From 752ab3dc79da6fa2dbfd7bfba3c48a6b60c82fa5 Mon Sep 17 00:00:00 2001
From: Florian Schaal <florian@schaal-24.de>
Date: Mon, 22 Sep 2014 09:14:03 -0400
Subject: [PATCH] check always $_POST
---
interface/web/admin/language_edit.php | 27 ++++++++++++++-------------
1 files changed, 14 insertions(+), 13 deletions(-)
diff --git a/interface/web/admin/language_edit.php b/interface/web/admin/language_edit.php
index ce9f30c..fda70a6 100644
--- a/interface/web/admin/language_edit.php
+++ b/interface/web/admin/language_edit.php
@@ -27,14 +27,15 @@
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
-require_once('../../lib/config.inc.php');
-require_once('../../lib/app.inc.php');
+require_once '../../lib/config.inc.php';
+require_once '../../lib/app.inc.php';
//* Check permissions for module
$app->auth->check_module_permissions('admin');
//* This is only allowed for administrators
if(!$app->auth->is_admin()) die('only allowed for administrators.');
+if($conf['demo_mode'] == true) $app->error('This function is disabled in demo mode.');
$app->uses('tpl');
@@ -56,27 +57,27 @@
$file_content = "<?php\n";
foreach($_POST['records'] as $key => $val) {
$val = stripslashes($val);
- $val = str_replace("'",'',$val);
- $val = str_replace('"','',$val);
- $file_content .= '$wb['."'$key'".'] = '."'$val';\n";
+ $val = str_replace('"', '\"', $val);
+ $val = str_replace('$', '', $val);
+ $file_content .= '$wb['."'$key'".'] = "'.$val.'";'."\n";
$msg = 'File saved.';
}
$file_content .= "?>\n";
if($module == 'global') {
- file_put_contents(ISPC_LIB_PATH."/lang/$lang_file" ,$file_content);
+ file_put_contents(ISPC_LIB_PATH."/lang/$lang_file" , $file_content);
} else {
- file_put_contents(ISPC_WEB_PATH."/$module/lib/lang/$lang_file" ,$file_content);
+ file_put_contents(ISPC_WEB_PATH."/$module/lib/lang/$lang_file" , $file_content);
}
}
-$app->tpl->setVar(array('module' => $module,'lang_file' => $lang_file, 'lang' => $lang, 'msg' => $msg));
+$app->tpl->setVar(array('module' => $module, 'lang_file' => $lang_file, 'lang' => $lang, 'msg' => $msg));
if($module == 'global') {
- include(ISPC_LIB_PATH."/lang/$lang_file");
+ include ISPC_LIB_PATH."/lang/$lang_file";
$file_path = ISPC_LIB_PATH."/lang/$lang_file";
} else {
- include(ISPC_WEB_PATH."/$module/lib/lang/$lang_file");
+ include ISPC_WEB_PATH."/$module/lib/lang/$lang_file";
$file_path = ISPC_WEB_PATH."/$module/lib/lang/$lang_file";
}
$app->tpl->setVar("file_path", $file_path);
@@ -84,7 +85,7 @@
$keyword_list = array();
if(isset($wb) && is_array($wb)) {
foreach($wb as $key => $val) {
- $keyword_list[] = array('key' => $key, 'val' => $val);
+ $keyword_list[] = array('key' => $key, 'val' => htmlentities($val, ENT_COMPAT | ENT_HTML401, 'UTF-8'));
}
$app->tpl->setLoop('records', $keyword_list);
@@ -92,9 +93,9 @@
}
-//* load language file
+//* load language file
$lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_edit.lng';
-include($lng_file);
+include $lng_file;
$app->tpl->setVar($wb);
$app->tpl_defaults();
--
Gitblit v1.9.1