diff options
| author | Cassio de Campos <cassiopc@gmail.com> | 2017-07-31 19:29:41 +0000 |
|---|---|---|
| committer | Cassio de Campos <cassiopc@gmail.com> | 2017-07-31 19:29:41 +0000 |
| commit | 00de0ce0817f36b5acba70362a4c30c8fa7aaf11 (patch) | |
| tree | a1212e95b472d75687741132d9055e416a558830 /src/ftask.php | |
| parent | e90144b4cc0feba26ee2f972b032c44d187b6bff (diff) | |
| download | boca-00de0ce0817f36b5acba70362a4c30c8fa7aaf11.tar.gz boca-00de0ce0817f36b5acba70362a4c30c8fa7aaf11.zip | |
sanitising
Diffstat (limited to 'src/ftask.php')
| -rw-r--r-- | src/ftask.php | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/ftask.php b/src/ftask.php index fc2cd48..a080db3 100644 --- a/src/ftask.php +++ b/src/ftask.php @@ -293,7 +293,9 @@ function DBNewTask($param, $c=null, $autotask=false) { if(isset($param['taskstatus']) && !isset($param['status'])) $param['status']=$param['taskstatus']; if(isset($param['taskdesc']) && !isset($param['desc'])) $param['desc']=$param['taskdesc']; if(isset($param['tasksystem']) && !isset($param['sys'])) $param['sys']=$param['tasksystem']; - + $param['filepath']=sanitizeFilename($param['filepath']); + $param['filename']=sanitizeFilename($param['filename']); + $ac=array('contest','site','user','desc'); $ac1=array('color','colorname','updatetime','filename','filepath','sys','tasknumber','status', 'taskdate','taskdatediff','taskdatediffans','taskstaffnumber','taskstaffsite'); @@ -316,7 +318,7 @@ function DBNewTask($param, $c=null, $autotask=false) { MSGError("DBNewTask param error: $key is not numeric"); return false; } - $$key = sanitizeText($param[$key]); + $$key = myhtmlspecialchars($param[$key]); } $taskstaffnumber=-1; $taskstaffsite=-1; @@ -334,7 +336,7 @@ function DBNewTask($param, $c=null, $autotask=false) { $taskdatediff=-1; foreach($ac1 as $key) { if(isset($param[$key])) { - $$key = sanitizeText($param[$key]); + $$key = myhtmlspecialchars($param[$key]); if(isset($type[$key]) && !is_numeric($param[$key])) { MSGError("DBNewTask param error: $key is not numeric"); return false; |