c_schmitz
2012-03-06 00:36
administrator
~17736
Last edited: 2012-03-06 00:37
|
Not a security issue.
Shubhab, there is some strange function js2php used in updateset.js which crashes on a single quite(')
Can you check if this contruct can rather be replaced with a jQuery serialize() and modify it accordingly?
Or find some other way way to fix the quote issue.
Thank you! |
|
|
|
I noticed that not only single quotes (') are a problem but also double quotes ("). |
|
|
|
Hello,
editanswer and editsubquestion are OK.
Maybe use same function for label se edition is a good option.
Denis |
|
magiclko
2012-03-08 13:42
reporter
~17788
|
Fixed in rev rc1ede9c - http://git.io/_PLpSw |
|
|
|
I made the changes in the three files as indicated in above link.
It does not seem to work for me.
In fact, with the changes no data at all can be saved with or without quotes... |
|
magiclko
2012-03-09 09:13
reporter
~17797
|
hugomp - version you are using? it works fine here! |
|
|
|
Remember to clear your browser cache. |
|
|
|
I tried again:
The changes made:
label.php:
//$data =json_decode(stripslashes($_POST['dataToSend']));
$data = json_decode(html_entity_decode($_POST['dataToSend'], ENT_QUOTES,"UTF-8"));
admin_core.js:
//json += '"'+property+'":"'+value+'",'
//escape double quotes!
value = value.replace(/"/g, '\"'); //.replace(/'/g, '\\'')
json += '"'+property+'":"'+value+'",';
updateset.js:
//$("#mainform").append("<input type='hidden' name='dataToSend' //value='"+js2php(dataToSend)+"' />");
var encodedData = htmlspecialchars(js2php(dataToSend));
$("#mainform").append("<input type='hidden' name='dataToSend' value='"+encodedData+"' />");
does not work for me even after clearing browser cache...
I get the warning:
Warning: array_unique() [function.array-unique]: The argument should be an array in /mnt/sites/pre-sales.ch/web/limesurvey/admin/labels.php on line 611
I am using version 1.92 |
|
magiclko
2012-03-09 16:32
reporter
~17806
|
hugomp : add this line
echo $_POST['dataToSend'];
above line no. 611 in admin/labels.php and tell me what do you get. |
|
|
|
Here it is:
{\"langs\":[\"fr\"],\"codelist\":[\"0\",\"1\"],\"0\":{\"code\":\"1\",\"assessmentvalue\":\"0\",\"text_fr\":\"d\'accord\"},\"1\":{\"code\":\"2\",\"assessmentvalue\":\"0\",\"text_fr\":\"pas d\'accord\"}}
|
|
magiclko
2012-03-09 18:20
reporter
~17809
|
weird, i'm only escaping value and not property!
I'll have a look again. |
|
|
|
Here is the site setting: http://www.pre-sales.ch/phpinfo.php
Could this have something to do with "magic quotes" and/or the french language? |
|
magiclko
2012-03-09 20:30
reporter
~17811
|
Most probably, it's "magic_quotes_gpc=on". try setting it to off and it'll work i guess! |
|
|
|
I have no access to php.ini but putting this code:
if (get_magic_quotes_gpc()) {
$process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
while (list($key, $val) = each($process)) {
foreach ($val as $k => $v) {
unset($process[$key][$k]);
if (is_array($v)) {
$process[$key][stripslashes($k)] = $v;
$process[] = &$process[$key][stripslashes($k)];
} else {
$process[$key][stripslashes($k)] = stripslashes($v);
}
}
}
unset($process);
}
at the top of the admin.php file...
...I can normally save label data WITHOUT any quote in the text (like before the changes) but putting quotes in it produces this time a MySql error.
Following "echo $_POST['dataToSend'];" I get:
{"langs":["fr"],"codelist":["0","new74039"],"0":{"code":"1","assessmentvalue":"0","text_fr":"d'accord"},"new74039":{"code":"2","assessmentvalue":"0","text_fr":"pas d'accord"}}
MySql error:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'accord','0',0,'fr')' at line 2:INSERT INTO lime_labels (lid,code,title,sortorder, assessment_value, language) VALUES(5,'1','d'accord','0',0,'fr')
Wouldn't it make sens in the general coding of LimeSurvey to foresee both possibilities: 1)magic quotes on and 2)magic quotes off? Many providers with shared Apache Servers do not give access to php.ini. |
|
|
|
A solution to eliminate the MySql error is for me:
$title = substr($title, 1, -1);
$title = str_replace("'","\'",$title);
$query = "INSERT INTO ".db_table_name('labels')." (lid,code,title,sortorder, assessment_value, language)
VALUES({$lid},{$actualcode},'{$title}',{$sort_order},{$assessmentvalue},{$lang})";
in labels.php around line 650 before and for the INSERT statament |
|
|
|
1.92+ Build 120211 released |
|
