The committertools stats webpage is sensitive to XSS fix: https://gitlab.eclipse.org/eclipsefdn/infrazilla/-/issues/1401 Change-Id: I259d5bd8fbcab88addbe1f13673ed358cabb158c Signed-off-by: Christopher Guindon <chris.guindon@eclipse-foundation.org>
diff --git a/committers/committertools/inc/en_cq_common.php b/committers/committertools/inc/en_cq_common.php index b1e5f84..0620261 100755 --- a/committers/committertools/inc/en_cq_common.php +++ b/committers/committertools/inc/en_cq_common.php
@@ -16,10 +16,10 @@ $Menu = new Menu("en"); - include("../modules/menu.php"); - + include("../modules/menu.php"); + $strRequired = "<font class=\"red\">*</font>"; - + ?> <br /> <td width="100%" valign="top" class="normal"> @@ -29,7 +29,7 @@ <tr> <td colspan="2">September 27, 2006</td></tr> <tr><td width="22%"> </td><td></td></tr> - + <tr><td colspan="2"><strong>Committer</strong><br></td></tr> <tr> <td colspan="2">Please choose the committer who will be incorporating this contribution into the code base. This is most likely yourself.</td> @@ -47,7 +47,7 @@ } ?> - <option value="<?= $myrow['userid'] ?>" <?= $strSelected ?>><?= $myrow['realname'] ?></option> + <option value="<?php echo $App->checkPlain($myrow['userid']); ?>" <?= $strSelected ?>><?php echo $App->checkPlain($myrow['realname']); ?></option> <?php } ?> @@ -65,7 +65,7 @@ <?php while($myrow = mysql_fetch_assoc($rs_projectleads)) { ?> - <option value="<?= $myrow['userid'] ?>"><?= $myrow['realname'] ?></option> + <option value="<?php echo $App->checkPlain($myrow['userid']); ?>"><?php echo $App->checkPlain($myrow['realname']); ?></option> <?php } ?> @@ -77,7 +77,7 @@ <tr> <td colspan="2">Please provide details about the contribution</td> </tr> - <tr> + <tr> <td>Project <?= $strRequired ?></td> <td> <select name="component_id"> @@ -85,7 +85,7 @@ <?php while($myrow = mysql_fetch_assoc($rs_components)) { ?> - <option value="<?= $myrow['product_id'] ?>|<?= $myrow['id'] ?>"><?= $myrow['name'] ?></option> + <option value="<?php echo $App->checkPlain($myrow['product_id'] . '|' . $myrow['id']); ?>"><?php echo $App->checkPlain($myrow['name']); ?></option> <?php } ?> @@ -106,9 +106,9 @@ <tr> <td valign="top"><p>Provide any additional information you may have regarding intellectual property rights (patents, trademarks, etc.) related to the Contribution.</td> <td><textarea cols="60" rows="10" name="contributionSupportInfo"></textarea></td> - </tr> - - + </tr> + + <tr><td> </td></tr> <tr> <td colspan="2"><strong>Cryptography</strong><br></td></tr><br>
diff --git a/committers/committertools/inc/en_cq_part2.php b/committers/committertools/inc/en_cq_part2.php index 02fc11b..87dfcc0 100755 --- a/committers/committertools/inc/en_cq_part2.php +++ b/committers/committertools/inc/en_cq_part2.php
@@ -17,40 +17,40 @@ $Menu = new Menu("en"); include("../modules/menu.php"); - + $pkgCount = 0; - - $strRequired = "<font class=\"red\">*</font>"; - + + $strRequired = "<font class=\"red\">*</font>"; + ?> <br /> <td width="100%" valign="top" class="normal"> <font class="large_title">Contribution Questionnaire - Third-party Packages</font><br /><br /> - + <table border=0 cellspacing=5 cellpadding=2 width="100%" > <tr><td> <form name="form1" method="post" action="cq_post.php"> - + <table width="100%" border="0"> <tr> <td colspan="2"><p><strong>3rd Party Package Information</strong></p><br /></td> </tr> <?php - + for($i = 0; $i < count($pkgList); $i++) { if($pkgList[$i] != "") { $pkgCount++; - + if($i > 0) { echo "<tr><td> </td></tr>"; echo "<tr><td colspan=2><hr /></td></tr>"; echo "<tr><td> </td></tr>"; } -?> +?> <tr> <td width="22%">Package Name: <?= $strRequired ?> </td> - <td width="78%"><input type="text" size="60" name="pkgName<?= $i ?>" value="<?= $pkgList[$i] ?>" /> + <td width="78%"><input type="text" size="60" name="pkgName<?= $i ?>" value="<?php echo $App->checkPlain($pkgList[$i]); ?>" /> </td> </tr> <tr> @@ -74,7 +74,7 @@ <tr> <td>License Name: <?= $strRequired ?> </td> <td><input type="text" size="60" name="pkgLicense<?= $i ?>" /> - </td> + </td> <tr> <td>Link to Package License: <?= $strRequired ?> </td> <td><input type="text" size="60" name="pkgLicenseType<?= $i ?>" /></td> @@ -98,7 +98,7 @@ } ?> - <option value="<?= $myrow['extern_id'] . "|" . $myrow['realname'] ?>" <?= $strSelected ?>><?= $myrow['realname'] ?></option> + <option value="<?php echo $App->checkPlain($myrow['extern_id'] . "|" . $myrow['realname']); ?>" <?= $strSelected ?>><?php echo $App->checkPlain($myrow['realname']); ?></option> <?php } ?> @@ -112,23 +112,23 @@ <tr><td colspan="2"> </td></tr> <br /> </table> - <input type="hidden" name="c" value="<?= $_ContributionID ?>" /> + <input type="hidden" name="c" value="<?php echo $App->checkPlain($_ContributionID); ?>" /> <input type="hidden" name="cqtype" value="nonepl" /> - <input type="hidden" name="projectlead_id" value="<?= $projectlead_id ?>" /> + <input type="hidden" name="projectlead_id" value="<?php echo $App->checkPlain($projectlead_id); ?>" /> <input type="button" name="Submit" value="Submit your questionnaire" onclick="fnValidForm();" /> </form> </td> - + <script language="javascript"> function fnValidForm() { - + for(i = 0; i < <?= $pkgCount ?>; i++) { document.form1.elements['pkgName' + i].className = ""; document.form1.elements['pkgVersion' + i].className = ""; document.form1.elements['pkgSource' + i].className = ""; document.form1.elements['pkgLicense' + i].className = ""; document.form1.elements['pkgLicenseType' + i].className = ""; - + if(document.form1.elements['pkgName' + i].value == "") { document.form1.elements['pkgName' + i].className = "inputInvalid"; document.form1.elements['pkgName' + i].focus(); @@ -162,7 +162,7 @@ } document.form1.submit(); } - + </script> <?php
diff --git a/committers/committertools/inc/en_project_category_list.php b/committers/committertools/inc/en_project_category_list.php index 5bc0a84..909d644 100755 --- a/committers/committertools/inc/en_project_category_list.php +++ b/committers/committertools/inc/en_project_category_list.php
@@ -15,10 +15,10 @@ include("../html/header.php"); $Menu = new Menu("en"); - + include("../modules/menu.php"); - + ?> <br /> <td width="100%" valign="top" class="normal"> @@ -27,9 +27,9 @@ <font class="large_title">Project category (Pillar) associations</font><br /><br /> Pillars are managed by the WebMaster. The purpose of these pillars is to groups projects for the many pillars and "By Topic" pages. Please be careful -- this is live stuff on our website!<br /><br /> - + <?= $ErrorMessage != "" ? "<font class='error'>" . $ErrorMessage . "</font>" : "" ?> - + <table width="100%" border="0" cellpadding="1" cellspacing="1"> <tr> <td width="50%"> @@ -42,16 +42,16 @@ <?php for($i = 0; $i < $ProjectList->getCount(); $i++) { $Project = $ProjectList->getItemAt($i); - + if($Project->getProjectID() != "root") { - + ?> - <option value="<?= $Project->getProjectID() ?>" <?= $strSelected ?>><?= $Project->getProjectID() ?></option> -<?php + <option value="<?php echo $App->checkPlain($Project->getProjectID()) ?>" <?= $strSelected ?>><?= $Project->getProjectID() ?></option> +<?php } } -?> +?> </select> </td> </tr> @@ -62,15 +62,15 @@ <?php for($i = 0; $i < $CategoryList->getCount(); $i++) { $Category = $CategoryList->getItemAt($i); - - + + ?> - <option value="<?= $Category->getCategoryID() ?>" <?= $strSelected ?>><?= $Category->getCategoryShortname() ?></option> -<?php + <option value="<?php echo $App->checkPlain($Category->getCategoryID()); ?>" <?= $strSelected ?>><?= $Category->getCategoryShortname() ?></option> +<?php - } + } -?> +?> </select> </td> </tr> @@ -87,9 +87,9 @@ </tr> </table> </td> - + <td width="50%" valign="top"> - <table border="0" class="normal"> + <table border="0" class="normal"> <tr> <td valign="top">Descriptive Paragraph</td> <td><textarea name="long_description" rows="4" cols="40"></textarea> @@ -144,7 +144,7 @@ <tr height="1" class="menu_border"> <td colspan="7"></td> </tr> - + <?php } ?> @@ -162,9 +162,9 @@ <input type="hidden" name="state" value="save" /> </form> </td> - + <script language="javascript"> - + function fnValidForm() { if(document.form1.project_id.selectedIndex == 0) { alert("Please select a project.");
diff --git a/committers/committertools/inc/en_stats_criteria.php b/committers/committertools/inc/en_stats_criteria.php index a9e992e..802606f 100755 --- a/committers/committertools/inc/en_stats_criteria.php +++ b/committers/committertools/inc/en_stats_criteria.php
@@ -27,7 +27,7 @@ <option value="polarsys" <?php echo($_FORGE == "polarsys" ? "selected" : ""); ?>>download.polarsys.org</option> <option value="locationtech" <?php echo($_FORGE == "locationtech" ? "selected" : ""); ?>>download.locationtech.org</option> </select> - <input type="text" name="filename" size="25" value="<?= $_FILENAME ?>" maxlength="255" /> + <input type="text" name="filename" size="25" value="<?php echo $App->checkPlain($_FILENAME); ?>" maxlength="255" /> <a href="javascript:fnPopup('file');"><img src="../images/ico_help.gif" border="0" /></a></td> </tr> <tr> @@ -69,11 +69,11 @@ </tr> <tr> <td>Date From:</td> - <td><input type="text" name="datefrom" size="20" value="<?= $_DATEFROM ?>" maxlength="10" onchange="document.forms[0].view_date.selectedIndex = 5;" /> <a href="javascript:fnPopup('date');"><img src="../images/ico_help.gif" border="0" /></a></td> + <td><input type="text" name="datefrom" size="20" value="<?php echo $App->checkPlain($_DATEFROM); ?>" maxlength="10" onchange="document.forms[0].view_date.selectedIndex = 5;" /> <a href="javascript:fnPopup('date');"><img src="../images/ico_help.gif" border="0" /></a></td> </tr> <tr> <td>Date To:</td> - <td><input type="text" name="dateto" size="20" value="<?= $_DATETO ?>" maxlength="10" onchange="document.forms[0].view_date.selectedIndex=5;" /> <a href="javascript:fnPopup('date');"><img src="../images/ico_help.gif" border="0" /></a></td> + <td><input type="text" name="dateto" size="20" value="<?php echo $App->checkPlain($_DATETO); ?>" maxlength="10" onchange="document.forms[0].view_date.selectedIndex=5;" /> <a href="javascript:fnPopup('date');"><img src="../images/ico_help.gif" border="0" /></a></td> </tr> <tr> <td></td> @@ -97,14 +97,14 @@ </tr> </table> </form> - + <h2>Results</h2> <script language="javascript"> function fnPopup(_file){ var filename = 'inc/en_popup_' + _file + '.html'; window.open(filename, 'popup', 'toolbar=no,scrollbar=no,addressbar=no,width=500,height=400'); } - + document.forms['form1'].email.className = ""; function fnValidateForm() { // if(document.forms[0].email.value == "") { @@ -113,7 +113,7 @@ // document.forms[0].email.focus(); // return false; //} - document.forms['form1'].gobutton.value='Please wait a while...'; + document.forms['form1'].gobutton.value='Please wait a while...'; document.forms['form1'].gobutton.disabled=true; document.forms['form1'].submit(); }