Improved input checking for role editor.

diff --git a/WEB-INF/templates/footer.tpl b/WEB-INF/templates/footer.tpl
index 6646f126b4da00b26f0753d28d25cec841379854..7c8bd634ffa0b3043c06bdc3a932d18e03de0a1b 100644 (file)
--- a/WEB-INF/templates/footer.tpl
+++ b/WEB-INF/templates/footer.tpl
@@ -12,7 +12,7 @@
       <br>
       <table cellspacing="0" cellpadding="4" width="100%" border="0">
         <tr>
       <br>
       <table cellspacing="0" cellpadding="4" width="100%" border="0">
         <tr>

-          <td align="center">&nbsp;Anuko Time Tracker 1.17.74.4181 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
+          <td align="center">&nbsp;Anuko Time Tracker 1.17.74.4182 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |

             <a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
             <a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
             <a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>
             <a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
             <a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
             <a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>

diff --git a/role_add.php b/role_add.php
index e4cbb96442c44ed7883e8755cd7a123f9180ea37..d26cb6ad03d97c13e8a41db3acb42c0b32a137fe 100644 (file)
--- a/role_add.php
+++ b/role_add.php
@@ -40,7 +40,7 @@ if (!ttAccessAllowed('manage_roles')) {
 if ($request->isPost()) {
   $cl_name = trim($request->getParameter('name'));
   $cl_description = trim($request->getParameter('description'));
 if ($request->isPost()) {
   $cl_name = trim($request->getParameter('name'));
   $cl_description = trim($request->getParameter('description'));

-  $cl_rank = (int) $request->getParameter('rank');
+  $cl_rank = (int)$request->getParameter('rank');

 }
 
 $form = new Form('roleForm');
 }
 
 $form = new Form('roleForm');


@@ -56,6 +56,7 @@ if ($request->isPost()) {
   // Validate user input.
   if (!ttValidString($cl_name)) $err->add($i18n->get('error.field'), $i18n->get('label.thing_name'));
   if (!ttValidString($cl_description, true)) $err->add($i18n->get('error.field'), $i18n->get('label.description'));
   // Validate user input.
   if (!ttValidString($cl_name)) $err->add($i18n->get('error.field'), $i18n->get('label.thing_name'));
   if (!ttValidString($cl_description, true)) $err->add($i18n->get('error.field'), $i18n->get('label.description'));

+  if ($cl_rank >= $user->rank || $cl_rank < 0) $err->add($i18n->get('error.field'), $i18n->get('form.roles.rank'));

 
   if ($err->no()) {
     $existing_role = ttRoleHelper::getRoleByRank($cl_rank, $user->team_id);
 
   if ($err->no()) {
     $existing_role = ttRoleHelper::getRoleByRank($cl_rank, $user->team_id);

diff --git a/role_delete.php b/role_delete.php
index 086e7affb5f61537e3d92ad1fd10fc157a390d80..a3ce2985d3337df148df40fe54d1b2234276ff6c 100644 (file)
--- a/role_delete.php
+++ b/role_delete.php
@@ -35,9 +35,14 @@ if (!ttAccessAllowed('manage_roles')) {
   header('Location: access_denied.php');
   exit();
 }
   header('Location: access_denied.php');
   exit();
 }

-

 $cl_role_id = (int)$request->getParameter('id');
 $role = ttRoleHelper::get($cl_role_id);
 $cl_role_id = (int)$request->getParameter('id');
 $role = ttRoleHelper::get($cl_role_id);

+if (!$role) {
+  header('Location: access_denied.php');
+  exit();
+}
+// End of access checks.
+

 $role_to_delete = $role['name'];
 
 $form = new Form('roleDeleteForm');
 $role_to_delete = $role['name'];
 
 $form = new Form('roleDeleteForm');

diff --git a/role_edit.php b/role_edit.php
index f5f3762b3221ba24177fe9bc1c050ca4e1d4c97a..972d4540cb2e3e9d2f392a640e3d1a00663f664e 100644 (file)
--- a/role_edit.php
+++ b/role_edit.php
@@ -28,8 +28,6 @@
 
 require_once('initialize.php');
 import('form.Form');
 
 require_once('initialize.php');
 import('form.Form');

-import('ttTeamHelper'); // TODO: remove this?
-import('ttTaskHelper'); // TODO: remove this?

 import('ttRoleHelper');
 
 // Access checks.
 import('ttRoleHelper');
 
 // Access checks.


@@ -43,6 +41,7 @@ if (!$role) {
   header('Location: access_denied.php');
   exit();
 }
   header('Location: access_denied.php');
   exit();
 }

+// End of access checks.

 
 $assigned_rights = explode(',', $role['rights']);
 $available_rights = array_diff($user->rights, $assigned_rights);
 
 $assigned_rights = explode(',', $role['rights']);
 $available_rights = array_diff($user->rights, $assigned_rights);


@@ -82,6 +81,7 @@ if ($request->isPost()) {
     // Validate user input.
     if (!ttValidString($cl_name)) $err->add($i18n->get('error.field'), $i18n->get('label.thing_name'));
     if (!ttValidString($cl_description, true)) $err->add($i18n->get('error.field'), $i18n->get('label.description'));
     // Validate user input.
     if (!ttValidString($cl_name)) $err->add($i18n->get('error.field'), $i18n->get('label.thing_name'));
     if (!ttValidString($cl_description, true)) $err->add($i18n->get('error.field'), $i18n->get('label.description'));

+    if ($cl_rank >= $user->rank || $cl_rank < 0) $err->add($i18n->get('error.field'), $i18n->get('form.roles.rank'));

 
     if ($err->no()) {
       $existing_role = ttRoleHelper::getRoleByName($cl_name);
 
     if ($err->no()) {
       $existing_role = ttRoleHelper::getRoleByName($cl_name);

diff --git a/roles.php b/roles.php
index ec79020ee842cd61fdbd64aab82cddbcf1c9d949..cd17da3c48cc5aa9bd695a18822abb07a32708b9 100644 (file)
--- a/roles.php
+++ b/roles.php
@@ -31,11 +31,12 @@ import('form.Form');
 import('ttTeamHelper');
 import('ttRoleHelper');
 
 import('ttTeamHelper');
 import('ttRoleHelper');
 

-// Access check.
+// Access checks.

 if (!ttAccessAllowed('manage_roles')) {
   header('Location: access_denied.php');
   exit();
 }
 if (!ttAccessAllowed('manage_roles')) {
   header('Location: access_denied.php');
   exit();
 }

+// End of access checks.

 
 $smarty->assign('active_roles', ttTeamHelper::getActiveRolesForUser());
 $smarty->assign('inactive_roles', ttTeamHelper::getInactiveRolesForUser());
 
 $smarty->assign('active_roles', ttTeamHelper::getActiveRolesForUser());
 $smarty->assign('inactive_roles', ttTeamHelper::getInactiveRolesForUser());