LimeSurvey - the Online Survey Tool

Revision: 3355
          http://limesurvey.svn.sourceforge.net/limesurvey/?rev=3355&view=rev
Author:   lemeur
Date:     2007-10-08 09:46:57 -0700 (Mon, 08 Oct 2007)

Log Message:
-----------
Fixed #1272: SQL injection point when checking tokens

Modified Paths:
--------------
    source/stable_plus/index.php

Modified: source/stable_plus/index.php
===================================================================
--- source/stable_plus/index.php	2007-10-07 18:38:28 UTC (rev 3354)
+++ source/stable_plus/index.php	2007-10-08 16:46:57 UTC (rev 3355)
@@ -109,7 +109,10 @@
 }
 
 // Get token
-if (!isset($token)) {$token=trim(returnglobal('token'));}
+if (!isset($token))
+{
+	$token=trim(returnglobal('token'));
+}
 
 // If token was submitted from token form
 // Disabled for the moment (1.50) with function captcha_enabled
@@ -264,11 +267,12 @@
 //Check if TOKEN is used for EVERY PAGE
 //This function fixes a bug where users able to submit two surveys/votes
 //by checking that the token has not been used at each page displayed.
-if ($tokensexist == 1 && returnglobal('token'))
+//if ($tokensexist == 1 && returnglobal('token'))
+if ($tokensexist == 1 && $token)
 {
 	//check if token actually does exist
 
-	$tkquery = "SELECT COUNT(*) FROM ".db_table_name('tokens_'.$surveyid)." WHERE token='".trim(returnglobal('token'))."' AND (completed = 'N' or completed='')";
+	$tkquery = "SELECT COUNT(*) FROM ".db_table_name('tokens_'.$surveyid)." WHERE token='".db_quote($token)."' AND (completed = 'N' or completed='')";
 	$tkresult = db_execute_num($tkquery);
 	list($tkexist) = $tkresult->FetchRow();
 	if (!$tkexist)


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

Revision: 3359
          http://limesurvey.svn.sourceforge.net/limesurvey/?rev=3359&view=rev
Author:   lemeur
Date:     2007-10-08 13:09:46 -0700 (Mon, 08 Oct 2007)

Log Message:
-----------
More Fix for #1272: SQL injection point when checking tokens

Modified Paths:
--------------
    source/stable_plus/index.php

Modified: source/stable_plus/index.php
===================================================================
--- source/stable_plus/index.php	2007-10-08 18:55:12 UTC (rev 3358)
+++ source/stable_plus/index.php	2007-10-08 20:09:46 UTC (rev 3359)
@@ -450,7 +450,7 @@
 function getTokenData($surveyid, $token)
 {
 	global $dbprefix, $connect;
-	$query = "SELECT * FROM ".db_table_name('tokens_'.$surveyid)." WHERE token='$token'";
+	$query = "SELECT * FROM ".db_table_name('tokens_'.$surveyid)." WHERE token='".db_quote($token)."'";
 	$result = db_execute_assoc($query) or die("Couldn't get token info in getTokenData()<br />".$query."<br />".htmlspecialchars($connect->ErrorMsg()));
 	while($row=$result->FetchRow())
 	{
@@ -902,12 +902,12 @@
 	{
 		$utquery .= "SET completed='Y'\n";
 	}
-	$utquery .= "WHERE token='{$_POST['token']}'";
+	$utquery .= "WHERE token='".db_quote($_POST['token'])."'";
 
 	$utresult = $connect->Execute($utquery) or die ("Couldn't update tokens table!<br />\n$utquery<br />\n".htmlspecialchars($connect->ErrorMsg()));
 
 	// TLR change to put date into sent and completed
-	$cnfquery = "SELECT * FROM ".db_table_name("tokens_$surveyid")." WHERE token='{$_POST['token']}' AND completed!='N' AND completed!=''";
+	$cnfquery = "SELECT * FROM ".db_table_name("tokens_$surveyid")." WHERE token='".db_quote($_POST['token'])."' AND completed!='N' AND completed!=''";
   
 	$cnfresult = db_execute_assoc($cnfquery);
 	while ($cnfrow = $cnfresult->FetchRow())
@@ -1110,7 +1110,7 @@
 	elseif ($tokensexist == 1 && returnglobal('token'))
 	{
 		//check if token actually does exist
-		$tkquery = "SELECT COUNT(*) FROM ".db_table_name('tokens_'.$surveyid)." WHERE token='".trim(returnglobal('token'))."' AND (completed = 'N' or completed='')";
+		$tkquery = "SELECT COUNT(*) FROM ".db_table_name('tokens_'.$surveyid)." WHERE token='".db_quote(trim(returnglobal('token')))."' AND (completed = 'N' or completed='')";
 		$tkresult = db_execute_num($tkquery);
 		list($tkexist) = $tkresult->FetchRow();
 		if (!$tkexist)
@@ -1146,7 +1146,7 @@
 
 	if (isset($_GET['token'])){
 	//get language from token (if one exists)
-		$tkquery2 = "SELECT * FROM ".db_table_name('tokens_'.$surveyid)." WHERE token='".trim(returnglobal('token'))."' AND (completed = 'N' or completed='')";
+		$tkquery2 = "SELECT * FROM ".db_table_name('tokens_'.$surveyid)." WHERE token='".db_quote(trim(returnglobal('token')))."' AND (completed = 'N' or completed='')";
 		//echo $tkquery2;
 		$result = db_execute_assoc($tkquery2) or die ("Couldn't get tokens<br />$tkquery<br />".htmlspecialchars($connect->ErrorMsg()));
 		while ($rw = $result->FetchRow())


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

Revision: 3429
          http://limesurvey.svn.sourceforge.net/limesurvey/?rev=3429&view=rev
Author:   lemeur
Date:     2007-10-19 12:43:57 -0700 (Fri, 19 Oct 2007)

Log Message:
-----------
Fixed #1284: Warning on accessing invalid survey

Modified Paths:
--------------
    source/stable_plus/index.php

Modified: source/stable_plus/index.php
===================================================================
--- source/stable_plus/index.php	2007-10-19 18:02:34 UTC (rev 3428)
+++ source/stable_plus/index.php	2007-10-19 19:43:57 UTC (rev 3429)
@@ -131,12 +131,19 @@
 $totalBoilerplatequestions =0;
 $thissurvey=getSurveyInfo($surveyid, $_SESSION['s_lang']);
 
-if (is_array($thissurvey)) {$surveyexists=1;} else {$surveyexists=0;}
+if (is_array($thissurvey))
+{
+	$surveyexists=1;
+} 
+else 
+{
+	$surveyexists=0;
+}
 
 
 //SEE IF SURVEY USES TOKENS
 $i = 0; //$tokensexist = 0;
-if (bHasSurveyGotTokentable($thissurvey))
+if ($surveyexists == 1 && bHasSurveyGotTokentable($thissurvey))
 {
 	$tokensexist = 1;
 }


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

Revision: 3449
          http://limesurvey.svn.sourceforge.net/limesurvey/?rev=3449&view=rev
Author:   c_schmitz
Date:     2007-10-21 09:24:37 -0700 (Sun, 21 Oct 2007)

Log Message:
-----------
More security measures

Modified Paths:
--------------
    source/stable_plus/index.php

Modified: source/stable_plus/index.php
===================================================================
--- source/stable_plus/index.php	2007-10-21 16:23:56 UTC (rev 3448)
+++ source/stable_plus/index.php	2007-10-21 16:24:37 UTC (rev 3449)
@@ -84,6 +84,7 @@
 }
 
 
+if (isset($_REQUEST['embedded_inc'])) {die('You cannot start this script directly');}
 if ( $embedded_inc != '' )
 require_once( $embedded_inc );
 


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

Revision: 3504
          http://limesurvey.svn.sourceforge.net/limesurvey/?rev=3504&view=rev
Author:   leochaton
Date:     2007-10-29 21:19:44 -0700 (Mon, 29 Oct 2007)

Log Message:
-----------
This add the hour and minute to the date of survey completion in the tokens table

Modified Paths:
--------------
    source/stable_plus/index.php

Modified: source/stable_plus/index.php
===================================================================
--- source/stable_plus/index.php	2007-10-29 20:40:23 UTC (rev 3503)
+++ source/stable_plus/index.php	2007-10-30 04:19:44 UTC (rev 3504)
@@ -895,7 +895,7 @@
 
 	// Put date into sent and completed
 	
-	$today = date_shift(date("Y-m-d H:i:s"), "Y-m-d", $timeadjust);     
+	$today = date_shift(date("Y-m-d H:i:s"), "Y-m-d H:i", $timeadjust);     
 	$utquery = "UPDATE {$dbprefix}tokens_$surveyid\n";
 	if (bIsTokenCompletedDatestamped($thissurvey))
 	{


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.