Mibew/i18n
1
0
Fork 0
mirror of https://github.com/Mibew/i18n.git synced 2025-02-02 17:44:42 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

Make headers more safe

Browse Source
This commit is contained in:
Fedor A. Fetisov 2013-09-10 17:41:54 +04:00
parent b42f5bdd0d
commit f26af7f05d
9 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/messenger/webim/operator/agent.php
View File

@ -83,7 +83,7 @@ if (!isset($_GET['token'])) {
} }
$token = $thread['ltoken']; $token = $thread['ltoken'];
header("Location: $webimroot/operator/agent.php?thread=$threadid&token=$token&level=$remote_level"); header("Location: $webimroot/operator/agent.php?thread=" . intval($threadid) . "&token=" . intval($token) . "&level=" . urlencode($remote_level));
exit; exit;
} }

4
src/messenger/webim/operator/avatar.php
View File

@ -77,7 +77,7 @@ if (!$op) {
if ($opId && $avatar && $_SESSION["${mysqlprefix}operator"] && $operator['operatorid'] == $opId) { if ($opId && $avatar && $_SESSION["${mysqlprefix}operator"] && $operator['operatorid'] == $opId) {
$_SESSION["${mysqlprefix}operator"]['vcavatar'] = $avatar; $_SESSION["${mysqlprefix}operator"]['vcavatar'] = $avatar;
} }
header("Location: $webimroot/operator/avatar.php?op=$opId"); header("Location: $webimroot/operator/avatar.php?op=" . intval($opId));
exit; exit;
} else { } else {
$page['avatar'] = topage($op['vcavatar']); $page['avatar'] = topage($op['vcavatar']);
@ -86,7 +86,7 @@ if (!$op) {
} else { } else {
if (isset($_GET['delete']) && $_GET['delete'] == "true" && $canmodify) { if (isset($_GET['delete']) && $_GET['delete'] == "true" && $canmodify) {
update_operator_avatar($op['operatorid'], ''); update_operator_avatar($op['operatorid'], '');
header("Location: $webimroot/operator/avatar.php?op=$opId"); header("Location: $webimroot/operator/avatar.php?op=" . intval($opId));
exit; exit;
} }
$page['avatar'] = topage($op['vcavatar']); $page['avatar'] = topage($op['vcavatar']);

2
src/messenger/webim/operator/canned.php
View File

@ -110,7 +110,7 @@ if (isset($_GET['act']) && $_GET['act'] == 'delete') {
$link = connect(); $link = connect();
perform_query("delete from ${mysqlprefix}chatresponses where id = " . intval($key), $link); perform_query("delete from ${mysqlprefix}chatresponses where id = " . intval($key), $link);
mysql_close($link); mysql_close($link);
header("Location: $webimroot/operator/canned.php?lang=$lang&group=$groupid"); header("Location: $webimroot/operator/canned.php?lang=" . urlencode($lang) . "&group=" . intval($groupid));
exit; exit;
} }
} }

4
src/messenger/webim/operator/group.php
View File

@ -95,11 +95,11 @@ if (isset($_POST['name'])) {
if (count($errors) == 0) { if (count($errors) == 0) {
if (!$groupid) { if (!$groupid) {
$newdep = create_group($name, $description, $commonname, $commondescription, $email); $newdep = create_group($name, $description, $commonname, $commondescription, $email);
header("Location: $webimroot/operator/groupmembers.php?gid=" . $newdep['groupid']); header("Location: $webimroot/operator/groupmembers.php?gid=" . intval($newdep['groupid']));
exit; exit;
} else { } else {
update_group($groupid, $name, $description, $commonname, $commondescription, $email); update_group($groupid, $name, $description, $commonname, $commondescription, $email);
header("Location: $webimroot/operator/group.php?gid=$groupid&stored"); header("Location: $webimroot/operator/group.php?gid=" . intval($groupid) . "&stored");
exit; exit;
} }
} else { } else {

2
src/messenger/webim/operator/groupmembers.php
View File

@ -74,7 +74,7 @@ if (!$group) {
} }
update_group_members($groupid, $new_members); update_group_members($groupid, $new_members);
header("Location: $webimroot/operator/groupmembers.php?gid=$groupid&stored"); header("Location: $webimroot/operator/groupmembers.php?gid=" . intval($groupid) . "&stored");
exit; exit;
} }

2
src/messenger/webim/operator/login.php
View File

@ -30,7 +30,7 @@ if (isset($_POST['login']) && isset($_POST['password'])) {
if ($operator && isset($operator['vcpassword']) && $operator['vcpassword'] == md5($password)) { if ($operator && isset($operator['vcpassword']) && $operator['vcpassword'] == md5($password)) {
$target = $password == '' $target = $password == ''
? "$webimroot/operator/operator.php?op=" . $operator['operatorid'] ? "$webimroot/operator/operator.php?op=" . intval($operator['operatorid'])
: (isset($_SESSION['backpath']) : (isset($_SESSION['backpath'])
? $_SESSION['backpath'] ? $_SESSION['backpath']
: "$webimroot/operator/index.php"); : "$webimroot/operator/index.php");

4
src/messenger/webim/operator/operator.php
View File

@ -84,7 +84,7 @@ if (isset($_POST['login']) && isset($_POST['password'])) {
if (count($errors) == 0) { if (count($errors) == 0) {
if (!$opId) { if (!$opId) {
$newop = create_operator($login, $email, $jabber, $password, $localname, $commonname, $jabbernotify ? 1 : 0, ""); $newop = create_operator($login, $email, $jabber, $password, $localname, $commonname, $jabbernotify ? 1 : 0, "");
header("Location: $webimroot/operator/avatar.php?op=" . $newop['operatorid']); header("Location: $webimroot/operator/avatar.php?op=" . intval($newop['operatorid']));
exit; exit;
} else { } else {
update_operator($opId, $login, $email, $jabber, $password, $localname, $commonname, $jabbernotify ? 1 : 0); update_operator($opId, $login, $email, $jabber, $password, $localname, $commonname, $jabbernotify ? 1 : 0);
@ -97,7 +97,7 @@ if (isset($_POST['login']) && isset($_POST['password'])) {
exit; exit;
} }
} }
header("Location: $webimroot/operator/operator.php?op=$opId&stored"); header("Location: $webimroot/operator/operator.php?op=" . intval($opId) . "&stored");
exit; exit;
} }
} else { } else {

2
src/messenger/webim/operator/opgroups.php
View File

@ -64,7 +64,7 @@ if (!$op) {
} }
update_operator_groups($op['operatorid'], $new_groups); update_operator_groups($op['operatorid'], $new_groups);
header("Location: $webimroot/operator/opgroups.php?op=$opId&stored"); header("Location: $webimroot/operator/opgroups.php?op=" . intval($opId) . "&stored");
exit; exit;
} }
} }

2
src/messenger/webim/operator/permissions.php
View File

@ -62,7 +62,7 @@ if (!$op) {
if ($opId && $_SESSION["${mysqlprefix}operator"] && $operator['operatorid'] == $opId) { if ($opId && $_SESSION["${mysqlprefix}operator"] && $operator['operatorid'] == $opId) {
$_SESSION["${mysqlprefix}operator"]['iperm'] = $new_permissions; $_SESSION["${mysqlprefix}operator"]['iperm'] = $new_permissions;
} }
header("Location: $webimroot/operator/permissions.php?op=$opId&stored"); header("Location: $webimroot/operator/permissions.php?op=" . intval($opId) . "&stored");
exit; exit;
} }