Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

* fix a bug #652.

Browse Source
This commit is contained in:
wangyidong
2014-11-27 06:46:49 +00:00
parent dca4f88056
commit d1aed6cc98
13 changed files with 38 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/config.php
+1
View File
@@ -32,6 +32,7 @@ $config->moduleVar = 'm'; // requestType=GET: the module var nam
$config->methodVar = 'f'; // requestType=GET: the method var name.
$config->viewVar = 't'; // requestType=GET: the view var name.
$config->sessionVar = 'sid'; // requestType=GET: the session var name.
$config->allowedTags = '<p><span><h1><h2><h3><h4><h5><em><u><strong><br><ol><ul><li><img><a><b><font><hr><pre><div><table><td><th><tr><tbody><embed><style>';
/* Supported views. */
$config->views = ',html,json,mhtml,';
lib/filter/filter.class.php
+12 -6
View File
@@ -504,17 +504,23 @@ class fixer
}
/**
* Strip tags
*
* @param string $fieldName
* @param string $allowableTags
* Strip tags
*
* @param string $fieldName
* @param string $allowedTags
* @access public
* @return object fixer object
*/
public function stripTags($fieldName)
public function stripTags($fieldName, $allowedTags)
{
$fields = $this->processFields($fieldName);
foreach($fields as $fieldName) $this->data->$fieldName = filter_var($this->data->$fieldName, FILTER_SANITIZE_STRING);
foreach($fields as $fieldName)
{
if(version_compare(phpversion(), '5.4', '<') and get_magic_quotes_gpc()) $this->data->$fieldName = stripslashes($this->data->$fieldName);
if(!in_array($fieldName, $this->stripedFields)) $this->data->$fieldName = strip_tags($this->data->$fieldName, $allowedTags);
$this->stripedFields[] = $fieldName;
}
return $this;
}
module/bug/model.php
+3 -3
View File
@@ -48,7 +48,7 @@ class bugModel extends model
->setDefault('openedBuild', '')
->setIF($this->post->assignedTo != '', 'assignedDate', $now)
->setIF($this->post->story != false, 'storyVersion', $this->loadModel('story')->getVersion($this->post->story))
->skipSpecial($this->config->bug->editor->create['id'])
->stripTags($this->config->bug->editor->create['id'], $this->config->allowedTags)
->cleanInt('product, module, severity')
->join('openedBuild', ',')
->join('mailto', ',')
@@ -353,7 +353,7 @@ class bugModel extends model
$now = helper::now();
$bug = fixer::input('post')
->cleanInt('product,module,severity,project,story,task')
->skipSpecial($this->config->bug->editor->edit['id'])
->stripTags($this->config->bug->editor->edit['id'], $this->config->allowedTags)
->setDefault('project,module,project,story,task,duplicateBug', 0)
->setDefault('openedBuild', '')
->setDefault('plan', 0)
@@ -1218,7 +1218,7 @@ class bugModel extends model
$template = fixer::input('post')
->add('account', $this->app->user->account)
->add('type', 'bug')
->skipSpecial('content')
->stripTags('content', $this->config->allowedTags)
->get();
$this->dao->insert(TABLE_USERTPL)->data($template)->autoCheck('title, content', 'notempty')->check('title', 'unique')->exec();
}
module/build/model.php
+2 -2
View File
@@ -157,7 +157,7 @@ class buildModel extends model
->join('stories', ',')
->join('bugs', ',')
->add('project', (int)$projectID)
->skipSpecial($this->config->build->editor->create['id'])
->stripTags($this->config->build->editor->create['id'], $this->config->allowedTags)
->remove('resolvedBy,allchecker,files,labels')
->get();
@@ -186,7 +186,7 @@ class buildModel extends model
->setDefault('bugs', '')
->join('stories', ',')
->join('bugs', ',')
->skipSpecial($this->config->build->editor->edit['id'])
->stripTags($this->config->build->editor->edit['id'], $this->config->allowedTags)
->remove('allchecker,resolvedBy,files,labels')
->get();
module/doc/model.php
+2 -2
View File
@@ -183,7 +183,7 @@ class docModel extends model
->add('addedBy', $this->app->user->account)
->add('addedDate', $now)
->setDefault('product, project, module', 0)
->skipSpecial($this->config->doc->editor->create['id'])
->stripTags($this->config->doc->editor->create['id'], $this->config->allowedTags)
->encodeURL('url')
->cleanInt('product, project, module')
->remove('files, labels')
@@ -225,7 +225,7 @@ class docModel extends model
->setIF($this->post->lib == 'product', 'project', 0)
->setIF(($this->post->lib != 'product' and $this->post->lib != 'project'), 'project', 0)
->setIF(($this->post->lib != 'product' and $this->post->lib != 'project'), 'product', 0)
->skipSpecial($this->config->doc->editor->edit['id'])
->stripTags($this->config->doc->editor->edit['id'], $this->config->allowedTags)
->encodeURL('url')
->add('editedBy', $this->app->user->account)
->add('editedDate', $now)
module/product/model.php
+2 -2
View File
@@ -213,7 +213,7 @@ class productModel extends model
->setDefault('createdDate', helper::now())
->setDefault('createdVersion', $this->config->version)
->join('whitelist', ',')
->skipSpecial($this->config->product->editor->create['id'])
->stripTags($this->config->product->editor->create['id'], $this->config->allowedTags)
->get();
$this->dao->insert(TABLE_PRODUCT)
->data($product)
@@ -239,7 +239,7 @@ class productModel extends model
$product = fixer::input('post')
->setIF($this->post->acl != 'custom', 'whitelist', '')
->join('whitelist', ',')
->skipSpecial($this->config->product->editor->edit['id'])
->stripTags($this->config->product->editor->edit['id'], $this->config->allowedTags)
->get();
$this->dao->update(TABLE_PRODUCT)
->data($product)
module/productplan/model.php
+2 -2
View File
@@ -105,7 +105,7 @@ class productplanModel extends model
*/
public function create()
{
$plan = fixer::input('post')->skipSpecial($this->config->productplan->editor->create['id'])->remove('delta')->get();
$plan = fixer::input('post')->stripTags($this->config->productplan->editor->create['id'], $this->config->allowedTags)->remove('delta')->get();
$this->dao->insert(TABLE_PRODUCTPLAN)
->data($plan)
->autoCheck()
@@ -125,7 +125,7 @@ class productplanModel extends model
public function update($planID)
{
$oldPlan = $this->getById($planID);
$plan = fixer::input('post')->skipSpecial($this->config->productplan->editor->edit['id'])->get();
$plan = fixer::input('post')->stripTags($this->config->productplan->editor->edit['id'], $this->config->allowedTags)->get();
$this->dao->update(TABLE_PRODUCTPLAN)
->data($plan)
->autoCheck()
module/project/model.php
+2 -2
View File
@@ -215,7 +215,7 @@ class projectModel extends model
->setDefault('openedVersion', $this->config->version)
->setDefault('team', $this->post->name)
->join('whitelist', ',')
->skipSpecial($this->config->project->editor->create['id'])
->stripTags($this->config->project->editor->create['id'], $this->config->allowedTags)
->remove('products, workDays, delta')
->get();
$this->dao->insert(TABLE_PROJECT)->data($project)
@@ -285,7 +285,7 @@ class projectModel extends model
->setIF($this->post->acl != 'custom', 'whitelist', '')
->setDefault('team', $this->post->name)
->join('whitelist', ',')
->skipSpecial($this->config->project->editor->create['id'])
->stripTags($this->config->project->editor->create['id'], $this->config->allowedTags)
->remove('products')
->get();
$this->dao->update(TABLE_PROJECT)->data($project)
module/release/model.php
+3 -3
View File
@@ -102,7 +102,7 @@ class releaseModel extends model
$build = fixer::input('post')
->add('product', (int)$productID)
->add('builder', $this->app->user->account)
->skipSpecial($this->config->release->editor->create['id'])
->stripTags($this->config->release->editor->create['id'], $this->config->allowedTags)
->remove('build,files,labels')
->get();
$this->dao->insert(TABLE_BUILD)->data($build)->autoCheck()->check('name','unique')->exec();
@@ -115,7 +115,7 @@ class releaseModel extends model
->join('stories', ',')
->join('bugs', ',')
->setIF($this->post->build == false, 'build', $buildID)
->skipSpecial($this->config->release->editor->create['id'])
->stripTags($this->config->release->editor->create['id'], $this->config->allowedTags)
->remove('allchecker,files,labels')
->get();
@@ -147,7 +147,7 @@ class releaseModel extends model
->setDefault('bugs', '')
->join('stories', ',')
->join('bugs', ',')
->skipSpecial($this->config->release->editor->edit['id'])
->stripTags($this->config->release->editor->edit['id'], $this->config->allowedTags)
->remove('files,labels,allchecker')
->get();
$this->dao->update(TABLE_RELEASE)->data($release)
module/story/model.php
+2 -2
View File
@@ -133,7 +133,7 @@ class storyModel extends model
->setIF($projectID > 0, 'stage', 'projected')
->setIF($bugID > 0, 'fromBug', $bugID)
->join('mailto', ',')
->skipSpecial($this->config->story->editor->create['id'])
->stripTags($this->config->story->editor->create['id'], $this->config->allowedTags)
->remove('files,labels,spec,verify,needNotReview,newStory')
->get();
@@ -346,7 +346,7 @@ class storyModel extends model
->setIF($specChanged, 'closedReason', '')
->setIF($specChanged and $oldStory->reviewedBy, 'reviewedDate', '0000-00-00')
->setIF($specChanged and $oldStory->closedBy, 'closedDate', '0000-00-00')
->skipSpecial($this->config->story->editor->change['id'])
->stripTags($this->config->story->editor->change['id'], $this->config->allowedTags)
->remove('files,labels,spec,verify,comment,needNotReview')
->get();
$this->dao->update(TABLE_STORY)
module/task/model.php
+2 -2
View File
@@ -38,7 +38,7 @@ class taskModel extends model
->setIF($this->post->story != false, 'storyVersion', $this->loadModel('story')->getVersion($this->post->story))
->setDefault('openedBy', $this->app->user->account)
->setDefault('openedDate', helper::now())
->skipSpecial($this->config->task->editor->create['id'])
->stripTags($this->config->task->editor->create['id'], $this->config->allowedTags)
->remove('after,files,labels')
->join('mailto', ',')
->get();
@@ -211,7 +211,7 @@ class taskModel extends model
->add('lastEditedBy', $this->app->user->account)
->add('lastEditedDate', $now)
->remove('comment,files,labels')
->skipSpecial($this->config->task->editor->edit['id'])
->stripTags($this->config->task->editor->edit['id'], $this->config->allowedTags)
->join('mailto', ',')
->get();
module/testtask/model.php
+3 -3
View File
@@ -41,7 +41,7 @@ class testtaskModel extends model
*/
function create()
{
$task = fixer::input('post')->skipSpecial($this->config->testtask->editor->create['id'])->get();
$task = fixer::input('post')->stripTags($this->config->testtask->editor->create['id'], $this->config->allowedTags)->get();
$this->dao->insert(TABLE_TESTTASK)->data($task)
->autoCheck($skipFields = 'begin,end')
->batchcheck($this->config->testtask->create->requiredFields, 'notempty')
@@ -163,7 +163,7 @@ class testtaskModel extends model
public function update($taskID)
{
$oldTask = $this->getById($taskID);
$task = fixer::input('post')->skipSpecial($this->config->testtask->editor->edit['id'])->get();
$task = fixer::input('post')->stripTags($this->config->testtask->editor->edit['id'], $this->config->allowedTags)->get();
$this->dao->update(TABLE_TESTTASK)->data($task)
->autoCheck()
->batchcheck($this->config->testtask->edit->requiredFields, 'notempty')
@@ -206,7 +206,7 @@ class testtaskModel extends model
$oldTesttask = $this->getById($taskID);
$testtask = fixer::input('post')
->setDefault('status', 'done')
->skipSpecial($this->config->testtask->editor->close['id'])
->stripTags($this->config->testtask->editor->close['id'], $this->config->allowedTags)
->remove('comment')->get();
$this->dao->update(TABLE_TESTTASK)->data($testtask)
module/todo/model.php
+2 -2
View File
@@ -32,7 +32,7 @@ class todoModel extends model
->setIF($this->post->date == false, 'date', '2030-01-01')
->setIF($this->post->begin == false, 'begin', '2400')
->setIF($this->post->end == false, 'end', '2400')
->skipSpecial($this->config->todo->editor->create['id'])
->stripTags($this->config->todo->editor->create['id'], $this->config->allowedTags)
->remove('bug, task')
->get();
$this->dao->insert(TABLE_TODO)->data($todo)
@@ -117,7 +117,7 @@ class todoModel extends model
->setIF($this->post->begin == false, 'begin', '2400')
->setIF($this->post->end == false, 'end', '2400')
->setDefault('private', 0)
->skipSpecial($this->config->todo->editor->edit['id'])
->stripTags($this->config->todo->editor->edit['id'], $this->config->allowedTags)
->get();
$this->dao->update(TABLE_TODO)->data($todo)
->autoCheck()