Congegni/sintonia
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'saas-dev' into soundcloud

Browse source
This commit is contained in:
Duncan Sommerville 2015-06-18 13:29:59 -04:00
commit 02e0537be9
13 changed files with 54 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

8
airtime_mvc/application/common/ProvisioningHelper.php
View file

@ -112,8 +112,12 @@ class ProvisioningHelper
$this->dbowner = $_POST['dbowner'];
$this->instanceId = $_POST['instanceid'];
$this->stationName = $_POST['station_name'];
$this->description = $_POST['description'];
if (isset($_POST['station_name'])) {
$this->stationName = $_POST['station_name'];
}
if (isset($_POST['description'])) {
$this->description = $_POST['description'];
}
}
/**

16
airtime_mvc/application/common/SecurityHelper.php
View file

@ -1,11 +1,15 @@
<?php
/**
* Created by PhpStorm.
* User: asantoni
* Date: 12/06/15
* Time: 12:24 PM
*/
class SecurityHelper {
public static function htmlescape_recursive(&$arr) {
foreach ($arr as $key => $val) {
if (is_array($val)) {
self::htmlescape_recursive($arr[$key]);
} else if (is_string($val)) {
$arr[$key] = htmlspecialchars($val, ENT_QUOTES);
}
}
return $arr;
}
}

44
airtime_mvc/application/common/WidgetHelper.php
View file

@ -46,13 +46,14 @@ class WidgetHelper
);
$result[$dow[$i]] = $shows;
// XSS exploit prevention
self::convertSpecialChars($result, array("name", "url"));
// convert image paths to point to api endpoints
self::findAndConvertPaths($result);
}
// XSS exploit prevention
SecurityHelper::htmlescape_recursive($result);
// convert image paths to point to api endpoints
self::findAndConvertPaths($result);
return $result;
}
@ -124,37 +125,18 @@ class WidgetHelper
}
$result[$weekCounter][$dayOfWeekCounter]["shows"] = $shows;
// XSS exploit prevention
self::convertSpecialChars($result, array("name", "url"));
// convert image paths to point to api endpoints
self::findAndConvertPaths($result);
}
$weekCounter += 1;
}
return $result;
}
/**
* Go through a given array and sanitize any potentially exploitable fields
* by passing them through htmlspecialchars
*
* @param unknown $arr the array to sanitize
* @param unknown $keys indexes of values to be sanitized
*/
public static function convertSpecialChars(&$arr, $keys)
{
foreach ($arr as &$a) {
if (is_array($a)) {
foreach ($keys as &$key) {
if (array_key_exists($key, $a)) {
$a[$key] = htmlspecialchars($a[$key]);
}
}
self::convertSpecialChars($a, $keys);
}
}
// XSS exploit prevention
SecurityHelper::htmlescape_recursive($result);
// convert image paths to point to api endpoints
self::findAndConvertPaths($result);
return $result;
}
/**