L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixing several error messages

Browse Source 
enhancing security of command injections.
allowing space in pathes for files.
allowing binding with tools out of moodleroot
This commit is contained in:
diml
2008-04-06 21:01:28 +00:00
parent 1559b68aaa
commit f8d8b7be3f
8 changed files with 50 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
blocks/search/config_global.html
+14
View File
@@ -55,6 +55,20 @@
} ?>"/><br/><br/>
</td>
</tr>
<tr>
<td valign="top" align="right">
<b><?php print_string('usemoodleroot', 'block_search') ?>:</b>
</td>
<td valign="top" align="left">
<?php
$usemoodleroot = (isset($CFG->block_search_usemoodleroot)) ? 'checked="checked"' : '' ;
$notusemoodleroot = (!isset($CFG->block_search_usemoodleroot)) ? 'checked="checked"' : '' ;
?>
<input id="block_search_usemoodleroot" type="radio" name="block_search_usemoodleroot" <?php echo $usemoodleroot ?> value="1"/> <?php print_string('yes') ?> -
<input id="block_search_usemoodleroot" type="radio" name="block_search_usemoodleroot" <?php echo $notusemoodleroot ?> value="0"/> <?php print_string('no') ?>
<br/><br/>
</td>
</tr>
<tr>
<td valign="top" align="right">
<b><?php print_string('configpdftotextcmd', 'block_search') ?>:</b>
search/documents/chat_document.php
+7 -7
View File
@@ -76,7 +76,9 @@ function chat_make_link($cm_id, $start, $end) {
* fetches all the records for a given session and assemble them as a unique track
* we revamped here the code of report.php for making sessions, but without any output.
* note that we should collect sessions "by groups" if groupmode() is SEPARATEGROUPS.
* @param chat_id the database
* @param int $chat_id the database
* @param int $fromtime
* @param int $totime
* @uses CFG
* @return an array of objects representing the chat sessions.
*/
@@ -100,8 +102,7 @@ function chat_get_session_tracks($chat_id, $fromtime = 0, $totime = 0) {
foreach($messages as $aMessage){
$groupedMessages[$aMessage->groupid][] = $aMessage;
}
}
else{
} else {
$groupedMessages[-1] = &$messages;
}
$sessiongap = 5 * 60; // 5 minutes silence means a new session
@@ -128,9 +129,8 @@ function chat_get_session_tracks($chat_id, $fromtime = 0, $totime = 0) {
$tracks[count($tracks) - 1]->content .= ' '.$message->message;
$tracks[count($tracks) - 1]->sessionstart = $message->timestamp;
}
}
} else {
// we initiate a new session track (backwards)
else {
$track = new Object();
$track->sessionend = $message->timestamp;
$track->sessionstart = $message->timestamp;
@@ -175,7 +175,7 @@ function chat_get_content_for_index(&$chat) {
foreach($sessionTracks as $aTrackId => $aTrack) {
foreach($aTrack->sessionusers as $aUserId){
$user = get_record('user', 'id', $aUserId);
$aTrack->authors = ($user) ? $user->firstname.' '.$user->lastname : '' ;
$aTrack->authors = ($user) ? fullname($user) : '' ;
$documents[] = new ChatTrackSearchDocument(get_object_vars($aTrack), $cm->id, $chat->course, $aTrack->groupid, $context->id);
}
}
@@ -208,8 +208,8 @@ function chat_single_document($id, $itemtype) {
if ($tracks){
$aTrack = $tracks[0];
$document = new ChatTrackSearchDocument(get_object_vars($aTrack), $cm->id, $chat->course, $aTrack->groupid, $context->id);
return $document;
}
return $document;
}
return null;
}
search/documents/physical_doc.php
+6 -4
View File
@@ -23,26 +23,28 @@ function get_text_for_indexing_doc(&$resource){
// SECURITY : do not allow non admin execute anything on system !!
if (!isadmin($USER->id)) return;
$moodleroot = (@$CFG->block_search_usemoodleroot) ? "{$CFG->dirroot}/" : '' ;
// just call pdftotext over stdout and capture the output
if (!empty($CFG->block_search_word_to_text_cmd)){
if (!file_exists("{$moodleroot}{$CFG->block_search_word_to_text_cmd}")){
mtrace('Error with MSWord to text converter command : executable not found.');
mtrace('Error with MSWord to text converter command : exectuable not found.');
}
else{
$file = escapeshellarg($CFG->dataroot.'/'.$resource->course.'/'.$resource->reference);
$text_converter_cmd = "\"{$moodleroot}{$CFG->block_search_word_to_text_cmd}\" \"$file\"";
$command = trim($CFG->block_search_word_to_text_cmd);
$text_converter_cmd = "{$moodleroot}{$command} \"$file\"";
if ($CFG->block_search_word_to_text_env){
putenv($CFG->block_search_word_to_text_env);
}
mtrace("Executing : $text_converter_cmd");
$result = shell_exec($text_converter_cmd);
if ($result){
return mb_convert_encoding($result, 'UTF8', 'auto');
}
else{
mtrace('Error with MSWord to text converter command : execution failed.');
mtrace('Error with MSWord to text converter command : execution failed. ');
return '';
}
}
search/documents/physical_htm.php
+1
View File
@@ -39,6 +39,7 @@ function get_text_for_indexing_htm(&$resource){
// filter all html tags
// $text = clean_text($text, FORMAT_PLAIN);
// NOTE : this is done in ResourceSearchDocument __constructor
$text = preg_replace("/<!--[^>]*?-->/", '', $text);
if (!empty($CFG->block_search_limit_index_body)){
$text = shorten($text, $CFG->block_search_limit_index_body);
search/documents/physical_pdf.php
+3 -2
View File
@@ -28,12 +28,13 @@ function get_text_for_indexing_pdf(&$resource){
// just call pdftotext over stdout and capture the output
if (!empty($CFG->block_search_pdf_to_text_cmd)){
preg_match("/^\S+/", $CFG->block_search_pdf_to_text_cmd, $matches);
if (!file_exists("{$moodleroot}{$matches[0]}")){
if (!file_exists("{$moodleroot}/{$matches[0]}")){
mtrace('Error with pdf to text converter command : exectuable not found.');
}
else{
$file = escapeshellarg($CFG->dataroot.'/'.$resource->course.'/'.$resource->reference);
$text_converter_cmd = "\"{$moodleroot}{$CFG->block_search_pdf_to_text_cmd}\" \"$file\" -";
$command = trim($CFG->block_search_pdf_to_text_cmd);
$text_converter_cmd = "{$moodleroot}/{$command} \"$file\" -";
$result = shell_exec($text_converter_cmd);
if ($result){
return $result;
search/documents/resource_document.php
+12 -8
View File
@@ -75,6 +75,7 @@ function resource_iterator() {
* this function does not need a content iterator, returns all the info
* itself;
* @param notneeded to comply API, remember to fake the iterator array though
* @uses CFG
* @return an array of searchable documents
*/
function resource_get_content_for_index(&$notneeded) {
@@ -162,7 +163,10 @@ function resource_get_physical_file(&$resource, $context_id, $getsingle, &$docum
global $CFG;
// cannot index empty references
if (empty($resource->reference)) return false;
if (empty($resource->reference)){
mtrace("Cannot index, empty reference.");
return false;
}
// cannot index remote resources
if (resource_is_url($resource->reference)){
@@ -173,6 +177,7 @@ function resource_get_physical_file(&$resource, $context_id, $getsingle, &$docum
$fileparts = pathinfo($resource->reference);
// cannot index unknown or masked types
if (empty($fileparts['extension'])) {
mtrace("Cannot index without explicit extension.");
return false;
}
@@ -196,15 +201,15 @@ function resource_get_physical_file(&$resource, $context_id, $getsingle, &$docum
$resource->alltext = $function_name($resource);
if (!empty($resource->alltext)){
if ($getsingle){
return new ResourceSearchDocument(get_object_vars($resource), $context_id);
}
else{
$single = new ResourceSearchDocument(get_object_vars($resource), $context_id);
mtrace("finished file $resource->name as {$resource->reference}");
return $single;
} else {
$documents[] = new ResourceSearchDocument(get_object_vars($resource), $context_id);
}
mtrace("finished file $resource->name as {$resource->reference}");
}
}
else{
} else {
mtrace("fulltext handler not found for $ext type");
}
return false;
@@ -257,8 +262,7 @@ function resource_single_document($id, $itemtype) {
$document = resource_get_physical_file($resource, true, $context->id);
if (!$document) mtrace("Warning : this document {$resource->name} will not be indexed");
return $document;
}
else{
} else {
return new ResourceSearchDocument(get_object_vars($resource), $context->id);
}
}
search/documents/techproject_document.php
+5
View File
@@ -91,6 +91,7 @@ function techproject_get_content_for_index(&$techproject) {
foreach($entries as $anEntry) {
if ($anEntry) {
if (strlen($anEntry->description) > 0) {
$anEntry->author = '';
$documents[] = new TechprojectEntrySearchDocument(get_object_vars($anEntry), $techproject->course, $context->id);
}
}
@@ -120,18 +121,22 @@ function techproject_single_document($id, $itemtype) {
switch ($itemtype){
case 'requirement':{
$entry = get_record('techproject_requirement', 'id', $id);
$entry->author = '';
break;
}
case 'specification':{
$entry = get_record('techproject_specification', 'id', $id);
$entry->author = '';
break;
}
case 'milestone':{
$entry = get_record('techproject_milestone', 'id', $id);
$entry->author = '';
break;
}
case 'deliverable':{
$entry = get_record('techproject_deliverable', 'id', $id);
$entry->author = '';
break;
}
case 'task':{
search/documents/wiki_document.php
+2 -2
View File
@@ -39,7 +39,7 @@ class WikiSearchDocument extends SearchDocument {
$doc->contextid = $context_id;
$doc->title = $page['pagename'];
$doc->date = $page['timemodified'];
$doc->date = $page['lastmodified'];
//remove '(ip.ip.ip.ip)' from wiki author field
$doc->author = preg_replace('/\(.*?\)/', '', $page['author']);
$doc->contents = $page['content'];
@@ -138,7 +138,7 @@ function wiki_get_latest_pages(&$entry) {
if ($ids = get_records('wiki_pages', 'wiki', $entry->id, '', 'distinct pagename')) {
if ($pagesets = get_records('wiki_pages', 'wiki', $entry->id, '', 'distinct pagename')) {
foreach ($pagesets as $aPageset) {
$pages[] = wiki_get_latest_page($entry, $aPageset->id);
$pages[] = wiki_get_latest_page($entry, $aPageset->pagename);
}
} else {
return false;