a/module/bug/model.php +++ b/module/bug/model.php @@ -48,7 +48,7 @@ class bugModel extends model ->setDefault('openedBuild', '') ->setIF($this->post->assignedTo != '', 'assignedDate', $now) ->setIF($this->post->story != false, 'storyVersion', $this->loadModel('story')->getVersion($this->post->story)) - ->specialChars('title,keyword') + ->skipSpecial($this->config->bug->editor->create['id']) ->cleanInt('product, module, severity') ->join('openedBuild', ',') ->join('mailto', ',') @@ -99,7 +99,7 @@ class bugModel extends model $bug->project = $data->projects[$i] ? $data->projects[$i] : 0; $bug->openedBuild = implode(',', $data->openedBuilds[$i]); $bug->title = $data->titles[$i]; - $bug->steps = nl2br(htmlspecialchars($data->stepses[$i])); + $bug->steps = nl2br($data->stepses[$i]); $bug->type = $data->types[$i]; $bug->severity = $data->severities[$i]; $bug->os = $data->oses[$i]; @@ -251,8 +251,7 @@ class bugModel extends model $now = helper::now(); $bug = fixer::input('post') ->cleanInt('product,module,severity,project,story,task') - ->specialChars('title,keyword') - ->remove('comment,files,labels') + ->skipSpecial($this->config->bug->editor->edit['id']) ->setDefault('project,module,project,story,task,duplicateBug', 0) ->setDefault('openedBuild', '') ->setDefault('plan', 0) @@ -275,6 +274,7 @@ class bugModel extends model ->setIF($this->post->resolution == '' and $this->post->resolvedDate =='', 'status', 'active') ->setIF($this->post->resolution != '', 'confirmed', 1) ->setIF($this->post->story != false and $this->post->story != $oldBug->story, 'storyVersion', $this->loadModel('story')->getVersion($this->post->story)) + ->remove('comment,files,labels') ->get(); $this->dao->update(TABLE_BUG)->data($bug) @@ -300,6 +300,7 @@ class bugModel extends model $bugs = array(); $allChanges = array(); $now = helper::now(); + $data = fixer::input('post')->get(); $bugIDList = $this->post->bugIDList ? $this->post->bugIDList : array(); /* Adjust whether the post data is complete, if not, remove the last element of $bugIDList. */ @@ -315,15 +316,15 @@ class bugModel extends model $bug = new stdclass(); $bug->lastEditedBy = $this->app->user->account; $bug->lastEditedDate = $now; - $bug->type = $this->post->types[$bugID]; - $bug->severity = $this->post->severities[$bugID]; - $bug->pri = $this->post->pris[$bugID]; - $bug->status = $this->post->statuses[$bugID]; - $bug->title = htmlspecialchars($this->post->titles[$bugID]); - $bug->assignedTo = $this->post->assignedTos[$bugID]; - $bug->resolvedBy = $this->post->resolvedBys[$bugID]; - $bug->resolution = $this->post->resolutions[$bugID]; - $bug->duplicateBug = $this->post->duplicateBugs[$bugID] ? $this->post->duplicateBugs[$bugID] : $oldBug->duplicateBug; + $bug->type = $data->types[$bugID]; + $bug->severity = $data->severities[$bugID]; + $bug->pri = $data->pris[$bugID]; + $bug->status = $data->statuses[$bugID]; + $bug->title = $data->titles[$bugID]; + $bug->assignedTo = $data->assignedTos[$bugID]; + $bug->resolvedBy = $data->resolvedBys[$bugID]; + $bug->resolution = $data->resolutions[$bugID]; + $bug->duplicateBug = $data->duplicateBugs[$bugID] ? $data->duplicateBugs[$bugID] : $oldBug->duplicateBug; if($bug->assignedTo != $oldBug->assignedTo) $bug->assignedDate = $now; if(($bug->resolvedBy != '' or $bug->resolution != '') and $oldBug->status != 'resolved') $bug->resolvedDate = $now; @@ -1080,7 +1081,6 @@ class bugModel extends model public function saveUserBugTemplate() { $template = fixer::input('post') - ->specialChars('title') ->add('account', $this->app->user->account) ->add('type', 'bug') ->get(); diff --git a/module/build/model.php b/module/build/model.php index 4c54f9eb16..86190fe7fc 100644 --- a/module/build/model.php +++ b/module/build/model.php @@ -152,11 +152,12 @@ class buildModel extends model $build->stories = ''; $build->bugs = ''; - $build = fixer::input('post')->stripTags('name') + $build = fixer::input('post') ->setDefault('product', 0) ->join('stories', ',') ->join('bugs', ',') ->add('project', (int)$projectID) + ->skipSpecial($this->config->build->editor->create['id']) ->remove('resolvedBy,allchecker,files,labels') ->get(); @@ -181,11 +182,11 @@ class buildModel extends model { $oldBuild = $this->getByID($buildID); $build = fixer::input('post') - ->stripTags('name') ->setDefault('stories', '') ->setDefault('bugs', '') ->join('stories', ',') ->join('bugs', ',') + ->skipSpecial($this->config->build->editor->edit['id']) ->remove('allchecker,resolvedBy,files,labels') ->get(); diff --git a/module/company/model.php b/module/company/model.php index 817a95c002..d5b33a8b31 100644 --- a/module/company/model.php +++ b/module/company/model.php @@ -69,7 +69,7 @@ class companyModel extends model */ public function update() { - $company = fixer::input('post')->stripTags('name')->get(); + $company = fixer::input('post')->get(); if($company->website == 'http://') $company->website = ''; if($company->backyard == 'http://') $company->backyard = ''; $companyID = $this->app->company->id; diff --git a/module/doc/model.php b/module/doc/model.php index 72d2563783..1d6a08d354 100644 --- a/module/doc/model.php +++ b/module/doc/model.php @@ -74,7 +74,7 @@ class docModel extends model */ public function createLib() { - $lib = fixer::input('post')->stripTags('name')->get(); + $lib = fixer::input('post')->get(); $this->dao->insert(TABLE_DOCLIB) ->data($lib) ->autoCheck() @@ -95,7 +95,7 @@ class docModel extends model { $libID = (int)$libID; $oldLib = $this->getLibById($libID); - $lib = fixer::input('post')->stripTags('name')->get(); + $lib = fixer::input('post')->get(); $this->dao->update(TABLE_DOCLIB) ->data($lib) ->autoCheck() @@ -183,7 +183,7 @@ class docModel extends model ->add('addedBy', $this->app->user->account) ->add('addedDate', $now) ->setDefault('product, project, module', 0) - ->specialChars('title, digest, keywords') + ->skipSpecial($this->config->doc->editor->create['id']) ->encodeURL('url') ->cleanInt('product, project, module') ->remove('files, labels') @@ -218,11 +218,11 @@ class docModel extends model $doc = fixer::input('post') ->cleanInt('module') ->setDefault('module', 0) - ->specialChars('title,digest,keywords') + ->skipSpecial($this->config->doc->editor->edit['id']) ->encodeURL('url') - ->remove('comment,files, labels') ->add('editedBy', $this->app->user->account) ->add('editedDate', $now) + ->remove('comment,files, labels') ->get(); $condition = "lib = '$doc->lib' AND module = $doc->module AND id != $docID"; diff --git a/module/file/model.php b/module/file/model.php index 93dd5c2212..96214356a3 100644 --- a/module/file/model.php +++ b/module/file/model.php @@ -289,6 +289,8 @@ class fileModel extends model while(($line = fgets($handle)) !== false) { $line = trim($line); + if(substr($line, -1) != ',') $line .= ','; + $line = str_replace(',"",', ',,', $line); $line = str_replace(',"",', ',,', $line); $line = preg_replace_callback('/(\"{2,})(\,+)/U', array($this, 'removeInterference'), $line); diff --git a/module/group/model.php b/module/group/model.php index 1fd47ba7bf..44891176a9 100644 --- a/module/group/model.php +++ b/module/group/model.php @@ -21,7 +21,7 @@ class groupModel extends model */ public function create() { - $group = fixer::input('post')->specialChars('name, desc')->get(); + $group = fixer::input('post')->get(); return $this->dao->insert(TABLE_GROUP)->data($group)->batchCheck($this->config->group->create->requiredFields, 'notempty')->exec(); } @@ -34,7 +34,7 @@ class groupModel extends model */ public function update($groupID) { - $group = fixer::input('post')->specialChars('name, desc')->get(); + $group = fixer::input('post')->get(); return $this->dao->update(TABLE_GROUP)->data($group)->batchCheck($this->config->group->edit->requiredFields, 'notempty')->where('id')->eq($groupID)->exec(); } @@ -47,7 +47,7 @@ class groupModel extends model */ public function copy($groupID) { - $group = fixer::input('post')->specialChars('name, desc')->remove('options')->get(); + $group = fixer::input('post')->remove('options')->get(); $this->dao->insert(TABLE_GROUP)->data($group)->check('name', 'unique')->check('name', 'notempty')->exec(); if($this->post->options == false) return; if(!dao::isError()) diff --git a/module/product/model.php b/module/product/model.php index 36c4794f1a..3ffab2c33b 100644 --- a/module/product/model.php +++ b/module/product/model.php @@ -207,13 +207,13 @@ class productModel extends model public function create() { $product = fixer::input('post') - ->stripTags('name,code') ->setIF($this->post->acl != 'custom', 'whitelist', '') ->setDefault('status', 'normal') ->setDefault('createdBy', $this->app->user->account) ->setDefault('createdDate', helper::now()) ->setDefault('createdVersion', $this->config->version) ->join('whitelist', ',') + ->skipSpecial($this->config->product->editor->create['id']) ->get(); $this->dao->insert(TABLE_PRODUCT) ->data($product) @@ -237,9 +237,9 @@ class productModel extends model $productID = (int)$productID; $oldProduct = $this->getById($productID); $product = fixer::input('post') - ->stripTags('name,code') ->setIF($this->post->acl != 'custom', 'whitelist', '') ->join('whitelist', ',') + ->skipSpecial($this->config->product->editor->edit['id']) ->get(); $this->dao->update(TABLE_PRODUCT) ->data($product) diff --git a/module/productplan/model.php b/module/productplan/model.php index 8c863f5d6c..ad09ee17c8 100644 --- a/module/productplan/model.php +++ b/module/productplan/model.php @@ -105,7 +105,7 @@ class productplanModel extends model */ public function create() { - $plan = fixer::input('post')->stripTags('title')->remove('delta')->get(); + $plan = fixer::input('post')->skipSpecial($this->config->productplan->editor->create['id'])->remove('delta')->get(); $this->dao->insert(TABLE_PRODUCTPLAN) ->data($plan) ->autoCheck() @@ -125,7 +125,7 @@ class productplanModel extends model public function update($planID) { $oldPlan = $this->getById($planID); - $plan = fixer::input('post')->stripTags('title')->get(); + $plan = fixer::input('post')->skipSpecial($this->config->productplan->editor->edit['id'])->get(); $this->dao->update(TABLE_PRODUCTPLAN) ->data($plan) ->autoCheck() diff --git a/module/project/model.php b/module/project/model.php index ac31c8d116..49f86dd878 100644 --- a/module/project/model.php +++ b/module/project/model.php @@ -211,11 +211,11 @@ class projectModel extends model $this->lang->project->team = $this->lang->project->teamname; $project = fixer::input('post') ->setDefault('status', 'wait') - ->stripTags('name, code, team') ->setIF($this->post->acl != 'custom', 'whitelist', '') ->setDefault('openedVersion', $this->config->version) ->setDefault('team', $this->post->name) ->join('whitelist', ',') + ->skipSpecial($this->config->project->editor->create['id']) ->remove('products, workDays, delta') ->get(); $this->dao->insert(TABLE_PROJECT)->data($project) @@ -280,12 +280,12 @@ class projectModel extends model $this->lang->project->team = $this->lang->project->teamname; $projectID = (int)$projectID; $project = fixer::input('post') - ->stripTags('name, code, team') ->setIF($this->post->begin == '0000-00-00', 'begin', '') ->setIF($this->post->end == '0000-00-00', 'end', '') ->setIF($this->post->acl != 'custom', 'whitelist', '') ->setDefault('team', $this->post->name) ->join('whitelist', ',') + ->skipSpecial($this->config->project->editor->create['id']) ->remove('products') ->get(); $this->dao->update(TABLE_PROJECT)->data($project) diff --git a/module/release/model.php b/module/release/model.php index 01b2e0fff8..e1995404b3 100644 --- a/module/release/model.php +++ b/module/release/model.php @@ -100,9 +100,9 @@ class releaseModel extends model if($this->post->build == false) { $build = fixer::input('post') - ->stripTags('name') ->add('product', (int)$productID) ->add('builder', $this->app->user->account) + ->skipSpecial($this->config->release->editor->create['id']) ->remove('build,files,labels') ->get(); $this->dao->insert(TABLE_BUILD)->data($build)->autoCheck()->check('name','unique')->exec(); @@ -110,12 +110,12 @@ class releaseModel extends model } $release = fixer::input('post') - ->stripTags('name') ->add('product', (int)$productID) ->setDefault('stories', '') ->join('stories', ',') ->join('bugs', ',') ->setIF($this->post->build == false, 'build', $buildID) + ->skipSpecial($this->config->release->editor->create['id']) ->remove('allchecker,files,labels') ->get(); @@ -143,11 +143,11 @@ class releaseModel extends model { $oldRelease = $this->getByID($releaseID); $release = fixer::input('post') - ->stripTags('name') ->setDefault('stories', '') ->setDefault('bugs', '') ->join('stories', ',') ->join('bugs', ',') + ->skipSpecial($this->config->release->editor->edit['id']) ->remove('files,labels,allchecker') ->get(); $this->dao->update(TABLE_RELEASE)->data($release) diff --git a/module/search/model.php b/module/search/model.php index daa2bf15e4..57db84c3e5 100644 --- a/module/search/model.php +++ b/module/search/model.php @@ -240,7 +240,6 @@ class searchModel extends model if(!$sql) $sql = ' 1 = 1 '; $query = fixer::input('post') - ->specialChars('title') ->add('account', $this->app->user->account) ->add('form', serialize($this->session->$formVar)) ->add('sql', $sql) diff --git a/module/story/model.php b/module/story/model.php index cdb06c122b..54ff6699f8 100644 --- a/module/story/model.php +++ b/module/story/model.php @@ -122,7 +122,6 @@ class storyModel extends model $story = fixer::input('post') ->cleanInt('product,module,pri,plan') ->cleanFloat('estimate') - ->stripTags('title') ->callFunc('title', 'trim') ->setDefault('plan', 0) ->add('openedBy', $this->app->user->account) @@ -135,8 +134,9 @@ class storyModel extends model ->setIF($this->post->plan > 0, 'stage', 'planned') ->setIF($projectID > 0, 'stage', 'projected') ->setIF($bugID > 0, 'fromBug', $bugID) - ->remove('files,labels,spec,verify,needNotReview,newStory') ->join('mailto', ',') + ->skipSpecial($this->config->story->editor->create['id']) + ->remove('files,labels,spec,verify,needNotReview,newStory') ->get(); $this->dao->insert(TABLE_STORY)->data($story)->autoCheck()->batchCheck($this->config->story->create->requiredFields, 'notempty')->exec(); @@ -219,7 +219,7 @@ class storyModel extends model $data[$i] = new stdclass(); $data[$i]->module = $stories->module[$i] != 'same' ? $stories->module[$i] : ($i == 0 ? 0 : $data[$i-1]->module); $data[$i]->plan = $stories->plan[$i] == 'same' ? ($i != 0 ? $data[$i-1]->plan : 0) : ($stories->plan[$i] != '' ? $stories->plan[$i] : 0); - $data[$i]->title = htmlspecialchars($stories->title[$i]); + $data[$i]->title = $stories->title[$i]; $data[$i]->pri = $stories->pri[$i] != '' ? $stories->pri[$i] : 0; $data[$i]->estimate = $stories->estimate[$i] != '' ? $stories->estimate[$i] : 0; $data[$i]->status = $stories->needReview[$i] == 0 ? 'active' : 'draft'; @@ -245,8 +245,8 @@ class storyModel extends model $specData[$i] = new stdclass(); $specData[$i]->story = $storyID; $specData[$i]->version = 1; - $specData[$i]->title = htmlspecialchars($stories->title[$i]); - if($stories->spec[$i] != '') $specData[$i]->spec = nl2br(htmlspecialchars($stories->spec[$i])); + $specData[$i]->title = $stories->title[$i]; + if($stories->spec[$i] != '') $specData[$i]->spec = nl2br($stories->spec[$i]); $this->dao->insert(TABLE_STORYSPEC)->data($specData[$i])->exec(); $this->loadModel('action'); @@ -288,7 +288,6 @@ class storyModel extends model $now = helper::now(); $story = fixer::input('post') - ->stripTags('title') ->callFunc('title', 'trim') ->add('lastEditedBy', $this->app->user->account) ->add('lastEditedDate', $now) @@ -301,6 +300,7 @@ class storyModel extends model ->setIF($specChanged, 'closedReason', '') ->setIF($specChanged and $oldStory->reviewedBy, 'reviewedDate', '0000-00-00') ->setIF($specChanged and $oldStory->closedBy, 'closedDate', '0000-00-00') + ->skipSpecial($this->config->story->editor->change['id']) ->remove('files,labels,spec,verify,comment,needNotReview') ->get(); $this->dao->update(TABLE_STORY) @@ -344,7 +344,6 @@ class storyModel extends model $story = fixer::input('post') ->cleanInt('product,module,pri,plan') - ->stripTags('title') ->add('assignedDate', $oldStory->assignedDate) ->add('lastEditedBy', $this->app->user->account) ->add('lastEditedDate', $now) @@ -355,9 +354,9 @@ class storyModel extends model ->setIF($this->post->closedReason != false and $oldStory->closedDate == '', 'closedDate', $now) ->setIF($this->post->closedBy != false or $this->post->closedReason != false, 'status', 'closed') ->setIF($this->post->closedReason != false and $this->post->closedBy == false, 'closedBy', $this->app->user->account) - ->remove('files,labels,comment') ->join('reviewedBy', ',') ->join('mailto', ',') + ->remove('files,labels,comment') ->get(); $this->dao->update(TABLE_STORY) @@ -385,6 +384,7 @@ class storyModel extends model $stories = array(); $allChanges = array(); $now = helper::now(); + $data = fixer::input('post')->get(); $storyIDList = $this->post->storyIDList ? $this->post->storyIDList : array(); /* Adjust whether the post data is complete, if not, remove the last element of $taskIDList. */ @@ -402,17 +402,17 @@ class storyModel extends model $story->lastEditedBy = $this->app->user->account; $story->lastEditedDate = $now; $story->status = $oldStory->status; - $story->title = htmlspecialchars($this->post->titles[$storyID]); - $story->estimate = $this->post->estimates[$storyID]; - $story->pri = $this->post->pris[$storyID]; - $story->module = $this->post->modules[$storyID]; - $story->plan = $this->post->plans[$storyID]; - $story->source = $this->post->sources[$storyID]; - $story->stage = isset($this->post->stages[$storyID]) ? $this->post->stages[$storyID] : $oldStory->stage; - $story->closedBy = isset($this->post->closedBys[$storyID]) ? $this->post->closedBys[$storyID] : $oldStory->closedBy; - $story->closedReason = isset($this->post->closedReasons[$storyID]) ? $this->post->closedReasons[$storyID] : $oldStory->closedReason; - $story->duplicateStory = isset($this->post->duplicateStories[$storyID]) ? $this->post->duplicateStories[$storyID] : $oldStory->duplicateStory; - $story->childStories = isset($this->post->childStoriesIDList[$storyID]) ? $this->post->childStoriesIDList[$storyID] : $oldStory->childStories; + $story->title = $data->titles[$storyID]; + $story->estimate = $data->estimates[$storyID]; + $story->pri = $data->pris[$storyID]; + $story->module = $data->modules[$storyID]; + $story->plan = $data->plans[$storyID]; + $story->source = $data->sources[$storyID]; + $story->stage = isset($data->stages[$storyID]) ? $data->stages[$storyID] : $oldStory->stage; + $story->closedBy = isset($data->closedBys[$storyID]) ? $data->closedBys[$storyID] : $oldStory->closedBy; + $story->closedReason = isset($data->closedReasons[$storyID]) ? $data->closedReasons[$storyID] : $oldStory->closedReason; + $story->duplicateStory = isset($data->duplicateStories[$storyID]) ? $data->duplicateStories[$storyID] : $oldStory->duplicateStory; + $story->childStories = isset($data->childStoriesIDList[$storyID]) ? $data->childStoriesIDList[$storyID] : $oldStory->childStories; $story->version = $story->title == $oldStory->title ? $oldStory->version : $oldStory->version + 1; if($story->title != $oldStory->title) $story->status = 'changed'; diff --git a/module/task/model.php b/module/task/model.php index 6b6b799c91..92fa14e6b9 100644 --- a/module/task/model.php +++ b/module/task/model.php @@ -28,7 +28,6 @@ class taskModel extends model { if($this->post->type == 'affair' and empty($assignedTo)) continue; $task = fixer::input('post') - ->striptags('name') ->add('project', (int)$projectID) ->setDefault('estimate, left, story', 0) ->setDefault('estStarted', '0000-00-00') @@ -39,6 +38,7 @@ class taskModel extends model ->setIF($this->post->story != false, 'storyVersion', $this->loadModel('story')->getVersion($this->post->story)) ->setDefault('openedBy', $this->app->user->account) ->setDefault('openedDate', helper::now()) + ->skipSpecial($this->config->task->editor->create['id']) ->remove('after,files,labels') ->join('mailto', ',') ->get(); @@ -110,8 +110,8 @@ class taskModel extends model $data[$i]->type = $tasks->type[$i] == 'ditto' ? (isset($data[$i-1]) ? $data[$i-1]->type : 0) : $tasks->type[$i]; $data[$i]->module = $tasks->module[$i] == 'ditto' ? (isset($data[$i-1]) ? $data[$i-1]->module : 0) : $tasks->module[$i]; $data[$i]->assignedTo = $tasks->assignedTo[$i] == 'ditto' ? (isset($data[$i-1]) ? $data[$i-1]->assignedTo : 0) : $tasks->assignedTo[$i]; - $data[$i]->name = htmlspecialchars($tasks->name[$i]); - $data[$i]->desc = nl2br(htmlspecialchars($tasks->desc[$i])); + $data[$i]->name = $tasks->name[$i]; + $data[$i]->desc = nl2br($tasks->desc[$i]); $data[$i]->pri = $tasks->pri[$i]; $data[$i]->estimate = $tasks->estimate[$i]; $data[$i]->left = $tasks->estimate[$i]; @@ -155,7 +155,6 @@ class taskModel extends model $oldTask = $this->getById($taskID); $now = helper::now(); $task = fixer::input('post') - ->striptags('name') ->setDefault('story, estimate, left, consumed', 0) ->setDefault('deadline', '0000-00-00') ->setIF($this->post->story != false and $this->post->story != $oldTask->story, 'storyVersion', $this->loadModel('story')->getVersion($this->post->story)) @@ -180,6 +179,7 @@ class taskModel extends model ->add('lastEditedBy', $this->app->user->account) ->add('lastEditedDate', $now) ->remove('comment,files,labels') + ->skipSpecial($this->config->task->editor->edit['id']) ->join('mailto', ',') ->get(); @@ -236,6 +236,7 @@ class taskModel extends model $allChanges = array(); $now = helper::now(); $today = date(DT_DATE1); + $data = fixer::input('post')->get(); $taskIDList = $this->post->taskIDList; /* Adjust whether the post data is complete, if not, remove the last element of $taskIDList. */ @@ -247,37 +248,37 @@ class taskModel extends model $oldTask = $this->getById($taskID); $task = new stdclass(); - $task->name = htmlspecialchars($this->post->names[$taskID]); - $task->module = isset($this->post->modules[$taskID]) ? $this->post->modules[$taskID] : 0; - $task->type = $this->post->types[$taskID]; - $task->status = $this->post->statuses[$taskID]; - $task->assignedTo = $task->status == 'closed' ? 'closed' : $this->post->assignedTos[$taskID]; - $task->pri = $this->post->pris[$taskID]; - $task->estimate = $this->post->estimates[$taskID]; - $task->left = $this->post->lefts[$taskID]; - $task->finishedBy = $this->post->finishedBys[$taskID]; - $task->canceledBy = $this->post->canceledBys[$taskID]; - $task->closedBy = $this->post->closedBys[$taskID]; - $task->closedReason = $this->post->closedReasons[$taskID]; + $task->name = $data->names[$taskID]; + $task->module = isset($data->modules[$taskID]) ? $data->modules[$taskID] : 0; + $task->type = $data->types[$taskID]; + $task->status = $data->statuses[$taskID]; + $task->assignedTo = $task->status == 'closed' ? 'closed' : $data->assignedTos[$taskID]; + $task->pri = $data->pris[$taskID]; + $task->estimate = $data->estimates[$taskID]; + $task->left = $data->lefts[$taskID]; + $task->finishedBy = $data->finishedBys[$taskID]; + $task->canceledBy = $data->canceledBys[$taskID]; + $task->closedBy = $data->closedBys[$taskID]; + $task->closedReason = $data->closedReasons[$taskID]; $task->finishedDate = $oldTask->finishedDate; $task->canceledDate = $oldTask->canceledDate; $task->closedDate = $oldTask->closedDate; $task->lastEditedBy = $this->app->user->account; $task->lastEditedDate = $now; $task->consumed = $oldTask->consumed; - if(isset($this->post->assignedTos[$taskID])) + if(isset($data->assignedTos[$taskID])) { - $task->assignedDate = $this->post->assignedTos[$taskID] == $oldTask->assignedTo ? $oldTask->assignedDate : $now; + $task->assignedDate = $data->assignedTos[$taskID] == $oldTask->assignedTo ? $oldTask->assignedDate : $now; } - if($this->post->consumeds[$taskID]) + if($data->consumeds[$taskID]) { $record = new stdclass(); $record->account = $this->app->user->account; $record->task = $taskID; $record->date = $today; $record->left = $task->left; - $record->consumed = $this->post->consumeds[$taskID]; + $record->consumed = $data->consumeds[$taskID]; $this->dao->insert(TABLE_TASKESTIMATE)->data($record)->autoCheck()->exec(); $task->consumed = $oldTask->consumed + $record->consumed; @@ -467,7 +468,7 @@ class taskModel extends model { $consumed += $estimate->consumed; $left = $estimate->left; - $work = htmlspecialchars($estimate->work); + $work = $estimate->work; $this->dao->insert(TABLE_TASKESTIMATE)->data($estimate) ->autoCheck() ->exec(); diff --git a/module/testcase/model.php b/module/testcase/model.php index be3677c929..c20ca8f452 100644 --- a/module/testcase/model.php +++ b/module/testcase/model.php @@ -51,7 +51,6 @@ class testcaseModel extends model ->setIF($this->post->story != false, 'storyVersion', $this->loadModel('story')->getVersion($this->post->story)) ->remove('steps,expects,files,labels') ->setDefault('story', 0) - ->specialChars('title') ->join('stage', ',') ->get(); $this->dao->insert(TABLE_CASE)->data($case)->autoCheck()->batchCheck($this->config->testcase->create->requiredFields, 'notempty')->exec(); @@ -100,7 +99,7 @@ class testcaseModel extends model $data[$i]->module = $cases->module[$i] == 'same' ? ($i == 0 ? 0 : $data[$i-1]->module) : $cases->module[$i]; $data[$i]->type = $cases->type[$i] == 'same' ? ($i == 0 ? '' : $data[$i-1]->type) : $cases->type[$i]; $data[$i]->story = $storyID ? $storyID : ($cases->story[$i] == 'same' ? ($i == 0 ? 0 : $data[$i-1]->story) : $cases->story[$i]); - $data[$i]->title = htmlspecialchars($cases->title[$i]); + $data[$i]->title = $cases->title[$i]; $data[$i]->openedBy = $this->app->user->account; $data[$i]->openedDate = $now; $data[$i]->status = 'normal'; @@ -240,7 +239,6 @@ class testcaseModel extends model ->add('version', $version) ->setIF($this->post->story != false and $this->post->story != $oldCase->story, 'storyVersion', $this->loadModel('story')->getVersion($this->post->story)) ->setDefault('story', 0) - ->specialChars('title') ->join('stage', ',') ->remove('comment,steps,expects,files,labels') ->get(); @@ -286,6 +284,7 @@ class testcaseModel extends model $cases = array(); $allChanges = array(); $now = helper::now(); + $data = fixer::input('post')->get(); $caseIDList = $this->post->caseIDList; /* Adjust whether the post data is complete, if not, remove the last element of $caseIDList. */ @@ -297,12 +296,12 @@ class testcaseModel extends model $case = new stdclass(); $case->lastEditedBy = $this->app->user->account; $case->lastEditedDate = $now; - $case->pri = $this->post->pris[$caseID]; - $case->status = $this->post->statuses[$caseID]; - $case->module = $this->post->modules[$caseID]; - $case->title = htmlspecialchars($this->post->titles[$caseID]); - $case->type = $this->post->types[$caseID]; - $case->stage = empty($this->post->stages[$caseID]) ? '' : implode(',', $this->post->stages[$caseID]); + $case->pri = $data->pris[$caseID]; + $case->status = $data->statuses[$caseID]; + $case->module = $data->modules[$caseID]; + $case->title = $data->titles[$caseID]; + $case->type = $data->types[$caseID]; + $case->stage = empty($data->stages[$caseID]) ? '' : implode(',', $data->stages[$caseID]); $cases[$caseID] = $case; unset($case); @@ -412,7 +411,8 @@ class testcaseModel extends model $this->loadModel('action'); $this->loadModel('story'); $this->loadModel('file'); - $now = helper::now(); + $now = helper::now(); + $data = fixer::input('post')->get(); if(!empty($_POST['id'])) { @@ -427,21 +427,20 @@ class testcaseModel extends model } $cases = array(); - foreach($this->post->product as $key => $product) + foreach($data->product as $key => $product) { $caseData = new stdclass(); $caseData->product = $product; - $caseData->module = $this->post->module[$key]; - $caseData->story = (int)$this->post->story[$key]; - $caseData->title = $this->post->title[$key]; - $caseData->pri = (int)$this->post->pri[$key]; - $caseData->type = $this->post->type[$key]; - $caseData->status = $this->post->status[$key]; - $caseData->stage = join(',', $this->post->stage[$key]); - $caseData->frequency = $this->post->frequency[$key]; - $caseData->linkCase = $this->post->linkCase[$key]; - $caseData->precondition = $this->post->precondition[$key]; + $caseData->module = $data->module[$key]; + $caseData->story = (int)$data->story[$key]; + $caseData->title = $data->title[$key]; + $caseData->pri = (int)$data->pri[$key]; + $caseData->type = $data->type[$key]; + $caseData->status = $data->status[$key]; + $caseData->stage = join(',', $data->stage[$key]); + $caseData->frequency = $data->frequency[$key]; + $caseData->precondition = $data->precondition[$key]; if(isset($this->config->testcase->create->requiredFields)) { @@ -460,7 +459,7 @@ class testcaseModel extends model { if(!empty($_POST['id'][$key])) { - $caseID = $this->post->id[$key]; + $caseID = $data->id[$key]; $stepChanged = false; $steps = array(); $oldStep = isset($oldSteps[$caseID]) ? $oldSteps[$caseID] : array(); diff --git a/module/testcase/view/showimport.html.php b/module/testcase/view/showimport.html.php index 88ff59e7f9..ebf079237c 100644 --- a/module/testcase/view/showimport.html.php +++ b/module/testcase/view/showimport.html.php @@ -51,7 +51,7 @@ testcase->typeList, $case->type, "class='form-control'")?> testcase->statusList, isset($case->status) ? $case->status : '', "class='form-control'")?> frequency) ? $case->frequency : 1, "class='form-control'")?> - testcase->stageList, isset($case->stage) ? $case->stage : '', "multiple='multiple' class='form-control chosen'")?> + testcase->stageList, isset($case->stage) ? $case->stage : '', "multiple='multiple' class='form-control chosen'")?> precondition) ? $case->precondition : "", "class='form-control'")?> diff --git a/module/testtask/model.php b/module/testtask/model.php index dc85ba67ad..894efb6d1e 100644 --- a/module/testtask/model.php +++ b/module/testtask/model.php @@ -41,9 +41,7 @@ class testtaskModel extends model */ function create() { - $task = fixer::input('post') - ->stripTags('name') - ->get(); + $task = fixer::input('post')->skipSpecial($this->config->testtask->editor->create['id'])->get(); $this->dao->insert(TABLE_TESTTASK)->data($task) ->autoCheck($skipFields = 'begin,end') ->batchcheck($this->config->testtask->create->requiredFields, 'notempty') @@ -152,7 +150,7 @@ class testtaskModel extends model public function update($taskID) { $oldTask = $this->getById($taskID); - $task = fixer::input('post')->stripTags('name')->get(); + $task = fixer::input('post')->skipSpecial($this->config->testtask->editor->edit['id'])->get(); $this->dao->update(TABLE_TESTTASK)->data($task) ->autoCheck() ->batchcheck($this->config->testtask->edit->requiredFields, 'notempty') @@ -195,6 +193,7 @@ class testtaskModel extends model $oldTesttask = $this->getById($taskID); $testtask = fixer::input('post') ->setDefault('status', 'done') + ->skipSpecial($this->config->testtask->editor->close['id']) ->remove('comment')->get(); $this->dao->update(TABLE_TESTTASK)->data($testtask) diff --git a/module/todo/model.php b/module/todo/model.php index 31e8b3b4ef..8b36c3e234 100644 --- a/module/todo/model.php +++ b/module/todo/model.php @@ -26,13 +26,13 @@ class todoModel extends model $todo = fixer::input('post') ->add('account', $this->app->user->account) ->add('idvalue', 0) - ->specialChars('type,name') ->cleanInt('date, pri, begin, end, private') ->setIF($this->post->type == 'bug' and $this->post->bug, 'idvalue', $this->post->bug) ->setIF($this->post->type == 'task' and $this->post->task, 'idvalue', $this->post->task) ->setIF($this->post->date == false, 'date', '2030-01-01') ->setIF($this->post->begin == false, 'begin', '2400') ->setIF($this->post->end == false, 'end', '2400') + ->skipSpecial($this->config->todo->editor->create['id']) ->remove('bug, task') ->get(); $this->dao->insert(TABLE_TODO)->data($todo) @@ -69,8 +69,8 @@ class todoModel extends model } $todo->type = $todos->types[$i]; $todo->pri = $todos->pris[$i]; - $todo->name = isset($todos->names[$i]) ? htmlspecialchars($todos->names[$i]) : ''; - $todo->desc = htmlspecialchars($todos->descs[$i]); + $todo->name = isset($todos->names[$i]) ? $todos->names[$i] : ''; + $todo->desc = $todos->descs[$i]; $todo->begin = isset($todos->begins[$i]) ? $todos->begins[$i] : 2400; $todo->end = isset($todos->ends[$i]) ? $todos->ends[$i] : 2400; $todo->status = "wait"; @@ -112,12 +112,12 @@ class todoModel extends model if($oldTodo->type != 'custom') $oldTodo->name = ''; $todo = fixer::input('post') ->cleanInt('date, pri, begin, end, private') - ->specialChars('type,name') ->setIF($this->post->type != 'custom', 'name', '') ->setIF($this->post->date == false, 'date', '2030-01-01') ->setIF($this->post->begin == false, 'begin', '2400') ->setIF($this->post->end == false, 'end', '2400') ->setDefault('private', 0) + ->skipSpecial($this->config->todo->editor->edit['id']) ->get(); $this->dao->update(TABLE_TODO)->data($todo) ->autoCheck() @@ -136,6 +136,7 @@ class todoModel extends model { $todos = array(); $allChanges = array(); + $data = fixer::input('post')->get(); $todoIDList = $this->post->todoIDList ? $this->post->todoIDList : array(); /* Adjust whether the post data is complete, if not, remove the last element of $todoIDList. */ @@ -147,15 +148,15 @@ class todoModel extends model foreach($todoIDList as $todoID) { $todo = new stdclass(); - $todo->date = $this->post->dates[$todoID]; - $todo->type = $this->post->types[$todoID]; - $todo->pri = $this->post->pris[$todoID]; - $todo->status = $this->post->status[$todoID]; - $todo->name = $todo->type == 'custom' ? htmlspecialchars($this->post->names[$todoID]) : ''; - $todo->begin = $this->post->begins[$todoID]; - $todo->end = $this->post->ends[$todoID]; - if($todo->type == 'task') $todo->idvalue = isset($this->post->tasks[$todoID]) ? $this->post->tasks[$todoID] : 0; - if($todo->type == 'bug') $todo->idvalue = isset($this->post->bugs[$todoID]) ? $this->post->bugs[$todoID] : 0; + $todo->date = $data->dates[$todoID]; + $todo->type = $data->types[$todoID]; + $todo->pri = $data->pris[$todoID]; + $todo->status = $data->status[$todoID]; + $todo->name = $todo->type == 'custom' ? $data->names[$todoID] : ''; + $todo->begin = $data->begins[$todoID]; + $todo->end = $data->ends[$todoID]; + if($todo->type == 'task') $todo->idvalue = isset($data->tasks[$todoID]) ? $data->tasks[$todoID] : 0; + if($todo->type == 'bug') $todo->idvalue = isset($data->bugs[$todoID]) ? $data->bugs[$todoID] : 0; $todos[$todoID] = $todo; } diff --git a/module/tree/model.php b/module/tree/model.php index bc6e1c340b..60909d5ec0 100644 --- a/module/tree/model.php +++ b/module/tree/model.php @@ -967,7 +967,7 @@ class treeModel extends model */ public function update($moduleID) { - $module = fixer::input('post')->specialChars('name')->get(); + $module = fixer::input('post')->get(); $self = $this->getById($moduleID); $parent = $this->getById($this->post->parent); $childs = $this->getAllChildId($moduleID); diff --git a/module/user/model.php b/module/user/model.php index bff4df027d..39777b4b70 100644 --- a/module/user/model.php +++ b/module/user/model.php @@ -307,7 +307,6 @@ class userModel extends model ->setDefault('join', '0000-00-00') ->setIF($this->post->password1 != false, 'password', md5($this->post->password1)) ->remove('password1, password2, groups') - ->specialChars('skype,qq,yahoo,gtalk,wangwang,mobile,phone,address,zipcode') ->get(); $this->dao->update(TABLE_USER)->data($user)