L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added sesskey to more actions + bug fix when detecting directory traversals.

Browse Source 
From skodak!
This commit is contained in:
stronk7
2004-10-24 23:51:51 +00:00
parent aeb0e7ee1e
commit 7092220f99
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/index.php
+8 -4
View File
@@ -204,7 +204,7 @@
case "move":
html_header($course, $wdir);
if ($count = setfilelist($_POST)) {
if (($count = setfilelist($_POST)) and confirm_sesskey()) {
$USER->fileop = $action;
$USER->filesource = $wdir;
echo "<p align=center>";
@@ -217,7 +217,7 @@
case "paste":
html_header($course, $wdir);
if (isset($USER->fileop) and $USER->fileop == "move") {
if (isset($USER->fileop) and ($USER->fileop == "move") and confirm_sesskey()) {
foreach ($USER->filelist as $file) {
$shortfile = basename($file);
$oldfile = $basedir.$file;
@@ -311,7 +311,7 @@
case "edit":
html_header($course, $wdir);
if (isset($text)) {
if (isset($text) and confirm_sesskey()) {
$fileptr = fopen($basedir.$file,"w");
fputs($fileptr, stripslashes($text));
fclose($fileptr);
@@ -338,6 +338,7 @@
echo " <INPUT TYPE=hidden NAME=wdir VALUE=\"$wdir\">";
echo " <INPUT TYPE=hidden NAME=file VALUE=\"$file\">";
echo " <INPUT TYPE=hidden NAME=action VALUE=edit>";
echo " <input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
print_textarea($usehtmleditor, 25, 80, 680, 400, "text", $contents);
echo "</TD></TR><TR><TD>";
echo " <INPUT TYPE=submit VALUE=\"".get_string("savechanges")."\">";
@@ -560,8 +561,9 @@ function setfilelist($VARS) {
foreach ($VARS as $key => $val) {
if (substr($key,0,4) == "file") {
$count++;
$val = rawurldecode($val);
if (!detect_munged_arguments($val, 0)) {
$USER->filelist[] = rawurldecode($val);
$USER->filelist[] = $val;
}
}
}
@@ -751,6 +753,7 @@ function displaydir ($wdir) {
echo "<TR><TD>";
echo "<INPUT TYPE=hidden NAME=id VALUE=\"$id\">";
echo "<INPUT TYPE=hidden NAME=wdir VALUE=\"$wdir\"> ";
echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
$options = array (
"move" => "$strmovetoanotherfolder",
"delete" => "$strdeletecompletely",
@@ -767,6 +770,7 @@ function displaydir ($wdir) {
echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
echo " <INPUT TYPE=hidden NAME=wdir VALUE=\"$wdir\">";
echo " <INPUT TYPE=hidden NAME=action VALUE=paste>";
echo " <input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
echo " <INPUT TYPE=submit VALUE=\"$strmovefilestohere\">";
echo "</FORM>";
}