blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-25 08:34:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Diverse SQL-Injection Lücken geschlossen

Browse Source
This commit is contained in:
Andreas Österreicher
2014-12-01 10:07:21 +00:00
parent 9325ebecbf
commit f670f45d2f
87 changed files with 4310 additions and 2015 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cis/testtool/admin/.htaccess
+1 -9
View File
@@ -3,15 +3,7 @@ AuthName "Technikum-Wien"
AuthType Basic
AuthBasicProvider ldap
AuthBasicAuthoritative Off
AuthLDAPURL "ldap://ldap.technikum-wien.at:389/ou=People,dc=technikum-wien,dc=at?uid?one?objectclass=posixAccount"
#AuthLDAPURL "ldap://ldap.technikum-wien.at:389/ou=People,dc=technikum,dc=at?uid?sub?(objectClass=*)"
AuthLDAPURL "ldap://localhost:389/ou=People,dc=oesi,dc=org?uid?one?objectclass=posixAccount"
AuthLDAPGroupAttributeIsDN Off
AuthLDAPGroupAttribute memberuid
Require ldap-group cn=fhadmin,ou=Group,dc=technikum-wien,dc=at
require ldap-group cn=hadesadm,ou=Group,dc=technikum-wien,dc=at
Require user pam
require user oesi
require user ruhan
Require user tw01e061
Require user if10b066
require ldap-user if10b066
cis/testtool/admin/auswertung_detail_prestudent.php
+2 -2
View File
@@ -45,7 +45,7 @@ echo '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//DE" "http://www
<script type="text/javascript" src="../../../include/js/jquery.js"></script>
</head>
<body class="Background_main">
<h2>Auswertung Reihungstest Detailergebnis PrestudentIn '.$_GET['prestudent_id'].'</h2>';
<h2>Auswertung Reihungstest Detailergebnis PrestudentIn '.$db->convert_html_chars($_GET['prestudent_id']).'</h2>';
if(!$rechte->isBerechtigt('basis/testtool', null, 'suid'))
die('Sie haben keine Berechtigung fuer diese Seite');
@@ -65,7 +65,7 @@ if(isset($_GET['prestudent_id']))
JOIN testtool.tbl_pruefling_frage ON (tbl_pruefling.pruefling_id=tbl_pruefling_frage.pruefling_id AND tbl_frage.frage_id =tbl_pruefling_frage.frage_id)
JOIN public.tbl_prestudent USING (prestudent_id)
JOIN public.tbl_person USING (person_id)
WHERE prestudent_id='".$_GET['prestudent_id']."'
WHERE prestudent_id=".$db->db_add_param($_GET['prestudent_id'], FHC_INTEGER)."
ORDER BY kurzbz,tbl_pruefling_frage.begintime,nummer";
if($result = $db->db_query($qry))
{
cis/testtool/admin/index.php
+5 -4
View File
@@ -91,8 +91,9 @@ else
$save_vorschlag_error=false;
/*<?xml-stylesheet type="text/xsl" href="../mathml.xsl"?>*/
echo '<?xml version="1.0" encoding="UTF-8"?>';
?>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN"
"http://www.w3.org/Math/DTD/mathml2/xhtml-math11-f.dtd">
@@ -174,7 +175,7 @@ if(isset($_GET['type']) && $_GET['type']=='changesprache')
}
if(!isset($_SESSION['sprache']))
$_SESSION['sprache']='German';
$_SESSION['sprache']=DEFAULT_LANGUAGE;
$sprache = $_SESSION['sprache'];
@@ -592,7 +593,7 @@ if (($anzahl!==0) || ($stg_kz=='-1') && ($stg_kz!==''))
echo '<br />';
// Liste der Fragen
$qry = "SELECT distinct nummer FROM testtool.tbl_frage WHERE gebiet_id='".addslashes($gebiet_id)."' ORDER BY nummer";
$qry = "SELECT distinct nummer FROM testtool.tbl_frage WHERE gebiet_id=".$db->db_add_param($gebiet_id)." ORDER BY nummer";
if($result = $db->db_query($qry))
{
@@ -752,7 +753,7 @@ if($frage_id!='')
echo '<b>Vorschlag'.($vorschlag_id!=''?' Edit':'').'</b><br /><br />';
echo "<form name='formular_vorschlag' method='POST' enctype='multipart/form-data' action='$PHP_SELF?gebiet_id=$gebiet_id&amp;stg_kz=$stg_kz&amp;nummer=$nummer&amp;frage_id=$frage_id'>";
echo "<input type='hidden' name='vorschlag_id' value='$vorschlag->vorschlag_id' />";
echo '<table>';
echo '<table>';
echo "<tr><td>Nummer:</td><td><input type='text' name='nummer' size='3' id='nummer' value='$vorschlag->nummer' />";
echo "<input type='button' value='1' onclick='document.getElementById(\"nummer\").value=\"1\";' />";
echo "<input type='button' value='2' onclick='document.getElementById(\"nummer\").value=\"2\";' />";
cis/testtool/frage.php
+10 -10
View File
@@ -236,7 +236,7 @@ if(isset($_POST['submitantwort']) && isset($_GET['frage_id']))
// alle vorhandenen Antworten zu dieser Frage loeschen
$qry = "DELETE FROM testtool.tbl_antwort WHERE antwort_id in(
SELECT antwort_id FROM testtool.tbl_antwort JOIN testtool.tbl_vorschlag USING(vorschlag_id)
WHERE frage_id='".addslashes($_GET['frage_id'])."' AND pruefling_id='".addslashes($_SESSION['pruefling_id'])."')";
WHERE frage_id=".$db->db_add_param($_GET['frage_id'])." AND pruefling_id=".$db->db_add_param($_SESSION['pruefling_id']).")";
$db->db_query($qry);
@@ -314,7 +314,7 @@ if(isset($_POST['submitantwort']) && isset($_GET['frage_id']))
$qry = "SELECT begintime
FROM
testtool.tbl_pruefling_frage JOIN testtool.tbl_frage USING(frage_id)
WHERE pruefling_id='".addslashes($_SESSION['pruefling_id'])."' AND gebiet_id='".addslashes($gebiet_id)."'
WHERE pruefling_id=".$db->db_add_param($_SESSION['pruefling_id'], FHC_INTEGER)." AND gebiet_id=".$db->db_add_param($gebiet_id, FHC_INTEGER)."
ORDER BY begintime ASC LIMIT 1";
if($result = $db->db_query($qry))
@@ -344,7 +344,7 @@ $info='';
$qry_pruefling = "SELECT vorname, nachname, stg_bez, tbl_studiengangstyp.bezeichnung FROM testtool.vw_pruefling
JOIN public.tbl_studiengang USING (studiengang_kz)
JOIN public.tbl_studiengangstyp USING (typ)
WHERE pruefling_id='".addslashes($_SESSION['pruefling_id'])."'";
WHERE pruefling_id=".$db->db_add_param($_SESSION['pruefling_id']);
if($result_pruefling = $db->db_query($qry_pruefling))
{
@@ -360,8 +360,8 @@ if($levelgebiet)
$max = $gebiet->maxfragen;
$aktuell=0;
$qry = "SELECT count(*) as anzahl FROM testtool.tbl_pruefling_frage JOIN testtool.tbl_frage USING(frage_id)
WHERE pruefling_id='".addslashes($_SESSION['pruefling_id'])."'
AND gebiet_id='$gebiet_id'";
WHERE pruefling_id=".$db->db_add_param($_SESSION['pruefling_id'], FHC_INTEGER)."
AND gebiet_id=".$db->db_add_param($gebiet_id, FHC_INTEGER);
if($result_aktuell = $db->db_query($qry))
{
@@ -405,7 +405,7 @@ else
//Wenn es sich um eine Testfrage handelt, dann wird die verbleibende Zeit angezeigt
$qry = "SELECT '$gebiet->zeit'-(now()-min(begintime)) as time
FROM testtool.tbl_pruefling_frage JOIN testtool.tbl_frage USING(frage_id)
WHERE gebiet_id='".addslashes($gebiet_id)."' AND pruefling_id='".addslashes($_SESSION['pruefling_id'])."'";
WHERE gebiet_id=".$db->db_add_param($gebiet_id, FHC_INTEGER)." AND pruefling_id=".$db->db_add_param($_SESSION['pruefling_id'], FHC_INTEGER);
$result = $db->db_query($qry);
$row = $db->db_fetch_object($result);
//Zeit in Sekunden umrechnen
@@ -441,7 +441,7 @@ else
// wenn keine Frage uebergeben wurde und die maximale Fragenanzahl erreicht wurde
// dann ist das Gebiet fertig
$qry = "SELECT count(*) as anzahl FROM testtool.tbl_pruefling_frage JOIN testtool.tbl_frage USING(frage_id)
WHERE gebiet_id='".addslashes($gebiet_id)."' AND pruefling_id='".addslashes($_SESSION['pruefling_id'])."' AND tbl_pruefling_frage.endtime is not null";
WHERE gebiet_id=".$db->db_add_param($gebiet_id, FHC_INTEGER)." AND pruefling_id=".$db->db_add_param($_SESSION['pruefling_id'], FHC_INTEGER)." AND tbl_pruefling_frage.endtime is not null";
$result = $db->db_query($qry);
$row = $db->db_fetch_object($result);
@@ -488,7 +488,7 @@ if($frage->frage_id!='')
{
$qry = "SELECT tbl_pruefling_frage.nummer, tbl_pruefling_frage.frage_id
FROM testtool.tbl_pruefling_frage JOIN testtool.tbl_frage USING(frage_id)
WHERE gebiet_id='".addslashes($gebiet_id)."' AND pruefling_id='".addslashes($_SESSION['pruefling_id'])."' AND demo=false ORDER BY nummer";
WHERE gebiet_id=".$db->db_add_param($gebiet_id, FHC_INTEGER)." AND pruefling_id=".$db->db_add_param($_SESSION['pruefling_id'], FHC_INTEGER)." AND demo=false ORDER BY nummer";
echo " <table><tr>";
//Nummern der Fragen Anzeigen
@@ -524,7 +524,7 @@ if($frage->frage_id!='')
if($demo)
{
$qry = "SELECT count(*) as anzahl FROM testtool.tbl_frage
WHERE tbl_frage.gebiet_id='".addslashes($gebiet_id)."'
WHERE tbl_frage.gebiet_id=".$db->db_add_param($gebiet_id, FHC_INTEGER)."
AND demo ";
if($row = $db->db_fetch_object($db->db_query($qry)))
{
@@ -563,7 +563,7 @@ if($frage->frage_id!='')
//$nextfrage = $frage->getNextFrage($gebiet_id, $_SESSION['pruefling_id'], $frage_id, $demo);
$qry = "SELECT count(*) as anzahl FROM testtool.tbl_frage
WHERE tbl_frage.gebiet_id='".addslashes($gebiet_id)."'
WHERE tbl_frage.gebiet_id=".$db->db_add_param($gebiet_id, FHC_INTEGER)."
AND demo ";
if($row = $db->db_fetch_object($db->db_query($qry)))
{
cis/testtool/login.php
+4 -3
View File
@@ -279,7 +279,7 @@ if(isset($_POST['save']) && isset($_SESSION['prestudent_id']))
$typ->getStudiengangTyp($stg_obj->typ);
//Sprachwahl des Studiengangs
$qry = "SELECT sprachwahl FROM testtool.tbl_ablauf_vorgaben WHERE studiengang_kz=".addslashes($prestudent->studiengang_kz)." LIMIT 1";
$qry = "SELECT sprachwahl FROM testtool.tbl_ablauf_vorgaben WHERE studiengang_kz=".$db->db_add_param($prestudent->studiengang_kz)." LIMIT 1";
$result = $db->db_query($qry);
$sprachwahl = $db->db_fetch_object($result);
$sprachwahl = $db->db_parse_bool($sprachwahl->sprachwahl);
@@ -317,7 +317,7 @@ if(isset($_POST['save']) && isset($_SESSION['prestudent_id']))
JOIN testtool.tbl_frage USING(gebiet_id)
JOIN testtool.tbl_frage_sprache USING(frage_id)
WHERE
tbl_pruefling.pruefling_id='".addslashes($pruefling->pruefling_id)."'
tbl_pruefling.pruefling_id=".$db->db_add_param($pruefling->pruefling_id)."
ORDER BY sprache DESC";
echo $p->t('testtool/spracheDerTestfragen').':';
if($result = $db->db_query($qry))
@@ -346,9 +346,10 @@ if(isset($_POST['save']) && isset($_SESSION['prestudent_id']))
}
else
{
$prestudent_id_dummy_student = (defined('PRESTUDENT_ID_DUMMY_STUDENT')?PRESTUDENT_ID_DUMMY_STUDENT:'');
echo '<form method="post">
<SELECT name="prestudent">';
echo '<OPTION value="'.PRESTUDENT_ID_DUMMY_STUDENT.'">'.$p->t('testtool/nameAuswaehlen').'</OPTION>\n';
echo '<OPTION value="'.$prestudent_id_dummy_student.'">'.$p->t('testtool/nameAuswaehlen').'</OPTION>\n';
foreach($ps->result as $prestd)
{
$stg = new studiengang();
cis/testtool/menu.php
+6 -6
View File
@@ -88,7 +88,7 @@ session_start();
if (isset($_SESSION['pruefling_id']))
{
//content_id fuer Einfuehrung auslesen
$qry = "SELECT content_id FROM testtool.tbl_ablauf_vorgaben WHERE studiengang_kz='".addslashes($_SESSION['studiengang_kz'])."' LIMIT 1";
$qry = "SELECT content_id FROM testtool.tbl_ablauf_vorgaben WHERE studiengang_kz=".$db->db_add_param($_SESSION['studiengang_kz'])." LIMIT 1";
$result = $db->db_query($qry);
echo '<table width="100%" border="0" cellspacing="0" cellpadding="0" style="border-right-width:1px;border-right-color:#BCBCBC;">';
@@ -96,11 +96,12 @@ if (isset($_SESSION['pruefling_id']))
<a href="login.php" target="content">'.$p->t('testtool/startseite').'</a>
</td></tr>';
if ($content_id = $db->db_fetch_object($result))
echo '<tr><td style="padding-left: 20px;"><a href="../../cms/content.php?content_id='.$content_id->content_id.'&sprache='.$sprache.'" target="content">'.$p->t('testtool/einleitung').'</a></td></tr>';
if($content_id->content_id!='')
echo '<tr><td style="padding-left: 20px;"><a href="../../cms/content.php?content_id='.$content_id->content_id.'&sprache='.$sprache.'" target="content">'.$p->t('testtool/einleitung').'</a></td></tr>';
echo '<tr><td>&nbsp;</td></tr>';
echo '<tr><td style="padding-left: 20px;" nowrap>';
$qry = "SELECT * FROM testtool.vw_ablauf WHERE studiengang_kz='".addslashes($_SESSION['studiengang_kz'])."' ORDER BY semester,reihung";
$qry = "SELECT * FROM testtool.vw_ablauf WHERE studiengang_kz=".$db->db_add_param($_SESSION['studiengang_kz'])." ORDER BY semester,reihung";
$result = $db->db_query($qry);
$lastsemester = '';
@@ -126,9 +127,9 @@ if (isset($_SESSION['pruefling_id']))
//Status der Gebiete Pruefen
$gebiet->load($row->gebiet_id);
$qry = "SELECT extract('epoch' from '$gebiet->zeit'-(now()-min(begintime))) as time
$qry = "SELECT extract('epoch' from '".$gebiet->zeit."'-(now()-min(begintime))) as time
FROM testtool.tbl_pruefling_frage JOIN testtool.tbl_frage USING(frage_id)
WHERE gebiet_id='".addslashes($row->gebiet_id)."' AND pruefling_id='".addslashes($_SESSION['pruefling_id'])."'";
WHERE gebiet_id=".$db->db_add_param($row->gebiet_id)." AND pruefling_id=".$db->db_add_param($_SESSION['pruefling_id']);
if($result_time = $db->db_query($qry))
{
if($row_time = $db->db_fetch_object($result_time))
@@ -180,7 +181,6 @@ if (isset($_SESSION['pruefling_id']))
else
{
echo '<tr>
<td width="10" nowrap>&nbsp;</td>
<td nowrap>
<span class="error"><img src="../../skin/images/menu_item.gif" width="7" height="9">&nbsp;'.$row->gebiet_bez.' (invalid)</span>
</td>
cis/testtool/topbar.php
+1 -1
View File
@@ -102,7 +102,7 @@ function changeSprache(sprache)
echo ' <table style="background-image: url(../../skin/images/header_testtool.png); background-repeat: repeat-x;" width="100%" height="100%" cellspacing="0" cellpadding="0">
<tr>
<td valign="top" align="left">
<a href="index.html" target="_top"><img class="header_logo" style="height:70%; left: 16px; top: 10%;" src="../../skin/styles/'.EXT_FKT_PATH.'/logo_klein.png" alt="logo"></a>
<a href="index.html" target="_top"><img class="header_logo" style="height:70%; left: 16px; top: 10%;" src="../../skin/styles/'.DEFAULT_STYLE.'/logo_klein.png" alt="logo"></a>
</td>
<td align="right">
<select style="text-align: left; color: #0086CC; border: 1;" name="select">';