Peter M. Groen / knowledgetree

Commit 2f89017c6a69a46936e7637ff32d2f5d55ed2f94

Authored by megan_w
1 parent 7f3a45fc

KTS-2831 

"CLONE -End line characters in discussions and disclaimers being displayed as html tags (SUP-546)"
Fixed. Removed the calls to sanitiseForSQL before inserting into the database.

Committed by: Megan Watson
Reviewed by: Conrad Vermeulen



git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@7909 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 5 changed files with 80 additions and 78 deletions
lib/discussions/DiscussionComment.inc
  View file @2f89017
... ... @@ -7,38 +7,38 @@
7 7 * KnowledgeTree Open Source Edition
8 8 * Document Management Made Simple
9 9 * Copyright (C) 2004 - 2007 The Jam Warehouse Software (Pty) Limited
10   - *
  10 + *
11 11 * This program is free software; you can redistribute it and/or modify it under
12 12 * the terms of the GNU General Public License version 3 as published by the
13 13 * Free Software Foundation.
14   - *
  14 + *
15 15 * This program is distributed in the hope that it will be useful, but WITHOUT
16 16 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
17 17 * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
18 18 * details.
19   - *
  19 + *
20 20 * You should have received a copy of the GNU General Public License
21 21 * along with this program. If not, see <http://www.gnu.org/licenses/>.
22   - *
  22 + *
23 23 * You can contact The Jam Warehouse Software (Pty) Limited, Unit 1, Tramber Place,
24 24 * Blake Street, Observatory, 7925 South Africa. or email info@knowledgetree.com.
25   - *
  25 + *
26 26 * The interactive user interfaces in modified source and object code versions
27 27 * of this program must display Appropriate Legal Notices, as required under
28 28 * Section 5 of the GNU General Public License version 3.
29   - *
  29 + *
30 30 * In accordance with Section 7(b) of the GNU General Public License version 3,
31 31 * these Appropriate Legal Notices must retain the display of the "Powered by
32   - * KnowledgeTree" logo and retain the original copyright notice. If the display of the
  32 + * KnowledgeTree" logo and retain the original copyright notice. If the display of the
33 33 * logo is not reasonably feasible for technical reasons, the Appropriate Legal Notices
34   - * must display the words "Powered by KnowledgeTree" and retain the original
35   - * copyright notice.
  34 + * must display the words "Powered by KnowledgeTree" and retain the original
  35 + * copyright notice.
36 36 * Contributor( s): ______________________________________
37 37 */
38 38  
39 39 class DiscussionComment extends KTEntity {
40 40 var $_bUsePearError = true;
41   -
  41 +
42 42 var $iThreadId;
43 43 var $iUserId;
44 44 var $sSubject;
... ... @@ -66,12 +66,12 @@ class DiscussionComment extends KTEntity {
66 66  
67 67 function getThreadId(){ return $this->iThreadId; }
68 68 function setThreadId($iThreadId){ $this->iThreadId = $iThreadId; }
69   - function getUserId(){ return $this->iUserId; }
  69 + function getUserId(){ return $this->iUserId; }
70 70 function setUserId($iNewUserId){ $this->iUserId = $iNewUserId; }
71   - function getSubject(){ return sanitizeForSQLtoHTML($this->sSubject); }
72   - function setSubject($sNewSubject){ $this->sSubject = sanitizeForSQL($sNewSubject); }
73   - function getBody(){ return sanitizeForSQLtoHTML($this->sBody); }
74   - function setBody($sNewBody){ $this->sBody = sanitizeForSQL($sNewBody); }
  71 + function getSubject(){ return $this->sSubject; }
  72 + function setSubject($sNewSubject){ $this->sSubject = $sNewSubject; }
  73 + function getBody(){ return $this->sBody; }
  74 + function setBody($sNewBody){ $this->sBody = $sNewBody; }
75 75 function getDate(){ return $this->dDate; }
76 76 function getInReplyTo(){ return $this->iInReplyTo; }
77 77 function setInReplyTo($sNewCommentId){ $this->iInReplyTo = $sNewCommentId; }
... ...
plugins/ktstandard/KTDisclaimers.php
  View file @2f89017
... ... @@ -5,32 +5,32 @@
5 5 * KnowledgeTree Open Source Edition
6 6 * Document Management Made Simple
7 7 * Copyright (C) 2004 - 2007 The Jam Warehouse Software (Pty) Limited
8   - *
  8 + *
9 9 * This program is free software; you can redistribute it and/or modify it under
10 10 * the terms of the GNU General Public License version 3 as published by the
11 11 * Free Software Foundation.
12   - *
  12 + *
13 13 * This program is distributed in the hope that it will be useful, but WITHOUT
14 14 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
15 15 * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
16 16 * details.
17   - *
  17 + *
18 18 * You should have received a copy of the GNU General Public License
19 19 * along with this program. If not, see <http://www.gnu.org/licenses/>.
20   - *
  20 + *
21 21 * You can contact The Jam Warehouse Software (Pty) Limited, Unit 1, Tramber Place,
22 22 * Blake Street, Observatory, 7925 South Africa. or email info@knowledgetree.com.
23   - *
  23 + *
24 24 * The interactive user interfaces in modified source and object code versions
25 25 * of this program must display Appropriate Legal Notices, as required under
26 26 * Section 5 of the GNU General Public License version 3.
27   - *
  27 + *
28 28 * In accordance with Section 7(b) of the GNU General Public License version 3,
29 29 * these Appropriate Legal Notices must retain the display of the "Powered by
30   - * KnowledgeTree" logo and retain the original copyright notice. If the display of the
  30 + * KnowledgeTree" logo and retain the original copyright notice. If the display of the
31 31 * logo is not reasonably feasible for technical reasons, the Appropriate Legal Notices
32   - * must display the words "Powered by KnowledgeTree" and retain the original
33   - * copyright notice.
  32 + * must display the words "Powered by KnowledgeTree" and retain the original
  33 + * copyright notice.
34 34 * Contributor( s): ______________________________________
35 35 *
36 36 */
... ... @@ -50,7 +50,7 @@ class KTDisclaimersPlugin extends KTPlugin {
50 50 $res = parent::KTPlugin($sFilename);
51 51 $this->sFriendlyName = _kt('Disclaimers Plugin');
52 52 return $res;
53   - }
  53 + }
54 54  
55 55 function setup() {
56 56 $this->setupAdmin();
... ... @@ -67,25 +67,25 @@ class KTDisclaimersPlugin extends KTPlugin {
67 67 }
68 68  
69 69 function getDisclaimer($sLocation) {
70   - $sDisclaimer = false;
  70 + $sDisclaimer = false;
  71 +
  72 + if($this->isRegistered()) {
  73 + $aHelp = KTHelp::getHelpInfo($sLocation);
71 74  
72   - if($this->isRegistered()) {
73   - $aHelp = KTHelp::getHelpInfo($sLocation);
74   -
75   - if(!PEAR::isError($aHelp) && strlen(trim($aHelp['body']))) {
76   - $sDisclaimer = $aHelp['body'];
77   - }
78   - }
  75 + if(!PEAR::isError($aHelp) && strlen(trim($aHelp['body']))) {
  76 + $sDisclaimer = str_replace(array('\r','\n'), array('<br>','<br>'), $aHelp['body']);
  77 + }
  78 + }
79 79  
80   - return $sDisclaimer;
  80 + return $sDisclaimer;
81 81 }
82 82  
83 83 function getPageDisclaimer() {
84   - return $this->getDisclaimer($this->aDisclaimers['page']['path']);
  84 + return $this->getDisclaimer($this->aDisclaimers['page']['path']);
85 85 }
86 86  
87 87 function getLoginDisclaimer() {
88   - return $this->getDisclaimer($this->aDisclaimers['login']['path']);
  88 + return $this->getDisclaimer($this->aDisclaimers['login']['path']);
89 89 }
90 90  
91 91 }
... ...
plugins/ktstandard/KTDiscussion.php
  View file @2f89017
... ... @@ -5,32 +5,32 @@
5 5 * KnowledgeTree Open Source Edition
6 6 * Document Management Made Simple
7 7 * Copyright (C) 2004 - 2007 The Jam Warehouse Software (Pty) Limited
8   - *
  8 + *
9 9 * This program is free software; you can redistribute it and/or modify it under
10 10 * the terms of the GNU General Public License version 3 as published by the
11 11 * Free Software Foundation.
12   - *
  12 + *
13 13 * This program is distributed in the hope that it will be useful, but WITHOUT
14 14 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
15 15 * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
16 16 * details.
17   - *
  17 + *
18 18 * You should have received a copy of the GNU General Public License
19 19 * along with this program. If not, see <http://www.gnu.org/licenses/>.
20   - *
  20 + *
21 21 * You can contact The Jam Warehouse Software (Pty) Limited, Unit 1, Tramber Place,
22 22 * Blake Street, Observatory, 7925 South Africa. or email info@knowledgetree.com.
23   - *
  23 + *
24 24 * The interactive user interfaces in modified source and object code versions
25 25 * of this program must display Appropriate Legal Notices, as required under
26 26 * Section 5 of the GNU General Public License version 3.
27   - *
  27 + *
28 28 * In accordance with Section 7(b) of the GNU General Public License version 3,
29 29 * these Appropriate Legal Notices must retain the display of the "Powered by
30   - * KnowledgeTree" logo and retain the original copyright notice. If the display of the
  30 + * KnowledgeTree" logo and retain the original copyright notice. If the display of the
31 31 * logo is not reasonably feasible for technical reasons, the Appropriate Legal Notices
32   - * must display the words "Powered by KnowledgeTree" and retain the original
33   - * copyright notice.
  32 + * must display the words "Powered by KnowledgeTree" and retain the original
  33 + * copyright notice.
34 34 * Contributor( s): ______________________________________
35 35 *
36 36 */
... ... @@ -136,12 +136,12 @@ class KTDocumentDiscussionAction extends KTDocumentAction {
136 136 $fields[] = new KTStringWidget(_kt("Subject"), _kt("The topic of discussion in this thread"), "subject", "", $this->oPage, true);
137 137 $fields[] = new KTTextWidget(_kt("Body"), _kt("Your contribution to the discussion in this thread"), "body", "", $this->oPage, true, null, null, array("cols" => 50, "rows" => 10));
138 138  
139   - $bIncludeClosed = KTUtil::arrayGet($_REQUEST, 'fIncludeClosed', false);
  139 + $bIncludeClosed = KTUtil::arrayGet($_REQUEST, 'fIncludeClosed', false);
140 140  
141   - $sQuery = sprintf('document_id = %d', $this->oDocument->getId());
142   - if(!$bIncludeClosed) {
143   - $sQuery .= sprintf(' AND state != %d', DISCUSSION_CLOSED);
144   - }
  141 + $sQuery = sprintf('document_id = %d', $this->oDocument->getId());
  142 + if(!$bIncludeClosed) {
  143 + $sQuery .= sprintf(' AND state != %d', DISCUSSION_CLOSED);
  144 + }
145 145  
146 146 $threads = DiscussionThread::getList($sQuery);
147 147 $sQuery2 = sprintf('document_id = %d AND state = %d', $this->oDocument->getId(), DISCUSSION_CLOSED);
... ... @@ -183,8 +183,8 @@ class KTDocumentDiscussionAction extends KTDocumentAction {
183 183 $oComment = DiscussionComment::createFromArray(array(
184 184 'threadid' => $oThread->getId(),
185 185 'userid' => $this->oUser->getId(),
186   - 'subject' => sanitizeForSQL($sSubject),
187   - 'body' => sanitizeForSQL(KTUtil::formatPlainText($sBody)),
  186 + 'subject' => $sSubject,
  187 + 'body' => KTUtil::formatPlainText($sBody),
188 188 ));
189 189 $aErrorOptions['message'] = _kt("There was an error adding the comment to the thread");
190 190 $this->oValidator->notError($oComment, $aErrorOptions);
... ... @@ -315,8 +315,8 @@ class KTDocumentDiscussionAction extends KTDocumentAction {
315 315 $oComment = DiscussionComment::createFromArray(array(
316 316 'threadid' => $oThread->getId(),
317 317 'userid' => $this->oUser->getId(),
318   - 'subject' => sanitizeForSQL($sSubject),
319   - 'body' => sanitizeForSQL(KTUtil::formatPlainText($sBody)),
  318 + 'subject' => $sSubject,
  319 + 'body' => KTUtil::formatPlainText($sBody),
320 320 ));
321 321 $aErrorOptions['message'] = _kt("There was an error adding the comment to the thread");
322 322 $this->oValidator->notError($oComment, $aErrorOptions);
... ... @@ -378,7 +378,7 @@ class KTDocumentDiscussionAction extends KTDocumentAction {
378 378 );
379 379  
380 380 $oPermission =& KTPermission::getByName('ktcore.permissions.workflow');
381   - $sRedirectTo = implode('&', $aErrorOptions['redirect_to']);
  381 + $sRedirectTo = implode('&', $aErrorOptions['redirect_to']);
382 382  
383 383 if (PEAR::isError($oPermission)) {
384 384 $this->errorRedirectTo($sRedirectTo, _kt("Error getting permission"));
... ... @@ -389,30 +389,30 @@ class KTDocumentDiscussionAction extends KTDocumentAction {
389 389 exit(0);
390 390 }
391 391  
392   - $iStateId = KTUtil::arrayGet($_REQUEST, 'state');
393   - if(!in_array($iStateId, $this->aTransitions[$oThread->getState()])) {
394   - $this->errorRedirectTo($sRedirectTo, _kt("Invalid transition"));
395   - exit(0);
396   - }
  392 + $iStateId = KTUtil::arrayGet($_REQUEST, 'state');
  393 + if(!in_array($iStateId, $this->aTransitions[$oThread->getState()])) {
  394 + $this->errorRedirectTo($sRedirectTo, _kt("Invalid transition"));
  395 + exit(0);
  396 + }
397 397  
398   - $aErrorOptions['message'] = _kt("No reason provided");
399   - $sReason = sanitizeForSQL($this->oValidator->validateString(KTUtil::arrayGet($_REQUEST, 'reason'), $aErrorOptions));
  398 + $aErrorOptions['message'] = _kt("No reason provided");
  399 + $sReason = $this->oValidator->validateString(KTUtil::arrayGet($_REQUEST, 'reason'), $aErrorOptions);
400 400  
401   - if($iStateId > $oThread->getState()) {
402   - $sTransactionNamespace = 'ktcore.transactions.collaboration_step_approve';
403   - } else {
404   - $sTransactionNamespace = 'ktcore.transactions.collaboration_step_rollback';
405   - }
  401 + if($iStateId > $oThread->getState()) {
  402 + $sTransactionNamespace = 'ktcore.transactions.collaboration_step_approve';
  403 + } else {
  404 + $sTransactionNamespace = 'ktcore.transactions.collaboration_step_rollback';
  405 + }
406 406  
407 407 // Start the transaction comment creation
408 408 $this->startTransaction();
409 409  
410 410 $oThread->setState($iStateId);
411   - if($iStateId == DISCUSSION_CLOSED) {
412   - $oThread->setCloseMetadataVersion($this->oDocument->getMetadataVersion());
413   - } else if($iStateId == DISCUSSION_CONCLUSION) {
414   - $oThread->setCloseReason($sReason);
415   - }
  411 + if($iStateId == DISCUSSION_CLOSED) {
  412 + $oThread->setCloseMetadataVersion($this->oDocument->getMetadataVersion());
  413 + } else if($iStateId == DISCUSSION_CONCLUSION) {
  414 + $oThread->setCloseReason($sReason);
  415 + }
416 416  
417 417 $oDocumentTransaction = new DocumentTransaction($this->oDocument, $sReason, $sTransactionNamespace);
418 418 $oDocumentTransaction->create();
... ... @@ -429,9 +429,6 @@ class KTDocumentDiscussionAction extends KTDocumentAction {
429 429 exit(0);
430 430 }
431 431  
432   -
433   -
434   -
435 432 function &_buildStates(&$oThread) {
436 433 $iCurState = $oThread->getState();
437 434 $aTransitions = $this->aTransitions[$iCurState];
... ... @@ -450,3 +447,4 @@ class KTDocumentDiscussionAction extends KTDocumentAction {
450 447  
451 448  
452 449 }
  450 +?>
453 451 \ No newline at end of file
... ...
sql/mysql/upgrade/3.4.6/remove_backslashes.sql
  View file @2f89017
... ... @@ -12,4 +12,8 @@ SET name = replace(replace(replace(name, &#39;\\\\&#39;, &#39;\\&#39;), &#39;\\\&quot;&#39;, &#39;\&quot;&#39;), &#39;\\\&#39;&#39;, &#39;
12 12  
13 13 UPDATE folders
14 14 SET name = replace(replace(replace(name, '\\\\', '\\'), '\\\"', '\"'), '\\\'', '\''),
15   - description = replace(replace(replace(description, '\\\\', '\\'), '\\\"', '\"'), '\\\'', '\'');
16 15 \ No newline at end of file
  16 + description = replace(replace(replace(description, '\\\\', '\\'), '\\\"', '\"'), '\\\'', '\'');
  17 +
  18 +UPDATE discussion_comments
  19 +SET subject = replace(replace(replace(subject, '\\\\', '\\'), '\\\"', '\"'), '\\\'', '\''),
  20 + body = replace(replace(replace(body, '\\\\', '\\'), '\\\"', '\"'), '\\\'', '\'');
17 21 \ No newline at end of file
... ...
templates/ktstandard/action/discussion_comment_list_item.smarty
  View file @2f89017
... ... @@ -7,14 +7,14 @@
7 7 {/if}
8 8  
9 9 <dt>
10   - <span class="subject">{$comment->getSubject()|sanitize_input}</span>
  10 + <span class="subject">{$comment->getSubject()}</span>
11 11 by
12 12 <span class="author">{$creator->getName()}</span>
13 13 <span class="date">({$comment->getDate()})</span>
14 14  
15 15 </dt>
16 16  
17   - <dd>{$comment->getBody()|sanitize_input}</dd>
  17 + <dd>{$comment->getBody()}</dd>
18 18  
19 19 </dl>
20 20  
... ...