Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

* finish task #2474 and fix bug.

Browse Source
This commit is contained in:
wangyidong
2016-03-08 11:32:48 +08:00
parent 26d831d0b6
commit df85f2625e
10 changed files with 48 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/config.php
+1
View File
@@ -110,6 +110,7 @@ $config->framework = new stdclass();
$config->framework->jsWithPrefix = false;
$config->framework->autoRepairTable = true;
$config->framework->logDays = 14;
$config->framework->purifier = true;
/* Include the custom config file. */
$configRoot = dirname(__FILE__) . DIRECTORY_SEPARATOR;
framework/helper.class.php
+14 -1
View File
@@ -1204,12 +1204,25 @@ function header301($url)
*/
function processEvil($value)
{
global $config;
if(strpos(htmlspecialchars_decode($value), '<?') !== false)
{
$value = (string) $value;
$evils = array('eval', 'exec', 'passthru', 'proc_open', 'shell_exec', 'system', '$$', 'include', 'require', 'assert');
$gibbedEvils = array('e v a l', 'e x e c', ' p a s s t h r u', ' p r o c _ o p e n', 's h e l l _ e x e c', 's y s t e m', '$ $', 'i n c l u d e', 'r e q u i r e', 'a s s e r t');
return str_ireplace($evils, $gibbedEvils, $value);
$value = str_ireplace($evils, $gibbedEvils, $value);
}
if(isset($config->framework->stripXSS) and $config->framework->stripXSS)
{
if(stripos($value, '<script') !== false)
{
$value = (string) $value;
$evils = array('appendchild(', 'createElement(', 'xss.re', 'onfocus', 'onclick', 'innerHTML', 'replaceChild(', 'html(', 'append(', 'appendTo(', 'prepend(', 'prependTo(', 'after(', 'before(', 'replaceWith(');
$gibbedEvils = array('a p p e n d c h i l d (', 'c r e a t e E l e m e n t (', 'x s s . r e', 'o n f o c u s', 'o n c l i c k', 'i n n e r H T M L', 'r e p l a c e C h i l d (', 'h t m l (', 'a p p e n d (', 'a p p e n d T o (', 'p r e p e n d (', 'p r e p e n d T o (', 'a f t e r (', 'b e f o r e (', 'r e p l a c e W i t h (');
$value = str_ireplace($evils, $gibbedEvils, $value);
}
/* Process like 'javascript:' */
$value = preg_replace('/j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\s*:/Ui', 'j a v a s c r i p t :', $value);
}
return $value;
}
lib/filter/filter.class.php
+25 -11
View File
@@ -696,19 +696,24 @@ class fixer
* @access public
* @return object fixer object
*/
public function stripTags($fieldName, $allowedTags)
public function stripTags($fieldName, $allowedTags = '')
{
global $app;
$app->loadClass('purifier', true);
$config = HTMLPurifier_Config::createDefault();
$config->set('Filter.YouTube', 1);
global $app, $config;
if(empty($allowedTags) and isset($config->allowedTags)) $allowedTags = $config->allowedTags;
$usePurifier = isset($config->framework->purifier) ? $config->framework->purifier : false;
if($usePurifier)
{
$app->loadClass('purifier', true);
$purifierConfig = HTMLPurifier_Config::createDefault();
$purifierConfig->set('Filter.YouTube', 1);
/* Disable caching. */
$config->set('Cache.DefinitionImpl', null);
/* Disable caching. */
$purifierConfig->set('Cache.DefinitionImpl', null);
$purifier = new HTMLPurifier($config);
$def = $config->getHTMLDefinition(true);
$def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top');
$purifier = new HTMLPurifier($purifierConfig);
$def = $purifierConfig->getHTMLDefinition(true);
$def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top');
}
$fields = $this->processFields($fieldName);
foreach($fields as $fieldName)
@@ -717,7 +722,16 @@ class fixer
if(!in_array($fieldName, $this->stripedFields))
{
if(!defined('RUN_MODE') or RUN_MODE != 'admin') $this->data->$fieldName = $purifier->purify($this->data->$fieldName);
if(!defined('RUN_MODE') or RUN_MODE != 'admin')
{
/*
* purifier会把&nbsp;替换空格，kindeditor在会吧行首的空格去掉。
* purifier will change &nbsp; to ' ', and edit it will no space in line head use kindeditor.
**/
if($usePurifier) $this->data->$fieldName = str_replace('&nbsp;', '&spnb;', $this->data->$fieldName);
$this->data->$fieldName = $usePurifier ? $purifier->purify($this->data->$fieldName) : strip_tags($this->data->$fieldName, $allowedTags);
if($usePurifier) $this->data->$fieldName = str_replace('&amp;spnb;', '&nbsp;', $this->data->$fieldName);
}
}
$this->stripedFields[] = $fieldName;
}
lib/front/front.class.php
+1
View File
@@ -317,6 +317,7 @@ class html
{
$id = "id='$name'";
if(strpos($attrib, 'id=') !== false) $id = '';
$value = str_replace("'", '&#039;', $value);
return "<input type='text' name='$name' {$id} value='$value' $attrib />\n";
}
module/product/css/browse.css
+1
View File
@@ -2,3 +2,4 @@
.dropdown-menu > .menu-search {padding: 0; position: absolute; z-index: 0; bottom: 0; left: 0; right: 0}
.dropdown-menu > .menu-search .input-group {width:100%;}
.dropdown-menu > .menu-search .input-group-addon {position: absolute; right: 10px; top: 0; z-index: 10; background: none; border: none; color: #666}
.pl-5px{padding-left:5px;}
module/product/view/browse.html.php
+1 -1
View File
@@ -113,7 +113,7 @@
<?php
echo "<div" . (isset($storyStages[$story->id]) ? " class='popoverStage' data-toggle='popover' data-placement='bottom' data-target='\$next'" : '') . "'>";
echo $lang->story->stageList[$story->stage];
if(isset($storyStages[$story->id])) echo "<span class='pull-right'><i class='icon icon-caret-down'></i></span>";
if(isset($storyStages[$story->id])) echo "<span class='pl-5px'><i class='icon icon-caret-down'></i></span>";
echo '</div>';
if(isset($storyStages[$story->id]))
{
module/task/lang/en.php
+1 -1
View File
@@ -163,7 +163,7 @@ $lang->task->error->consumedThisTime = 'Please input "hours"';
$lang->task->error->left = 'Please input "left"';
$lang->task->error->work = '"Comment" must be less than 255 characters';
$lang->task->error->skipClose = 'The status of Tasks : %s are not finished or canceled, can not close.';
$lang->task->error->consumed = 'The consumed of task %s is less than zero, ignore it.';
$lang->task->error->consumed = 'The estimate of task %s is less than zero, ignore it.';
/* Report. */
$lang->task->report = new stdclass();
module/task/lang/zh-cn.php
+1 -1
View File
@@ -163,7 +163,7 @@ $lang->task->error->consumedThisTime = '请填写"工时"';
$lang->task->error->left = '请填写"剩余"';
$lang->task->error->work = '"备注"必须小于255个字符';
$lang->task->error->skipClose = '任务：%s 不是“已完成”或“已取消”状态，不能关闭！';
$lang->task->error->consumed = '任务：%s总消耗小于0，忽略该任务工时的改动';
$lang->task->error->consumed = '任务：%s工时不能小于0，忽略该任务工时的改动';
/* 统计报表。*/
$lang->task->report = new stdclass();
module/task/model.php
+1 -1
View File
@@ -313,7 +313,7 @@ class taskModel extends model
if($data->consumeds[$taskID])
{
if(($oldTask->consumed + $data->consumeds[$taskID]) < 0)
if($data->consumeds[$taskID] < 0)
{
echo js::alert(sprintf($this->lang->task->error->consumed, $taskID));
}
www/js/my.full.js
+2 -2
View File
@@ -1375,10 +1375,10 @@ function fixedTfootAction(formID)
if($inputgroup.size() > 0)var $inputwidth = $inputgroup.width();
var tfootOffset = $tfoot.offset().top + 30;
var tfootOffset = $tfoot.offset().top + $tfoot.height() + 20;
var windowH = $(window).height();
var tableWidth = $table.width();
if(tfootOffset > windowH + $(window).scrollTop())
if(tfootOffset >= windowH + $(window).scrollTop())
{
$tfoot.addClass('fixedTfootAction');
$tfoot.width(tableWidth);