tutos-commits Mailing List for TUTOS

Revision: 1292
          http://sourceforge.net/p/tutos/code/1292
Author:   gokohnert
Date:     2016-07-08 14:20:10 +0000 (Fri, 08 Jul 2016)
Log Message:
-----------
check against SQL Injection

SYSS-2016-070

Credits:

This security vulnerability was found by Christoph Ritter of the SySS
GmbH.

E-Mail: chr...@sy...
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Christoph_Ritter.asc
Key Fingerprint: 9FB0 1B9B 2F72 3DD5 3AF3 62D8 0545 8E66 6D35 EAE8

Modified Paths:
--------------
    trunk/php/report-engine/rep_bug_state_duration/rep_bug_state_duration.pinc

Modified: trunk/php/report-engine/rep_bug_state_duration/rep_bug_state_duration.pinc
===================================================================
--- trunk/php/report-engine/rep_bug_state_duration/rep_bug_state_duration.pinc	2016-07-08 14:18:44 UTC (rev 1291)
+++ trunk/php/report-engine/rep_bug_state_duration/rep_bug_state_duration.pinc	2016-07-08 14:20:10 UTC (rev 1292)
@@ -34,7 +34,9 @@
 
         $this->bugclass = array();
         if (isset($_GET['bugclass'])) {
-            $this->bugclass = $_GET['bugclass'];
+            if (is_array($_GET['bugclass'])) {
+                $this->bugclass = $_GET['bugclass'];
+            }
         }
 
         $this->stc = getObject($this->dbconn,$tutos['bug_state_stc']);
@@ -83,14 +85,12 @@
         }
 
         $x = new TUTOS_Date_Time();
-        # calc the last state only if not CLOSED
-                                              #   if (($lastState != BUG_STATE_CLOSED) && ($lastState != BUG_STATE_SOLVED)) {
-            if ($lastState != BUG_STATE_CLOSED)  {
-                $stat[$lastState] += ($x->ts - $lastChange);
-            }
-            $lastChange = $x->ts;
+        if ($lastState != BUG_STATE_CLOSED)  {
+            $stat[$lastState] += ($x->ts - $lastChange);
+        }
+        $lastChange = $x->ts;
 
-            return $r;
+        return $r;
     }
 
     function show(layout $ly) {
@@ -109,16 +109,20 @@
                 $r .= 'FILTERED '. $lang['BugClass'].': ';
                 $pre_r = '';
                 foreach ($this->bugclass as $j) {
-                    $r .= $pre_r. $lang['BugClasses'][$j];
-                    $pre_r = " or ";
+                    if (is_numeric($j)) {
+                        $r .= $pre_r. $lang['BugClasses'][$j];
+                        $pre_r = " or ";
+                    }
                 }
                 $r .= "<br />";
 
                 $q .= $pre . "class in (";
                 $pre2 = "";
                 foreach ($this->bugclass as $j) {
-                    $q.= $pre2.$j;
-                    $pre2 = ",";
+                    if (is_numeric($j)) {
+                        $q.= $pre2.$j;
+                        $pre2 = ",";
+                    }
                 }
                 $q.= ")";
                 $pre = " AND ";
@@ -240,4 +244,4 @@
 
 }
 
-?>
+?>
\ No newline at end of file

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

Revision: 1291
          http://sourceforge.net/p/tutos/code/1291
Author:   gokohnert
Date:     2016-07-08 14:18:44 +0000 (Fri, 08 Jul 2016)
Log Message:
-----------
check against XSS attack vector

Credits:

This security vulnerability was found by Christoph Ritter of the SySS
GmbH.

E-Mail: chr...@sy...
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Christoph_Ritter.asc
Key Fingerprint: 9FB0 1B9B 2F72 3DD5 3AF3 62D8 0545 8E66 6D35 EAE8

Modified Paths:
--------------
    trunk/php/address_tools.p3

Modified: trunk/php/address_tools.p3
===================================================================
--- trunk/php/address_tools.p3	2016-04-12 17:53:01 UTC (rev 1290)
+++ trunk/php/address_tools.p3	2016-07-08 14:18:44 UTC (rev 1291)
@@ -68,7 +68,7 @@
                     $url = addUrlParameter($url,"format=popup",false);
                     $url = addSessionKey($url,false);
                     $r .= "<a href=\"JavaScript:
-     mywindow = window.open('". $l ."', 'help', 'width=300,height=300,top=200,left=200,scrollbars=1');
+     mywindow = window.open('". myentities($l->name) ."', 'help', 'width=300,height=300,top=200,left=200,scrollbars=1');
      mywindow.location.href = '". $url ."'; mywindow.focus();\" "self.status='". myentities($l->$name,1) ."' ;return true\" title=\"". myentities($l->$name) ."\">";
                     $r .= myentities($l->$name) ."</a>";
                 } else {

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.