From 19f76fbd9caf10b862852e2148863750aa2727bb Mon Sep 17 00:00:00 2001 From: Nikolai Kristiansen Date: Tue, 20 Sep 2011 23:34:19 +0200 Subject: [PATCH 1/4] Check for quotes and backslash in password. --- inside/User.php | 7 +++++++ inside/migration/js/byebye_inside.js | 4 ++++ inside/migration/js/custom_validators.js | 6 ++++++ 3 files changed, 17 insertions(+) diff --git a/inside/User.php b/inside/User.php index 65c3e30..5bc3b7a 100644 --- a/inside/User.php +++ b/inside/User.php @@ -56,6 +56,7 @@ class User { $this->id = -1; return false; } else { + /* Validate user supplied data. */ if (strlen(stripcslashes($data['username'])) < 3 || strlen(stripcslashes($data['username'])) > 12 ) { notify("Brukernavnet må være mellom 3 og 12 tegn."); $this->id = -1; @@ -72,6 +73,12 @@ class User { $this->id = -1; return false; } + /* No double nor single quotes */ + if(preg_match('/["\'\\]+/', $data['password1'])) { + notify("Passordet kan ikke inneholde enkel- eller dobbelfnutt eller bakslask."); + $this->id = -1; + return false; + } if ($data['password1'] != $data['password2']) { notify("Passordene var ikke like."); $this->id = -1; diff --git a/inside/migration/js/byebye_inside.js b/inside/migration/js/byebye_inside.js index 1e37295..2bba94d 100644 --- a/inside/migration/js/byebye_inside.js +++ b/inside/migration/js/byebye_inside.js @@ -10,10 +10,14 @@ function init_validation() { password: { required: true, minlength: 8, + noquotes: true, + nobackslashes: true, }, password_check: { required: true, minlength: 8, + noquotes: true, + nobackslashes: true, equalTo: "#id_password", }, }, diff --git a/inside/migration/js/custom_validators.js b/inside/migration/js/custom_validators.js index 2542aa1..3bf1361 100644 --- a/inside/migration/js/custom_validators.js +++ b/inside/migration/js/custom_validators.js @@ -1,3 +1,9 @@ jQuery.validator.addMethod("lettersonly", function(value, element) { return this.optional(element) || /^[a-z]+$/.test(value); }, "Please enter only letters (english alphabet)."); +jQuery.validator.addMethod("noquotes", function(value, element) { + return this.optional(element) || ! /['"]+/.test(value); +}, "No single or double quotes, please."); +jQuery.validator.addMethod("noescape", function(value, element) { + return this.optional(element) || ! /[\\]+/.test(value); +}, "No backslashes, please."); From 57409da75652338e630eef9e02643d3756cceaf5 Mon Sep 17 00:00:00 2001 From: Nikolai Kristiansen Date: Tue, 20 Sep 2011 23:35:16 +0200 Subject: [PATCH 2/4] Typo --- inside/migration/js/byebye_inside.js | 4 ++-- inside/migration/js/custom_validators.js | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/inside/migration/js/byebye_inside.js b/inside/migration/js/byebye_inside.js index 2bba94d..4810d9d 100644 --- a/inside/migration/js/byebye_inside.js +++ b/inside/migration/js/byebye_inside.js @@ -11,13 +11,13 @@ function init_validation() { required: true, minlength: 8, noquotes: true, - nobackslashes: true, + noescapes: true, }, password_check: { required: true, minlength: 8, noquotes: true, - nobackslashes: true, + noescapes: true, equalTo: "#id_password", }, }, diff --git a/inside/migration/js/custom_validators.js b/inside/migration/js/custom_validators.js index 3bf1361..dda72d8 100644 --- a/inside/migration/js/custom_validators.js +++ b/inside/migration/js/custom_validators.js @@ -4,6 +4,6 @@ jQuery.validator.addMethod("lettersonly", function(value, element) { jQuery.validator.addMethod("noquotes", function(value, element) { return this.optional(element) || ! /['"]+/.test(value); }, "No single or double quotes, please."); -jQuery.validator.addMethod("noescape", function(value, element) { +jQuery.validator.addMethod("noescapes", function(value, element) { return this.optional(element) || ! /[\\]+/.test(value); }, "No backslashes, please."); From f73dcc0e57a9f7ba4280ee83fd64313bce41fdfe Mon Sep 17 00:00:00 2001 From: Nikolai Kristiansen Date: Wed, 21 Sep 2011 00:09:35 +0200 Subject: [PATCH 3/4] Subtle regex fixes. --- inside/User.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inside/User.php b/inside/User.php index 5bc3b7a..27d4876 100644 --- a/inside/User.php +++ b/inside/User.php @@ -74,7 +74,7 @@ class User { return false; } /* No double nor single quotes */ - if(preg_match('/["\'\\]+/', $data['password1'])) { + if(preg_match('/[\\\"\']+/', $data['password1'])) { notify("Passordet kan ikke inneholde enkel- eller dobbelfnutt eller bakslask."); $this->id = -1; return false; From 69392f69531c0cf11ec218526367e7b8aafecc23 Mon Sep 17 00:00:00 2001 From: Mausern Testbruker Date: Fri, 21 Oct 2011 00:52:34 +0200 Subject: [PATCH 4/4] Live changes (sticker period related) --- inside/ActionParser.php | 2 +- inside/Page.php | 19 ++++++++++--------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/inside/ActionParser.php b/inside/ActionParser.php index fb93670..927f5ac 100644 --- a/inside/ActionParser.php +++ b/inside/ActionParser.php @@ -1301,7 +1301,7 @@ private function logError($username, $error) if ($subaction == "sticker-sale") { $user->_registerUpdate("Oblat solgt i billettbod"); $user->updateExpiry(scriptParam("new-sticker-date")); - $user->updateLastSticker(scriptParam("new-sticker-date")); + $user->updateLastSticker(getStickerPeriod(scriptParam("new-sticker-date"))); } elseif ($subaction == "give-sticker") { $user->_registerUpdate("Gyldig medlemskap, oblat gitt ut i billettluka"); $user->updateLastSticker(scriptParam("new-sticker-date")); diff --git a/inside/Page.php b/inside/Page.php index 2e3d66c..0a52fb7 100644 --- a/inside/Page.php +++ b/inside/Page.php @@ -3452,25 +3452,26 @@ Om dere lager en facebook side til arrangementet, ikke glem å putte inn le print "lever ut kort"; } else { print ""; - print "\n"; + print "\n"; + print "\n"; + print "\n"; + print "\n"; print "\n"; print ""; } } else { + if (!$user->getCardProduced()) { print "produser kort"; } elseif (!$user->getCardDelivered()) { print ""; - print "expiry) . "\" />"; - print "expiry) . ")\" />"; + print "expires) . "\" />"; + print "expires) . ")\" />"; } elseif (!$user->hasCardSticker()) { print ""; - print "expiry) . "\" />"; - print "expiry) . ")\" />"; + print "expires) . "\" />"; + print "expires) . ")\" />"; } else { print "-"; }