goodspeed/Cloudlog
1
0
派生 0
代码 工单 合并请求 项目 版本发布 软件包 百科 动态 Actions

[Awards] Added xss_clean to all used inputs

浏览代码
这个提交包含在：
Andreas 2023-08-01 14:20:14 +02:00
父节点 25e62a2708
当前提交 1e82df7530
共有 1 个文件被更改，包括 80 次插入 和 80 次删除
显示统计信息 下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件

160
application/controllers/Awards.php
查看文件

@ -41,7 +41,7 @@ class Awards extends CI_Controller {
$this->load->model('modes'); $this->load->model('modes');
if($this->input->method() === 'post') { if($this->input->method() === 'post') {
$postdata['doks'] = $this->input->post('doks'); $postdata['doks'] = $this->security->xss_clean($this->input->post('doks'));
} else { } else {
$postdata['doks'] = 'both'; $postdata['doks'] = 'both';
} }
@ -53,7 +53,7 @@ class Awards extends CI_Controller {
if ($this->input->post('band') == 'All') { if ($this->input->post('band') == 'All') {
$bands = $data['worked_bands']; $bands = $data['worked_bands'];
} else { } else {
$bands[] = $this->input->post('band'); $bands[] = $this->security->xss_clean($this->input->post('band'));
} }
} else { } else {
$bands = $data['worked_bands']; $bands = $data['worked_bands'];
@ -62,13 +62,13 @@ class Awards extends CI_Controller {
$data['bands'] = $bands; $data['bands'] = $bands;
if($this->input->method() === 'post') { if($this->input->method() === 'post') {
$postdata['qsl'] = $this->input->post('qsl'); $postdata['qsl'] = $this->security->xss_clean($this->input->post('qsl'));
$postdata['lotw'] = $this->input->post('lotw'); $postdata['lotw'] = $this->security->xss_clean($this->input->post('lotw'));
$postdata['eqsl'] = $this->input->post('eqsl'); $postdata['eqsl'] = $this->security->xss_clean($this->input->post('eqsl'));
$postdata['worked'] = $this->input->post('worked'); $postdata['worked'] = $this->security->xss_clean($this->input->post('worked'));
$postdata['confirmed'] = $this->input->post('confirmed'); $postdata['confirmed'] = $this->security->xss_clean($this->input->post('confirmed'));
$postdata['band'] = $this->input->post('band'); $postdata['band'] = $this->security->xss_clean($this->input->post('band'));
$postdata['mode'] = $this->input->post('mode'); $postdata['mode'] = $this->security->xss_clean($this->input->post('mode'));
} else { } else {
$postdata['qsl'] = 1; $postdata['qsl'] = 1;
$postdata['lotw'] = 1; $postdata['lotw'] = 1;
@ -98,7 +98,7 @@ class Awards extends CI_Controller {
} }
public function dok_details_ajax(){ public function dok_details_ajax(){
$a = $this->input->post(); $a = $this->security->xss_clean($this->input->post());
$q = ""; $q = "";
foreach ($a as $key => $value) { foreach ($a as $key => $value) {
$q .= $key."=".$value.("(and)"); $q .= $key."=".$value.("(and)");
@ -141,7 +141,7 @@ class Awards extends CI_Controller {
$bands = $data['worked_bands']; $bands = $data['worked_bands'];
} }
else { else {
$bands[] = $this->input->post('band'); $bands[] = $this->security->xss_clean($this->input->post('band'));
} }
} }
else { else {
@ -151,22 +151,22 @@ class Awards extends CI_Controller {
$data['bands'] = $bands; // Used for displaying selected band(s) in the table in the view $data['bands'] = $bands; // Used for displaying selected band(s) in the table in the view
if($this->input->method() === 'post') { if($this->input->method() === 'post') {
$postdata['qsl'] = $this->input->post('qsl'); $postdata['qsl'] = $this->security->xss_clean($this->input->post('qsl'));
$postdata['lotw'] = $this->input->post('lotw'); $postdata['lotw'] = $this->security->xss_clean($this->input->post('lotw'));
$postdata['eqsl'] = $this->input->post('eqsl'); $postdata['eqsl'] = $this->security->xss_clean($this->input->post('eqsl'));
$postdata['worked'] = $this->input->post('worked'); $postdata['worked'] = $this->security->xss_clean($this->input->post('worked'));
$postdata['confirmed'] = $this->input->post('confirmed'); $postdata['confirmed'] = $this->security->xss_clean($this->input->post('confirmed'));
$postdata['notworked'] = $this->input->post('notworked'); $postdata['notworked'] = $this->security->xss_clean($this->input->post('notworked'));
$postdata['includedeleted'] = $this->input->post('includedeleted'); $postdata['includedeleted'] = $this->security->xss_clean($this->input->post('includedeleted'));
$postdata['Africa'] = $this->input->post('Africa'); $postdata['Africa'] = $this->security->xss_clean($this->input->post('Africa'));
$postdata['Asia'] = $this->input->post('Asia'); $postdata['Asia'] = $this->security->xss_clean($this->input->post('Asia'));
$postdata['Europe'] = $this->input->post('Europe'); $postdata['Europe'] = $this->security->xss_clean($this->input->post('Europe'));
$postdata['NorthAmerica'] = $this->input->post('NorthAmerica'); $postdata['NorthAmerica'] = $this->security->xss_clean($this->input->post('NorthAmerica'));
$postdata['SouthAmerica'] = $this->input->post('SouthAmerica'); $postdata['SouthAmerica'] = $this->security->xss_clean($this->input->post('SouthAmerica'));
$postdata['Oceania'] = $this->input->post('Oceania'); $postdata['Oceania'] = $this->security->xss_clean($this->input->post('Oceania'));
$postdata['Antarctica'] = $this->input->post('Antarctica'); $postdata['Antarctica'] = $this->security->xss_clean($this->input->post('Antarctica'));
$postdata['band'] = $this->input->post('band'); $postdata['band'] = $this->security->xss_clean($this->input->post('band'));
$postdata['mode'] = $this->input->post('mode'); $postdata['mode'] = $this->security->xss_clean($this->input->post('mode'));
} }
else { // Setting default values at first load of page else { // Setting default values at first load of page
$postdata['qsl'] = 1; $postdata['qsl'] = 1;
@ -214,8 +214,8 @@ class Awards extends CI_Controller {
public function vucc_band(){ public function vucc_band(){
$this->load->model('vucc'); $this->load->model('vucc');
$band = str_replace('"', "", $this->input->get("Band")); $band = str_replace('"', "", $this->security->xss_clean($this->input->get("Band")));
$type = str_replace('"', "", $this->input->get("Type")); $type = str_replace('"', "", $this->security->xss_clean($this->input->get("Type")));
$data['vucc_array'] = $this->vucc->vucc_details($band, $type); $data['vucc_array'] = $this->vucc->vucc_details($band, $type);
$data['type'] = $type; $data['type'] = $type;
@ -231,8 +231,8 @@ class Awards extends CI_Controller {
public function vucc_details_ajax(){ public function vucc_details_ajax(){
$this->load->model('logbook_model'); $this->load->model('logbook_model');
$gridsquare = str_replace('"', "", $this->input->post("Gridsquare")); $gridsquare = str_replace('"', "", $this->security->xss_clean($this->input->post("Gridsquare")));
$band = str_replace('"', "", $this->input->post("Band")); $band = str_replace('"', "", $this->security->xss_clean($this->input->post("Band")));
$data['results'] = $this->logbook_model->vucc_qso_details($gridsquare, $band); $data['results'] = $this->logbook_model->vucc_qso_details($gridsquare, $band);
// Render Page // Render Page
@ -247,11 +247,11 @@ class Awards extends CI_Controller {
public function qso_details_ajax(){ public function qso_details_ajax(){
$this->load->model('logbook_model'); $this->load->model('logbook_model');
$searchphrase = str_replace('"', "", $this->input->post("Searchphrase")); $searchphrase = str_replace('"', "", $this->security->xss_clean($this->input->post("Searchphrase")));
$band = str_replace('"', "", $this->input->post("Band")); $band = str_replace('"', "", $this->security->xss_clean($this->input->post("Band")));
$mode = str_replace('"', "", $this->input->post("Mode")); $mode = str_replace('"', "", $this->security->xss_clean($this->input->post("Mode")));
$type = $this->input->post('Type'); $type = $this->security->xss_clean($this->input->post('Type'));
$qsl = $this->input->post('QSL') == null ? '' : $this->input->post('QSL'); $qsl = $this->input->post('QSL') == null ? '' : $this->security->xss_clean($this->input->post('QSL'));
$data['results'] = $this->logbook_model->qso_details($searchphrase, $band, $mode, $type, $qsl); $data['results'] = $this->logbook_model->qso_details($searchphrase, $band, $mode, $type, $qsl);
@ -361,14 +361,14 @@ class Awards extends CI_Controller {
$data['bands'] = $bands; // Used for displaying selected band(s) in the table in the view $data['bands'] = $bands; // Used for displaying selected band(s) in the table in the view
if($this->input->method() === 'post') { if($this->input->method() === 'post') {
$postdata['qsl'] = $this->input->post('qsl'); $postdata['qsl'] = $this->security->xss_clean($this->input->post('qsl'));
$postdata['lotw'] = $this->input->post('lotw'); $postdata['lotw'] = $this->security->xss_clean($this->input->post('lotw'));
$postdata['eqsl'] = $this->input->post('eqsl'); $postdata['eqsl'] = $this->security->xss_clean($this->input->post('eqsl'));
$postdata['worked'] = $this->input->post('worked'); $postdata['worked'] = $this->security->xss_clean($this->input->post('worked'));
$postdata['confirmed'] = $this->input->post('confirmed'); $postdata['confirmed'] = $this->security->xss_clean($this->input->post('confirmed'));
$postdata['notworked'] = $this->input->post('notworked'); $postdata['notworked'] = $this->security->xss_clean($this->input->post('notworked'));
$postdata['band'] = $this->input->post('band'); $postdata['band'] = $this->security->xss_clean($this->input->post('band'));
$postdata['mode'] = $this->input->post('mode'); $postdata['mode'] = $this->security->xss_clean($this->input->post('mode'));
} }
else { // Setting default values at first load of page else { // Setting default values at first load of page
$postdata['qsl'] = 1; $postdata['qsl'] = 1;
@ -411,7 +411,7 @@ class Awards extends CI_Controller {
$bands = $data['worked_bands']; $bands = $data['worked_bands'];
} }
else { else {
$bands[] = $this->input->post('band'); $bands[] = $this->security->xss_clean($this->input->post('band'));
} }
} }
else { else {
@ -421,14 +421,14 @@ class Awards extends CI_Controller {
$data['bands'] = $bands; // Used for displaying selected band(s) in the table in the view $data['bands'] = $bands; // Used for displaying selected band(s) in the table in the view
if($this->input->method() === 'post') { if($this->input->method() === 'post') {
$postdata['qsl'] = $this->input->post('qsl'); $postdata['qsl'] = $this->security->xss_clean($this->input->post('qsl'));
$postdata['lotw'] = $this->input->post('lotw'); $postdata['lotw'] = $this->security->xss_clean($this->input->post('lotw'));
$postdata['eqsl'] = $this->input->post('eqsl'); $postdata['eqsl'] = $this->security->xss_clean($this->input->post('eqsl'));
$postdata['worked'] = $this->input->post('worked'); $postdata['worked'] = $this->security->xss_clean($this->input->post('worked'));
$postdata['confirmed'] = $this->input->post('confirmed'); $postdata['confirmed'] = $this->security->xss_clean($this->input->post('confirmed'));
$postdata['notworked'] = $this->input->post('notworked'); $postdata['notworked'] = $this->security->xss_clean($this->input->post('notworked'));
$postdata['band'] = $this->input->post('band'); $postdata['band'] = $this->security->xss_clean($this->input->post('band'));
$postdata['mode'] = $this->input->post('mode'); $postdata['mode'] = $this->security->xss_clean($this->input->post('mode'));
} }
else { // Setting default values at first load of page else { // Setting default values at first load of page
$postdata['qsl'] = 1; $postdata['qsl'] = 1;
@ -463,7 +463,7 @@ class Awards extends CI_Controller {
$bands = $data['worked_bands']; $bands = $data['worked_bands'];
} }
else { else {
$bands[] = $this->input->post('band'); $bands[] = $this->security->xss_clean($this->input->post('band'));
} }
} }
else { else {
@ -474,19 +474,19 @@ class Awards extends CI_Controller {
$data['modes'] = $this->modes->active(); // Used in the view for mode select $data['modes'] = $this->modes->active(); // Used in the view for mode select
if($this->input->method() === 'post') { if($this->input->method() === 'post') {
$postdata['worked'] = $this->input->post('worked'); $postdata['worked'] = $this->security->xss_clean($this->input->post('worked'));
$postdata['confirmed'] = $this->input->post('confirmed'); $postdata['confirmed'] = $this->security->xss_clean($this->input->post('confirmed'));
$postdata['notworked'] = $this->input->post('notworked'); $postdata['notworked'] = $this->security->xss_clean($this->input->post('notworked'));
$postdata['includedeleted'] = $this->input->post('includedeleted'); $postdata['includedeleted'] = $this->security->xss_clean($this->input->post('includedeleted'));
$postdata['Africa'] = $this->input->post('Africa'); $postdata['Africa'] = $this->security->xss_clean($this->input->post('Africa'));
$postdata['Asia'] = $this->input->post('Asia'); $postdata['Asia'] = $this->security->xss_clean($this->input->post('Asia'));
$postdata['Europe'] = $this->input->post('Europe'); $postdata['Europe'] = $this->security->xss_clean($this->input->post('Europe'));
$postdata['NorthAmerica'] = $this->input->post('NorthAmerica'); $postdata['NorthAmerica'] = $this->security->xss_clean($this->input->post('NorthAmerica'));
$postdata['SouthAmerica'] = $this->input->post('SouthAmerica'); $postdata['SouthAmerica'] = $this->security->xss_clean($this->input->post('SouthAmerica'));
$postdata['Oceania'] = $this->input->post('Oceania'); $postdata['Oceania'] = $this->security->xss_clean($this->input->post('Oceania'));
$postdata['Antarctica'] = $this->input->post('Antarctica'); $postdata['Antarctica'] = $this->security->xss_clean($this->input->post('Antarctica'));
$postdata['band'] = $this->input->post('band'); $postdata['band'] = $this->security->xss_clean($this->input->post('band'));
$postdata['mode'] = $this->input->post('mode'); $postdata['mode'] = $this->security->xss_clean($this->input->post('mode'));
} }
else { // Setting default values at first load of page else { // Setting default values at first load of page
$postdata['worked'] = 1; $postdata['worked'] = 1;
@ -528,8 +528,8 @@ class Awards extends CI_Controller {
public function counties_details() { public function counties_details() {
$this->load->model('counties'); $this->load->model('counties');
$state = str_replace('"', "", $this->input->get("State")); $state = str_replace('"', "", $this->security->xss_clean($this->input->get("State")));
$type = str_replace('"', "", $this->input->get("Type")); $type = str_replace('"', "", $this->security->xss_clean($this->input->get("Type")));
$data['counties_array'] = $this->counties->counties_details($state, $type); $data['counties_array'] = $this->counties->counties_details($state, $type);
$data['type'] = $type; $data['type'] = $type;
@ -544,8 +544,8 @@ class Awards extends CI_Controller {
public function counties_details_ajax(){ public function counties_details_ajax(){
$this->load->model('logbook_model'); $this->load->model('logbook_model');
$state = str_replace('"', "", $this->input->post("State")); $state = str_replace('"', "", $this->security->xss_clean($this->input->post("State")));
$county = str_replace('"', "", $this->input->post("County")); $county = str_replace('"', "", $this->security->xss_clean($this->input->post("County")));
$data['results'] = $this->logbook_model->county_qso_details($state, $county); $data['results'] = $this->logbook_model->county_qso_details($state, $county);
// Render Page // Render Page
@ -578,7 +578,7 @@ class Awards extends CI_Controller {
// Grab all worked sig stations // Grab all worked sig stations
$this->load->model('sig'); $this->load->model('sig');
$type = str_replace('"', "", $this->input->get("type")); $type = str_replace('"', "", $this->security->xss_clean($this->input->get("type")));
$data['sig_all'] = $this->sig->get_all($type); $data['sig_all'] = $this->sig->get_all($type);
$data['type'] = $type; $data['type'] = $type;
@ -598,7 +598,7 @@ class Awards extends CI_Controller {
$this->load->model('adif_data'); $this->load->model('adif_data');
$type = $this->uri->segment(3); $type = $this->security->xss_clean($this->uri->segment(3));
$data['qsos'] = $this->adif_data->sig_all($type); $data['qsos'] = $this->adif_data->sig_all($type);
$this->load->view('adif/data/exportall', $data); $this->load->view('adif/data/exportall', $data);
@ -652,8 +652,8 @@ class Awards extends CI_Controller {
$postdata['worked'] = $this->input->post('worked') == 0 ? NULL: 1; $postdata['worked'] = $this->input->post('worked') == 0 ? NULL: 1;
$postdata['confirmed'] = $this->input->post('confirmed') == 0 ? NULL: 1; $postdata['confirmed'] = $this->input->post('confirmed') == 0 ? NULL: 1;
$postdata['notworked'] = $this->input->post('notworked') == 0 ? NULL: 1; $postdata['notworked'] = $this->input->post('notworked') == 0 ? NULL: 1;
$postdata['band'] = $this->input->post('band'); $postdata['band'] = $this->security->xss_clean($this->input->post('band'));
$postdata['mode'] = $this->input->post('mode'); $postdata['mode'] = $this->security->xss_clean($this->input->post('mode'));
if ($logbooks_locations_array) { if ($logbooks_locations_array) {
$location_list = "'".implode("','",$logbooks_locations_array)."'"; $location_list = "'".implode("','",$logbooks_locations_array)."'";
@ -685,7 +685,7 @@ class Awards extends CI_Controller {
header('Content-Type: application/json'); header('Content-Type: application/json');
echo json_encode($zones); echo json_encode($zones);
} }
/* /*
function dxcc_map function dxcc_map
This displays the DXCC map This displays the DXCC map
@ -694,7 +694,7 @@ class Awards extends CI_Controller {
$this->load->model('dxcc'); $this->load->model('dxcc');
$this->load->model('bands'); $this->load->model('bands');
$bands[] = $this->input->post('band'); $bands[] = $this->security->xss_clean($this->input->post('band'));
$postdata['qsl'] = $this->input->post('qsl') == 0 ? NULL: 1; $postdata['qsl'] = $this->input->post('qsl') == 0 ? NULL: 1;
$postdata['lotw'] = $this->input->post('lotw') == 0 ? NULL: 1; $postdata['lotw'] = $this->input->post('lotw') == 0 ? NULL: 1;
@ -702,8 +702,8 @@ class Awards extends CI_Controller {
$postdata['worked'] = $this->input->post('worked') == 0 ? NULL: 1; $postdata['worked'] = $this->input->post('worked') == 0 ? NULL: 1;
$postdata['confirmed'] = $this->input->post('confirmed') == 0 ? NULL: 1; $postdata['confirmed'] = $this->input->post('confirmed') == 0 ? NULL: 1;
$postdata['notworked'] = $this->input->post('notworked') == 0 ? NULL: 1; $postdata['notworked'] = $this->input->post('notworked') == 0 ? NULL: 1;
$postdata['band'] = $this->input->post('band'); $postdata['band'] = $this->security->xss_clean($this->input->post('band'));
$postdata['mode'] = $this->input->post('mode'); $postdata['mode'] = $this->security->xss_clean($this->input->post('mode'));
$postdata['includedeleted'] = $this->input->post('includedeleted') == 0 ? NULL: 1; $postdata['includedeleted'] = $this->input->post('includedeleted') == 0 ? NULL: 1;
$postdata['Africa'] = $this->input->post('Africa') == 0 ? NULL: 1; $postdata['Africa'] = $this->input->post('Africa') == 0 ? NULL: 1;
$postdata['Asia'] = $this->input->post('Asia') == 0 ? NULL: 1; $postdata['Asia'] = $this->input->post('Asia') == 0 ? NULL: 1;
@ -743,7 +743,7 @@ class Awards extends CI_Controller {
$this->load->model('iota'); $this->load->model('iota');
$this->load->model('bands'); $this->load->model('bands');
$bands[] = $this->input->post('band'); $bands[] = $this->security->xss_clean($this->input->post('band'));
$postdata['lotw'] = $this->input->post('lotw') == 0 ? NULL: 1; $postdata['lotw'] = $this->input->post('lotw') == 0 ? NULL: 1;
$postdata['qsl'] = $this->input->post('qsl') == 0 ? NULL: 1; $postdata['qsl'] = $this->input->post('qsl') == 0 ? NULL: 1;