Skip to content

Commit 70ec4e1

Browse files
committed
1 parent 1eace48 commit 70ec4e1

File tree

6 files changed

+106
-105
lines changed

6 files changed

+106
-105
lines changed

main/auth/profile.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -356,7 +356,7 @@ function check_user_password($password){
356356
$user_id = api_get_user_id();
357357
if ($user_id != strval(intval($user_id)) || empty($password)) { return false; }
358358
$table_user = Database :: get_main_table(TABLE_MAIN_USER);
359-
$password = api_get_encrypted_password($password);
359+
$password = Database::escape_string(api_get_encrypted_password($password));
360360
$sql_password = "SELECT * FROM $table_user WHERE user_id='".$user_id."' AND password='".$password."'";
361361
$result = Database::query($sql_password);
362362
return Database::num_rows($result) != 0;

main/course_info/infocours.php

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,12 @@
4444

4545
//LOGIC FUNCTIONS
4646
function is_settings_editable() {
47-
return isset($GLOBALS['course_info_is_editable']) && $GLOBALS['course_info_is_editable'];
47+
return isset($GLOBALS['course_info_is_editable']) && $GLOBALS['course_info_is_editable'];
4848
}
4949

5050
/* MAIN CODE */
5151
if (!$is_allowedToEdit) {
52-
api_not_allowed(true);
52+
api_not_allowed(true);
5353
}
5454

5555
$show_delete_watermark_text_message = false;
@@ -78,8 +78,8 @@ function is_settings_editable() {
7878
$q_result_titulars = Database::query($s_sql_course_titular);
7979

8080
if (Database::num_rows($q_result_titulars) == 0) {
81-
$sql = "SELECT username, lastname, firstname FROM $tbl_user as user, $tbl_admin as admin WHERE admin.user_id=user.user_id ORDER BY ".$target_name." ASC";
82-
$q_result_titulars = Database::query($sql);
81+
$sql = "SELECT username, lastname, firstname FROM $tbl_user as user, $tbl_admin as admin WHERE admin.user_id=user.user_id ORDER BY ".$target_name." ASC";
82+
$q_result_titulars = Database::query($sql);
8383
}
8484

8585
$a_profs[0] = '-- '.get_lang('NoManager').' --';
@@ -134,7 +134,7 @@ function is_settings_editable() {
134134

135135

136136
$form->add_textfield('title', get_lang('Title'), true, array('class' => 'span6'));
137-
//$form->applyFilter('title', 'html_filter');
137+
$form->applyFilter('title', 'html_filter');
138138
$form->applyFilter('title', 'trim');
139139

140140
//$form->add_textfield('tutor_name', get_lang('Professors'), true, array ('size' => '60'));
@@ -154,9 +154,11 @@ function is_settings_editable() {
154154
$form->addElement('select_language', 'course_language', array(get_lang('Ln'), get_lang('TipLang')));
155155

156156
$form->add_textfield('department_name', get_lang('Department'), false, array('class' => 'span5'));
157+
$form->applyFilter('department_name', 'html_filter');
157158
$form->applyFilter('department_name', 'trim');
158159

159160
$form->add_textfield('department_url', get_lang('DepartmentUrl'), false, array('class' => 'span5'));
161+
$form->applyFilter('department_url', 'html_filter');
160162
//$form->addRule('tutor_name', get_lang('ThisFieldIsRequired'), 'required');
161163

162164

@@ -424,7 +426,7 @@ function is_settings_editable() {
424426

425427
//Variables that will be saved in the TABLE_MAIN_COURSE table
426428
$update_in_course_table = array('title', 'course_language','category_code','department_name', 'department_url','visibility',
427-
'subscribe', 'unsubscribe','tutor_name','course_registration_password', 'legal', 'activate_legal');
429+
'subscribe', 'unsubscribe','tutor_name','course_registration_password', 'legal', 'activate_legal');
428430

429431
foreach ($update_values as $index =>$value) {
430432
$update_values[$index] = Database::escape_string($value);

main/inc/lib/fckeditor/editor/filemanager/connectors/php/config.php

100644100755
Lines changed: 47 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -22,77 +22,87 @@
2222
* Configuration file for the File Manager Connector for PHP.
2323
*/
2424

25-
// Modifications by Ivan Tcholakov, JUN-2009.
25+
// Modifications by Ivan Tcholakov, JUN-2009.
2626

2727
// Some language variables are needed.
2828
$language_file = array('create_course');
2929

3030
// Loading the global initialization file, Chamilo LMS.
3131
require_once '../../../../../../global.inc.php';
3232

33+
// Disabling access for anonymous users.
34+
api_block_anonymous_users();
35+
3336
// Initialization of the repositories.
3437
require_once api_get_path(LIBRARY_PATH).'fckeditor/repository.php' ;
3538

36-
global $Config ;
39+
global $Config;
3740

3841
// SECURITY: You must explicitly enable this "connector". (Set it to "true").
3942
// WARNING: don't just set "$Config['Enabled'] = true ;", you must be sure that only
4043
// authenticated users can access this file or use some kind of session checking.
4144
$Config['Enabled'] = true ;
4245

43-
4446
// Path to user files relative to the document root.
45-
//$Config['UserFilesPath']
47+
$Config['UserFilesPath'] = null;
48+
49+
$userId = api_get_user_id();
50+
51+
4652
if (api_is_in_course()) {
47-
if (!api_is_in_group()) {
48-
// 1. We are inside a course and not in a group.
49-
if (api_is_allowed_to_edit()) {
50-
$Config['UserFilesPath'] = api_get_path(REL_COURSE_PATH).api_get_course_path().'/document/';
51-
} else {
52-
// 1.2. Student
53-
$current_session_id = api_get_session_id();
54-
if($current_session_id==0)
55-
{
56-
$Config['UserFilesPath'] = api_get_path(REL_COURSE_PATH).api_get_course_path().'/document/shared_folder/sf_user_'.api_get_user_id().'/';
57-
}
58-
else
59-
{
60-
$Config['UserFilesPath'] = api_get_path(REL_COURSE_PATH).api_get_course_path().'/document/shared_folder_session_'.$current_session_id.'/sf_user_'.api_get_user_id().'/';
61-
}
62-
}
63-
} else {
64-
// 2. Inside a course and inside a group.
65-
global $group_properties;
66-
$Config['UserFilesPath'] = api_get_path(REL_COURSE_PATH).api_get_course_path().'/document'.$group_properties['directory'].'/';
67-
}
53+
$coursePath = api_get_path(REL_COURSE_PATH).api_get_course_path();
54+
if (!api_is_in_group()) {
55+
// 1. We are inside a course and not in a group.
56+
if (api_is_allowed_to_edit()) {
57+
$Config['UserFilesPath'] = $coursePath.'/document/';
58+
} else {
59+
// 1.2. Student
60+
$current_session_id = api_get_session_id();
61+
if ($current_session_id == 0) {
62+
$Config['UserFilesPath'] = $coursePath.'/document/shared_folder/sf_user_'.$userId.'/';
63+
} else {
64+
$Config['UserFilesPath'] = $coursePath.'/document/shared_folder_session_'.$current_session_id.'/sf_user_'.$userId.'/';
65+
}
66+
}
67+
} else {
68+
$groupId = api_get_group_id();
69+
$groupInfo = GroupManager::get_group_properties($groupId);
70+
if (!empty($groupInfo)) {
71+
// 2. Inside a course and inside a group.
72+
$Config['UserFilesPath'] = $coursePath.'/document'.$groupInfo['directory'].'/';
73+
}
74+
}
6875
} else {
69-
if (api_is_platform_admin() && $_SESSION['this_section'] == 'platform_admin') {
70-
// 3. Platform administration activities.
71-
$Config['UserFilesPath'] = api_get_path(REL_PATH).'home/default_platform_document/';
72-
} else {
73-
// 4. The user is outside courses.
74-
$my_path = UserManager::get_user_picture_path_by_id(api_get_user_id(),'rel');
75-
$Config['UserFilesPath'] = $my_path['dir'].'my_files/';
76-
}
76+
if (api_is_platform_admin() && $_SESSION['this_section'] == 'platform_admin') {
77+
// 3. Platform administration activities.
78+
$Config['UserFilesPath'] = api_get_path(REL_PATH).'home/default_platform_document/';
79+
} else {
80+
// 4. The user is outside courses.
81+
$my_path = UserManager::get_user_picture_path_by_id($userId, 'rel');
82+
$Config['UserFilesPath'] = $my_path['dir'].'my_files/';
83+
}
7784
}
7885

86+
if (empty($Config['UserFilesPath'])) {
87+
api_not_allowed(true);
88+
}
7989

8090
// Fill the following value it you prefer to specify the absolute path for the
8191
// user files directory. Useful if you are using a virtual directory, symbolic
8292
// link or alias. Examples: 'C:\\MySite\\userfiles\\' or '/root/mysite/userfiles/'.
8393
// Attention: The above 'UserFilesPath' must point to the same directory.
84-
$Config['UserFilesAbsolutePath'] = rtrim(api_get_path(SYS_SERVER_ROOT_PATH), '/') . $Config['UserFilesPath'] ;
94+
$Config['UserFilesAbsolutePath'] = rtrim(api_get_path(SYS_SERVER_ROOT_PATH), '/').$Config['UserFilesPath'];
8595

8696
// Due to security issues with Apache modules, it is recommended to leave the
8797
// following setting enabled.
88-
$Config['ForceSingleExtension'] = true ;
98+
$Config['ForceSingleExtension'] = true;
8999

90100
// Perform additional checks for image files.
91101
// If set to true, validate image size (using getimagesize).
92102
$Config['SecureImageUploads'] = true;
93103

94104
// What the user can do with this connector.
95-
$Config['ConfigAllowedCommands'] = array('QuickUpload', 'FileUpload', 'GetFolders', 'GetFoldersAndFiles', 'CreateFolder') ;
105+
$Config['ConfigAllowedCommands'] = array('QuickUpload', 'FileUpload', 'GetFolders', 'GetFoldersAndFiles', 'CreateFolder');
96106

97107
// Allowed Resource Types.
98108
$Config['ConfigAllowedTypes'] = array('File', 'Audio', 'Images', 'Flash', 'Media', 'MP3', 'Video', 'Video/flv') ;
@@ -160,8 +170,7 @@
160170
$Config['QuickUploadAbsolutePath']['Image'] = $Config['UserFilesAbsolutePath'] ;
161171
into:
162172
$Config['QuickUploadPath']['Image'] = $Config['FileTypesPath']['Image'] ;
163-
$Config['QuickUploadAbsolutePath']['Image'] = $Config['FileTypesAbsolutePath']['Image'] ;
164-
173+
$Config['QuickUploadAbsolutePath']['Image'] = $Config['FileTypesAbsolutePath']['Image'];
165174
*/
166175

167176
// Files
@@ -220,5 +229,3 @@
220229
$Config['FileTypesAbsolutePath']['Video/flv'] = $Config['UserFilesAbsolutePath'] . 'video/flv/' ;
221230
$Config['QuickUploadPath']['Video/flv'] = $Config['UserFilesPath'] . 'video/flv/' ;
222231
$Config['QuickUploadAbsolutePath']['Video/flv'] = $Config['UserFilesAbsolutePath'] . 'video/flv/' ;
223-
224-
?>

main/inc/lib/fckeditor/editor/plugins/ImageManager/config.inc.php

Lines changed: 43 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -27,62 +27,54 @@
2727
in this directory and its subdirectories.
2828
*/
2929
$language_file = array('document');
30-
include '../../../../../../inc/global.inc.php';
30+
31+
require_once '../../../../../../inc/global.inc.php';
32+
api_block_anonymous_users();
33+
34+
// Disabling access for anonymous users.
35+
api_block_anonymous_users();
3136

3237
// Initialization of the repositories.
3338
require_once api_get_path(LIBRARY_PATH).'fckeditor/repository.php';
3439

40+
$userId = api_get_user_id();
41+
3542
// Choosing the repository to be used.
36-
if (api_is_in_course())
37-
{
38-
if (!api_is_in_group())
39-
{
40-
// 1. We are inside a course and not in a group.
41-
if (api_is_allowed_to_edit())
42-
{
43-
// 1.1. Teacher
44-
$IMConfig['base_dir'] = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/document/';
45-
$IMConfig['base_url'] = api_get_path(WEB_COURSE_PATH).api_get_course_path().'/document/';
46-
}
47-
else
48-
{
49-
// 1.2. Student
50-
$current_session_id = api_get_session_id();
51-
if($current_session_id==0)
52-
{
53-
$IMConfig['base_dir'] = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/document/shared_folder/sf_user_'.api_get_user_id().'/';
54-
$IMConfig['base_url'] = api_get_path(WEB_COURSE_PATH).api_get_course_path().'/document/shared_folder/sf_user_'.api_get_user_id().'/';
55-
}
56-
else
57-
{
58-
$IMConfig['base_dir'] = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/document/shared_folder_session_'.$current_session_id.'/sf_user_'.api_get_user_id().'/';
59-
$IMConfig['base_url'] = api_get_path(WEB_COURSE_PATH).api_get_course_path().'/document/shared_folder_session_'.$current_session_id.'/sf_user_'.api_get_user_id().'/';
60-
}
61-
}
62-
}
63-
else
64-
{
65-
// 2. Inside a course and inside a group.
66-
$IMConfig['base_dir'] = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/document'.$group_properties['directory'].'/';
67-
$IMConfig['base_url'] = api_get_path(WEB_COURSE_PATH).api_get_course_path().'/document'.$group_properties['directory'].'/';
68-
}
69-
}
70-
else
71-
{
72-
if (api_is_platform_admin() && $_SESSION['this_section'] == 'platform_admin')
73-
{
74-
// 3. Platform administration activities.
75-
$IMConfig['base_dir'] = $_configuration['root_sys'].'home/default_platform_document/';
76-
$IMConfig['base_url'] = $_configuration['root_web'].'home/default_platform_document/';
77-
}
78-
else
79-
{
80-
// 4. The user is outside courses.
81-
$my_path = UserManager::get_user_picture_path_by_id(api_get_user_id(),'system');
82-
$IMConfig['base_dir'] = $my_path['dir'].'my_files/';
83-
$my_path = UserManager::get_user_picture_path_by_id(api_get_user_id(),'web');
84-
$IMConfig['base_url'] = $my_path['dir'].'my_files/';
85-
}
43+
if (api_is_in_course()) {
44+
if (!api_is_in_group()) {
45+
// 1. We are inside a course and not in a group.
46+
if (api_is_allowed_to_edit()) {
47+
// 1.1. Teacher
48+
$IMConfig['base_dir'] = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/document/';
49+
$IMConfig['base_url'] = api_get_path(WEB_COURSE_PATH).api_get_course_path().'/document/';
50+
} else {
51+
// 1.2. Student
52+
$sessionId = api_get_session_id();
53+
if ($sessionId == 0) {
54+
$IMConfig['base_dir'] = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/document/shared_folder/sf_user_'.$userId.'/';
55+
$IMConfig['base_url'] = api_get_path(WEB_COURSE_PATH).api_get_course_path().'/document/shared_folder/sf_user_'.$userId.'/';
56+
} else {
57+
$IMConfig['base_dir'] = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/document/shared_folder_session_'.$sessionId.'/sf_user_'.$userId.'/';
58+
$IMConfig['base_url'] = api_get_path(WEB_COURSE_PATH).api_get_course_path().'/document/shared_folder_session_'.$sessionId.'/sf_user_'.$userId.'/';
59+
}
60+
}
61+
} else {
62+
// 2. Inside a course and inside a group.
63+
$IMConfig['base_dir'] = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/document'.$group_properties['directory'].'/';
64+
$IMConfig['base_url'] = api_get_path(WEB_COURSE_PATH).api_get_course_path().'/document'.$group_properties['directory'].'/';
65+
}
66+
} else {
67+
if (api_is_platform_admin() && $_SESSION['this_section'] == 'platform_admin') {
68+
// 3. Platform administration activities.
69+
$IMConfig['base_dir'] = $_configuration['root_sys'].'home/default_platform_document/';
70+
$IMConfig['base_url'] = $_configuration['root_web'].'home/default_platform_document/';
71+
} else {
72+
// 4. The user is outside courses.
73+
$my_path = UserManager::get_user_picture_path_by_id($userId, 'system');
74+
$IMConfig['base_dir'] = $my_path['dir'].'my_files/';
75+
$my_path = UserManager::get_user_picture_path_by_id($userId, 'web');
76+
$IMConfig['base_url'] = $my_path['dir'].'my_files/';
77+
}
8678
}
8779

8880
$IMConfig['server_name'] = $_SERVER['SERVER_NAME'];
@@ -91,11 +83,8 @@
9183
demo - when true, no saving is allowed
9284
*/
9385
$IMConfig['demo'] = false;
94-
9586
/*
96-
9787
Possible values: true, false
98-
9988
TRUE - If PHP on the web server is in safe mode, set this to true.
10089
SAFE MODE restrictions: directory creation will not be possible,
10190
only the GD library can be used, other libraries require

main/inc/lib/fckeditor/editor/plugins/MP3/fck_mp3.php

100644100755
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22
// name of the language file that needs to be included
33
$language_file = array('resourcelinker','document');
44
include('../../../../../../inc/global.inc.php');
5+
6+
// Disabling access for anonymous users.
7+
api_block_anonymous_users();
8+
59
?>
610
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
711
<html>

main/inc/lib/fckeditor/editor/plugins/ajaxfilemanager/inc/config.php

100644100755
Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,9 @@
1616
// Loading the global initialization file.
1717
require_once '../../../../../../inc/global.inc.php';
1818

19-
// Loading document repositories settings.
19+
api_block_anonymous_users();
2020

21+
// Loading document repositories settings.
2122
require_once api_get_path(LIBRARY_PATH).'fckeditor/repository.php';
2223

2324
//FILESYSTEM CONFIG
@@ -48,7 +49,6 @@ function secureFileName($input) {
4849
define('DIR_AJAX_EDIT_AREA', DIR_AJAX_JS.'edit_area'.DIRECTORY_SEPARATOR);
4950
define('DIR_LANG', DIR_AJAX_ROOT.'langs'.DIRECTORY_SEPARATOR);
5051

51-
5252
//Class Declarations
5353
define('CLASS_FILE', DIR_AJAX_INC.'class.file.php');
5454
define("CLASS_UPLOAD", DIR_AJAX_INC.'class.upload.php');
@@ -69,7 +69,6 @@ function secureFileName($input) {
6969

7070
require_once dirname(__FILE__).DIRECTORY_SEPARATOR.$configBaseFileName;
7171

72-
7372
// Loading the selected language file.
7473
require_once DIR_AJAX_LANGS.CONFIG_LANG_DEFAULT.".php";
7574

@@ -116,4 +115,4 @@ function secureFileName($input) {
116115
define('CONFIG_URL_LIST_LISTING', 'ajax_get_file_listing.php');
117116
define('CONFIG_URL_IMG_THUMBNAIL', $web_path.'ajax_image_thumbnail.php');
118117
define('CONFIG_URL_FILEnIMAGE_MANAGER', 'ajaxfilemanager.php');
119-
define('CONFIG_URL_FILE_PASTE', 'ajax_file_paste.php');
118+
define('CONFIG_URL_FILE_PASTE', 'ajax_file_paste.php');

0 commit comments

Comments
 (0)