Peter M. Groen / knowledgetree

Commit 14899303363772f9909edee63e118460965a921b

Authored by Conrad Vermeulen
1 parent 1bf803c8

KTS-2178 

"cross site scripting"
Updated.

Reviewed By: Kevin Fourie

git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@6920 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 1 changed file with 107 additions and 107 deletions
plugins/ktcore/KTColumns.inc.php
  View file @1489930
1 1 <?php
2 2 /**
3 3 * $Id$
4   - *
  4 + *
5 5 * The contents of this file are subject to the KnowledgeTree Public
6 6 * License Version 1.1.2 ("License"); You may not use this file except in
7 7 * compliance with the License. You may obtain a copy of the License at
8 8 * http://www.knowledgetree.com/KPL
9   - *
  9 + *
10 10 * Software distributed under the License is distributed on an "AS IS"
11 11 * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied.
12 12 * See the License for the specific language governing rights and
... ... @@ -17,9 +17,9 @@
17 17 * (ii) the KnowledgeTree copyright notice
18 18 * in the same form as they appear in the distribution. See the License for
19 19 * requirements.
20   - *
  20 + *
21 21 * The Original Code is: KnowledgeTree Open Source
22   - *
  22 + *
23 23 * The Initial Developer of the Original Code is The Jam Warehouse Software
24 24 * (Pty) Ltd, trading as KnowledgeTree.
25 25 * Portions created by The Jam Warehouse Software (Pty) Ltd are Copyright
... ... @@ -41,40 +41,40 @@ class AdvancedTitleColumn extends AdvancedColumn {
41 41 var $link_folders = true;
42 42 var $link_documents = true;
43 43  
44   - function setOptions($aOptions) {
  44 + function setOptions($aOptions) {
45 45 $this->link_folders = KTUtil::arrayGet($aOptions, 'link_folders', $this->link_folders, false);
46   - $this->link_documents = KTUtil::arrayGet($aOptions, 'link_documents', $this->link_documents, false);
  46 + $this->link_documents = KTUtil::arrayGet($aOptions, 'link_documents', $this->link_documents, false);
47 47 parent::setOptions($aOptions);
48 48 }
49   -
  49 +
50 50 function AdvancedTitleColumn() {
51 51 $this->label = _kt("Title");
52   - }
53   -
54   - // what is used for sorting
  52 + }
  53 +
  54 + // what is used for sorting
55 55 // query addition is:
56 56 // [0] => join claus
57 57 // [1] => join params
58   - // [2] => ORDER
59   -
60   - function addToFolderQuery() {
61   - return array(null,
62   - null,
  58 + // [2] => ORDER
  59 +
  60 + function addToFolderQuery() {
  61 + return array(null,
  62 + null,
63 63 "F.name",
64   - );
  64 + );
65 65 }
66   - function addToDocumentQuery() {
67   - return array(null,
68   - null,
  66 + function addToDocumentQuery() {
  67 + return array(null,
  68 + null,
69 69 "DM.name"
70   - );
  70 + );
71 71 }
72 72  
73   -
  73 +
74 74 function renderFolderLink($aDataRow) {
75 75 /* this check has to be done so that any titles longer than 40 characters is not displayed incorrectly.
76 76 as mozilla cannot wrap text without white spaces */
77   - if (mb_strlen($aDataRow["folder"]->getName(), 'UTF-8') > 40) {
  77 + if (mb_strlen($aDataRow["folder"]->getName(), 'UTF-8') > 40) {
78 78 mb_internal_encoding("UTF-8");
79 79 $outStr = htmlentities(mb_substr($aDataRow["folder"]->getName(), 0, 40, 'UTF-8')."...", ENT_NOQUOTES, 'UTF-8');
80 80 }else{
... ... @@ -90,15 +90,15 @@ class AdvancedTitleColumn extends AdvancedColumn {
90 90 function renderDocumentLink($aDataRow) {
91 91 /* this check has to be done so that any titles longer than 40 characters is not displayed incorrectly.
92 92 as mozilla cannot wrap text without white spaces */
93   - if (mb_strlen($aDataRow["document"]->getName(), 'UTF-8') > 40) {
  93 + if (mb_strlen($aDataRow["document"]->getName(), 'UTF-8') > 40) {
94 94 mb_internal_encoding("UTF-8");
95 95 $outStr = htmlentities(mb_substr($aDataRow["document"]->getName(), 0, 40, 'UTF-8')."...", ENT_NOQUOTES, 'UTF-8');
96 96 }else{
97 97 $outStr = htmlentities($aDataRow["document"]->getName(), ENT_NOQUOTES, 'UTF-8');
98 98 }
99   -
  99 +
100 100 if($this->link_documents) {
101   - $outStr = '<a href="' . $this->buildDocumentLink($aDataRow) . '" title="' . $aDataRow["document"]->getFilename().'">' .
  101 + $outStr = '<a href="' . $this->buildDocumentLink($aDataRow) . '" title="' . htmlentities($aDataRow["document"]->getFilename(), ENT_QUOTES, 'UTF-8').'">' .
102 102 $outStr . '</a>';
103 103 }
104 104 return $outStr;
... ... @@ -116,7 +116,7 @@ class AdvancedTitleColumn extends AdvancedColumn {
116 116 function buildFolderLink($aDataRow) {
117 117 if (is_null(KTUtil::arrayGet($this->aOptions, 'direct_folder'))) {
118 118 $dest = KTUtil::arrayGet($this->aOptions, 'folder_link');
119   - $params = kt_array_merge(KTUtil::arrayGet($this->aOptions, 'qs_params', array()),
  119 + $params = kt_array_merge(KTUtil::arrayGet($this->aOptions, 'qs_params', array()),
120 120 array('fFolderId' => $aDataRow['folder']->getId()));
121 121  
122 122 if (empty($dest)) {
... ... @@ -129,9 +129,9 @@ class AdvancedTitleColumn extends AdvancedColumn {
129 129 return KTBrowseUtil::getUrlForFolder($aDataRow['folder']);
130 130 }
131 131 }
132   -
  132 +
133 133 // use inline, since its just too heavy to even _think_ about using smarty.
134   - function renderData($aDataRow) {
  134 + function renderData($aDataRow) {
135 135 if ($aDataRow["type"] == "folder") {
136 136 $contenttype = 'folder';
137 137 $link = $this->renderFolderLink($aDataRow);
... ... @@ -143,11 +143,11 @@ class AdvancedTitleColumn extends AdvancedColumn {
143 143 return sprintf('<span class="contenttype %s">%s (%s)</span>', $contenttype, $link, $size);
144 144 }
145 145 }
146   -
  146 +
147 147 function prettySize($size) {
148 148 $finalSize = $size;
149 149 $label = 'b';
150   -
  150 +
151 151 if ($finalSize > 1000) { $label='Kb'; $finalSize = floor($finalSize/1000); }
152 152 if ($finalSize > 1000) { $label='Mb'; $finalSize = floor($finalSize/1000); }
153 153 return $finalSize . $label;
... ... @@ -159,7 +159,7 @@ class AdvancedTitleColumn extends AdvancedColumn {
159 159 }
160 160 }
161 161  
162   -/*
  162 +/*
163 163 * Column to handle dates
164 164 */
165 165  
... ... @@ -168,17 +168,17 @@ class AdvancedDateColumn extends AdvancedColumn {
168 168  
169 169 var $document_field_function;
170 170 var $folder_field_function;
171   - var $sortable = true;
  171 + var $sortable = true;
172 172 var $document_sort_column;
173 173 var $folder_sort_column;
174 174 var $namespace = 'ktcore.columns.genericdate';
175   -
  175 +
176 176 function AdvancedDateColumn() {
177 177 $this->label = _kt('Generic Date Function');
178 178 }
179 179  
180 180 // use inline, since its just too heavy to even _think_ about using smarty.
181   - function renderData($aDataRow) {
  181 + function renderData($aDataRow) {
182 182 $outStr = '';
183 183 if (($aDataRow["type"] == "folder") && (!is_null($this->folder_field_function))) {
184 184 $res = call_user_func(array($aDataRow["folder"], $this->folder_field_function));
... ... @@ -186,7 +186,7 @@ class AdvancedDateColumn extends AdvancedColumn {
186 186  
187 187 // now reformat this into something "pretty"
188 188 return date("Y-m-d H:i", $dColumnDate);
189   -
  189 +
190 190 } else if (($aDataRow["type"] == "document") && (!is_null($this->document_field_function))) {
191 191 $res = call_user_func(array($aDataRow["document"], $this->document_field_function));
192 192 $dColumnDate = strtotime($res);
... ... @@ -210,11 +210,11 @@ class AdvancedDateColumn extends AdvancedColumn {
210 210 class CreationDateColumn extends AdvancedDateColumn {
211 211 var $document_field_function = 'getCreatedDateTime';
212 212 var $folder_field_function = null;
213   -
  213 +
214 214 var $document_sort_column = "D.created";
215 215 var $folder_sort_column = null;
216 216 var $namespace = 'ktcore.columns.creationdate';
217   -
  217 +
218 218 function CreationDateColumn() {
219 219 $this->label = _kt('Created');
220 220 }
... ... @@ -223,11 +223,11 @@ class CreationDateColumn extends AdvancedDateColumn {
223 223 class ModificationDateColumn extends AdvancedDateColumn {
224 224 var $document_field_function = 'getLastModifiedDate';
225 225 var $folder_field_function = null;
226   -
  226 +
227 227 var $document_sort_column = "D.modified";
228 228 var $folder_sort_column = null;
229 229 var $namespace = 'ktcore.columns.modificationdate';
230   -
  230 +
231 231 function ModificationDateColumn() {
232 232 $this->label = _kt('Modified');
233 233 }
... ... @@ -236,25 +236,25 @@ class ModificationDateColumn extends AdvancedDateColumn {
236 236 class AdvancedUserColumn extends AdvancedColumn {
237 237 var $document_field_function;
238 238 var $folder_field_function;
239   - var $sortable = false; // by default
  239 + var $sortable = false; // by default
240 240 var $document_sort_column;
241 241 var $folder_sort_column;
242 242 var $namespace = 'ktcore.columns.genericuser';
243   -
  243 +
244 244 function AdvancedUserColumn() {
245   - $this->label = null; // abstract.
  245 + $this->label = null; // abstract.
246 246 }
247   -
  247 +
248 248 // use inline, since its just too heavy to even _think_ about using smarty.
249   - function renderData($aDataRow) {
  249 + function renderData($aDataRow) {
250 250 $iUserId = null;
251 251 if (($aDataRow["type"] == "folder") && (!is_null($this->folder_field_function))) {
252 252 if (method_exists($aDataRow['folder'], $this->folder_field_function)) {
253   - $iUserId = call_user_func(array($aDataRow['folder'], $this->folder_field_function));
  253 + $iUserId = call_user_func(array($aDataRow['folder'], $this->folder_field_function));
254 254 }
255 255 } else if (($aDataRow["type"] == "document") && (!is_null($this->document_field_function))) {
256 256 if (method_exists($aDataRow['document'], $this->document_field_function)) {
257   - $iUserId = call_user_func(array($aDataRow['document'], $this->document_field_function));
  257 + $iUserId = call_user_func(array($aDataRow['document'], $this->document_field_function));
258 258 }
259 259 }
260 260 if (is_null($iUserId)) {
... ... @@ -271,7 +271,7 @@ class AdvancedUserColumn extends AdvancedColumn {
271 271 function addToFolderQuery() {
272 272 return array(null, null, null);
273 273 }
274   -
  274 +
275 275 function addToDocumentQuery() {
276 276 return array(null, null, null);
277 277 }
... ... @@ -280,20 +280,20 @@ class AdvancedUserColumn extends AdvancedColumn {
280 280 class CreatorColumn extends AdvancedUserColumn {
281 281 var $document_field_function = "getCreatorID";
282 282 var $folder_field_function = "getCreatorID";
283   - var $sortable = true; // by default
  283 + var $sortable = true; // by default
284 284 var $namespace = 'ktcore.columns.creator';
285   -
  285 +
286 286 function CreatorColumn() {
287   - $this->label = _kt("Creator"); // abstract.
  287 + $this->label = _kt("Creator"); // abstract.
288 288 }
289 289 }
290 290  
291 291 class AdvancedSelectionColumn extends AdvancedColumn {
292 292 var $rangename = null;
293 293 var $show_folders = true;
294   - var $show_documents = true;
295   -
296   - var $namespace = "ktcore.columns.selection";
  294 + var $show_documents = true;
  295 +
  296 + var $namespace = "ktcore.columns.selection";
297 297  
298 298 function AdvancedSelectionColumn() {
299 299 $this->label = '';
... ... @@ -302,40 +302,40 @@ class AdvancedSelectionColumn extends AdvancedColumn {
302 302 function setOptions($aOptions) {
303 303 AdvancedColumn::setOptions($aOptions);
304 304 $this->rangename = KTUtil::arrayGet($this->aOptions, 'rangename', $this->rangename);
305   - $this->show_folders = KTUtil::arrayGet($this->aOptions, 'show_folders', $this->show_folders, false);
306   - $this->show_documents = KTUtil::arrayGet($this->aOptions, 'show_documents', $this->show_documents, false);
  305 + $this->show_folders = KTUtil::arrayGet($this->aOptions, 'show_folders', $this->show_folders, false);
  306 + $this->show_documents = KTUtil::arrayGet($this->aOptions, 'show_documents', $this->show_documents, false);
307 307 }
308 308  
309   - function renderHeader($sReturnURL) {
  309 + function renderHeader($sReturnURL) {
310 310 global $main;
311 311 $main->requireJSResource("resources/js/toggleselect.js");
312   -
  312 +
313 313 return sprintf('<input type="checkbox" title="toggle all" onclick="toggleSelectFor(this, \'%s\')" />', $this->rangename);
314   -
  314 +
315 315 }
316   -
  316 +
317 317 // only include the _f or _d IF WE HAVE THE OTHER TYPE.
318   - function renderData($aDataRow) {
319   - $localname = $this->rangename;
320   -
321   - if (($aDataRow["type"] === "folder") && ($this->show_folders)) {
  318 + function renderData($aDataRow) {
  319 + $localname = htmlentities($this->rangename,ENT_QUOTES,'UTF-8');
  320 +
  321 + if (($aDataRow["type"] === "folder") && ($this->show_folders)) {
322 322 if ($this->show_documents) {
323   - $localname .= "_f[]";
  323 + $localname .= "_f[]";
324 324 }
325   - $v = $aDataRow["folderid"];
326   - } else if (($aDataRow["type"] === "document") && $this->show_documents) {
  325 + $v = $aDataRow["folderid"];
  326 + } else if (($aDataRow["type"] === "document") && $this->show_documents) {
327 327 if ($this->show_folders) {
328   - $localname .= "_d[]";
  328 + $localname .= "_d[]";
329 329 }
330   - $v = $aDataRow["docid"];
331   - } else {
332   - return '&nbsp;';
  330 + $v = $aDataRow["docid"];
  331 + } else {
  332 + return '&nbsp;';
333 333 }
334   -
  334 +
335 335 return sprintf('<input type="checkbox" name="%s" onclick="activateRow(this)" value="%s"/>', $localname, $v);
336 336 }
337   -
338   -
  337 +
  338 +
339 339 // no label, but we do have a title
340 340 function getName() {
341 341 return _kt("Multiple Selection");
... ... @@ -350,36 +350,36 @@ class AdvancedSingleSelectionColumn extends AdvancedSelectionColumn {
350 350 parent::AdvancedSelectionColumn();
351 351 $this->label = null;
352 352 }
353   -
  353 +
354 354 function renderHeader() {
355   - return '&nbsp;';
  355 + return '&nbsp;';
356 356 }
357   -
  357 +
358 358 // only include the _f or _d IF WE HAVE THE OTHER TYPE.
359   - function renderData($aDataRow) {
  359 + function renderData($aDataRow) {
360 360 $localname = $this->rangename;
361   -
362   - if (($aDataRow["type"] === "folder") && ($this->show_folders)) {
  361 +
  362 + if (($aDataRow["type"] === "folder") && ($this->show_folders)) {
363 363 if ($this->show_documents) {
364   - $localname .= "_f";
  364 + $localname .= "_f";
365 365 }
366   - $v = $aDataRow["folderid"];
367   - } else if (($aDataRow["type"] === "document") && $this->show_documents) {
  366 + $v = $aDataRow["folderid"];
  367 + } else if (($aDataRow["type"] === "document") && $this->show_documents) {
368 368 if ($this->show_folders) {
369   - $localname .= "_d";
  369 + $localname .= "_d";
370 370 }
371   - $v = $aDataRow["docid"];
372   - } else {
373   - return '&nbsp;';
  371 + $v = $aDataRow["docid"];
  372 + } else {
  373 + return '&nbsp;';
374 374 }
375   -
  375 +
376 376 return '<input type="radio" name="' . $localname . '" value="' . $v . '"/>';
377 377 }
378 378  
379 379 // no label, but we do have a title
380 380 function getName() {
381 381 return _kt("Single Selection");
382   - }
  382 + }
383 383 }
384 384  
385 385  
... ... @@ -389,16 +389,16 @@ class AdvancedWorkflowColumn extends AdvancedColumn {
389 389  
390 390 function AdvancedWorkflowColumn() {
391 391 $this->label = _kt("Workflow State");
392   - $this->sortable = false;
  392 + $this->sortable = false;
393 393 }
394   -
  394 +
395 395 // use inline, since its just too heavy to even _think_ about using smarty.
396   - function renderData($aDataRow) {
  396 + function renderData($aDataRow) {
397 397 // only _ever_ show this for documents.
398   - if ($aDataRow["type"] === "folder") {
  398 + if ($aDataRow["type"] === "folder") {
399 399 return '&nbsp;';
400 400 }
401   -
  401 +
402 402 $oWorkflow = KTWorkflowUtil::getWorkflowForDocument($aDataRow['document']);
403 403 $oState = KTWorkflowUtil::getWorkflowStateForDocument($aDataRow['document']);
404 404 if (($oState == null) || ($oWorkflow == null)) {
... ... @@ -415,21 +415,21 @@ class AdvancedWorkflowColumn extends AdvancedColumn {
415 415 class AdvancedDownloadColumn extends AdvancedColumn {
416 416  
417 417 var $namespace = 'ktcore.columns.download';
418   -
  418 +
419 419 function AdvancedDownloadColumn() {
420 420 $this->label = null;
421 421 }
422 422  
423   - function renderData($aDataRow) {
  423 + function renderData($aDataRow) {
424 424 // only _ever_ show this for documents.
425   - if ($aDataRow["type"] === "folder") {
  425 + if ($aDataRow["type"] === "folder") {
426 426 return '&nbsp;';
427 427 }
428   -
  428 +
429 429 $link = KTUtil::ktLink('action.php','ktcore.actions.document.view', 'fDocumentId=' . $aDataRow['document']->getId());
430 430 return sprintf('<a href="%s" class="ktAction ktDownload" title="%s">%s</a>', $link, _kt('Download Document'), _kt('Download Document'));
431 431 }
432   -
  432 +
433 433 function getName() { return _kt('Download'); }
434 434 }
435 435  
... ... @@ -437,17 +437,17 @@ class AdvancedDownloadColumn extends AdvancedColumn {
437 437 class DocumentIDColumn extends AdvancedColumn {
438 438 var $bSortable = false;
439 439 var $namespace = 'ktcore.columns.docid';
440   -
  440 +
441 441 function DocumentIDColumn() {
442 442 $this->label = _kt("Document ID");
443 443 }
444 444  
445   - function renderData($aDataRow) {
  445 + function renderData($aDataRow) {
446 446 // only _ever_ show this for documents.
447   - if ($aDataRow["type"] === "folder") {
  447 + if ($aDataRow["type"] === "folder") {
448 448 return '&nbsp;';
449 449 }
450   -
  450 +
451 451 return htmlentities($aDataRow['document']->getId(), ENT_NOQUOTES, 'UTF-8');
452 452 }
453 453 }
... ... @@ -455,21 +455,21 @@ class DocumentIDColumn extends AdvancedColumn {
455 455 class ContainingFolderColumn extends AdvancedColumn {
456 456  
457 457 var $namespace = 'ktcore.columns.containing_folder';
458   -
  458 +
459 459 function ContainingFolderColumn() {
460 460 $this->label = _kt("View Folder");
461 461 }
462 462  
463   - function renderData($aDataRow) {
  463 + function renderData($aDataRow) {
464 464 // only _ever_ show this for documents.
465   - if ($aDataRow["type"] === "folder") {
  465 + if ($aDataRow["type"] === "folder") {
466 466 return '&nbsp;';
467 467 }
468   -
  468 +
469 469 $link = KTBrowseUtil::getUrlForFolder($aDataRow['document']->getFolderId());
470 470 return sprintf('<a href="%s" class="ktAction ktMoveUp" title="%s">%s</a>', $link, _kt('View Folder'), _kt('View Folder'));
471 471 }
472   -
  472 +
473 473 function getName() { return _kt('Opening Containing Folder'); }
474 474 }
475 475  
... ...