Talenttic_survey/CATI_Tool
2
0
Fork 0
mirror of https://github.com/ACSPRI/queXS synced 2024-04-02 12:12:16 +00:00
Code Issues Releases Activity

Merging the updated Limesurvey 1.92+ branch of queXS to trunk

Browse Source
This commit is contained in:
azammitdcarf
2012-11-21 04:04:39 +00:00
parent 153fc8ca0d
commit c569559964
856 changed files with 254260 additions and 819988 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/limesurvey/classes/core/language.php
View File

@@ -10,7 +10,7 @@
* other free or open source software licenses.
* See COPYRIGHT.php for copyright notices and details.
*
* $Id: language.php 9648 2011-01-07 13:06:39Z c_schmitz $
* $Id: language.php 9247 2010-10-14 21:09:05Z c_schmitz $
*

754
include/limesurvey/classes/core/sanitize.php
View File

@@ -1,377 +1,377 @@
<?php
/*
* $Id: sanitize.php 9998 2011-04-12 11:34:43Z c_schmitz $
*
* Copyright (c) 2002,2003 Free Software Foundation
* developed under the custody of the
* Open Web Application Security Project
* (http://www.owasp.org)
*
* This file is part of the PHP Filters.
* PHP Filters is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* PHP Filters is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
* See the GNU General Public License for more details.
*
* If you are not able to view the LICENSE, which should
* always be possible within a valid and working PHP Filters release,
* please write to the Free Software Foundation, Inc.,
* 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
* to get a copy of the GNU General Public License or to report a
* possible license violation.
*/
///////////////////////////////////////
// sanitize.inc.php
// Sanitization functions for PHP
// by: Gavin Zuchlinski, Jamie Pratt, Hokkaido
// webpage: http://libox.net
// Last modified: December 21, 2003
//
// Many thanks to those on the webappsec list for helping me improve these functions
///////////////////////////////////////
// Function list:
// sanitize_paranoid_string($string) -- input string, returns string stripped of all non
// alphanumeric
// sanitize_system_string($string) -- input string, returns string stripped of special
// characters
// sanitize_html_string($string) -- input string, returns string with html replacements
// for special characters
// sanitize_int($integer) -- input integer, returns ONLY the integer (no extraneous
// characters
// sanitize_float($float) -- input float, returns ONLY the float (no extraneous
// characters)
// sanitize($input, $flags) -- input any variable, performs sanitization
// functions specified in flags. flags can be bitwise
// combination of PARANOID, SQL, SYSTEM, HTML, INT, FLOAT, LDAP,
// UTF8
// sanitize_email($email) -- input any string, all non-email chars will be removed
// sanitize_user($string) -- total length check (and more ??)
// sanitize_userfullname($string) -- total length check (and more ??)
//
//
///////////////////////////////////////
//
// 20031121 jp - added defines for magic_quotes and register_globals, added ; to replacements
// in sanitize_sql_string() function, created rudimentary testing pages
// 20031221 gz - added nice_addslashes and changed sanitize_sql_string to use it
// 20070213 lemeur - marked sanitize_sql_string as obsolete, should use db_quote instead
// 20071025 c_schmitz - added sanitize_email
// 20071032 lemeur - added sanitize_user and sanitize_userfullname
//
/////////////////////////////////////////
define("PARANOID", 1);
//define("SQL", 2);
define("SYSTEM", 4);
define("HTML", 8);
define("INT", 16);
define("FLOAT", 32);
define("LDAP", 64);
define("UTF8", 128);
// get magic_quotes_gpc ini setting - jp
$magic_quotes = (bool) @ini_get('magic_quotes_gpc');
if ($magic_quotes == TRUE) { define("MAGIC_QUOTES", 1); } else { define("MAGIC_QUOTES", 0); }
// addslashes wrapper to check for gpc_magic_quotes - gz
function nice_addslashes($string)
{
// if magic quotes is on the string is already quoted, just return it
if(MAGIC_QUOTES)
return $string;
else
return addslashes($string);
}
/**
* Function: sanitize_filename
* Returns a sanitized string, typically for URLs.
*
* Parameters:
* $string - The string to sanitize.
* $force_lowercase - Force the string to lowercase?
* $alphanumeric - If set to *true*, will remove all non-alphanumeric characters.
*/
function sanitize_filename($string, $force_lowercase = true, $alphanumeric = false) {
$strip = array("~", "`", "!", "@", "#", "$", "%", "^", "&", "*", "(", ")", "_", "=", "+", "[", "{", "]",
"}", "\\", "|", ";", ":", "\"", "'", "&#8216;", "&#8217;", "&#8220;", "&#8221;", "&#8211;", "&#8212;",
"—", "–", ",", "<", ".", ">", "/", "?");
$lastdot=strrpos($string, ".");
$clean = trim(str_replace($strip, "_", strip_tags($string)));
$clean = preg_replace('/\s+/', "-", $clean);
$clean = ($alphanumeric) ? preg_replace("/[^a-zA-Z0-9]/", "", $clean) : $clean ;
if ($lastdot !== false) {
$clean= substr_replace ( $clean , '.' , $lastdot , 1 );
}
return ($force_lowercase) ?
(function_exists('mb_strtolower')) ?
mb_strtolower($clean, 'UTF-8') :
strtolower($clean) :
$clean;
}
// paranoid sanitization -- only let the alphanumeric set through
function sanitize_paranoid_string($string, $min='', $max='')
{
if (isset($string))
{
$string = preg_replace("/[^_.a-zA-Z0-9]/", "", $string);
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return $string;
}
}
function sanitize_cquestions($string, $min='', $max='')
{
if (isset($string))
{
$string = preg_replace("/[^_.a-zA-Z0-9+#]/", "", $string);
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return $string;
}
}
function sanitize_email($email) {
// Handles now emails separated with a semikolon
$emailarray=explode(';',$email);
for ($i = 0; $i <= count($emailarray)-1; $i++)
{
$emailarray[$i]=preg_replace("/[^`'a-zA-Z0-9;+_=|.$%&#!{*~?}^@-]/i", "", $emailarray[$i]);
}
return implode(';',$emailarray);
}
// sanitize a string in prep for passing a single argument to system() (or similar)
function sanitize_system_string($string, $min='', $max='')
{
if (isset($string))
{
$pattern = '/(;|\||`|>|<|&|^|"|'."\n|\r|'".'|{|}|[|]|\)|\()/i'; // no piping, passing possible environment variables ($),
// seperate commands, nested execution, file redirection,
// background processing, special commands (backspace, etc.), quotes
// newlines, or some other special characters
$string = preg_replace($pattern, '', $string);
$string = '"'.preg_replace('/\$/', '\\\$', $string).'"'; //make sure this is only interpretted as ONE argument
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max))) return FALSE;
return $string;
}
}
function sanitize_xss_string($string)
{
if (isset($string))
{
$bad = array ('*','^','&','\'','-',';','\"','(',')','%','$','?');
return str_replace($bad, '',$string);
}
}
// sanitize a string for SQL input (simple slash out quotes and slashes)
function sanitize_sql_db_tablename($string)
{
$bad = array ('*','^','&','\'','-',';','\"','(',')','%','$','?');
return str_replace($bad, "",$string);
}
// sanitize a string for SQL input (simple slash out quotes and slashes)
function sanitize_ldap_string($string, $min='', $max='')
{
$pattern = '/(\)|\(|\||&)/';
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return preg_replace($pattern, '', $string);
}
// sanitize a string for HTML (make sure nothing gets interpretted!)
function sanitize_html_string($string)
{
$pattern[0] = '/\&/';
$pattern[1] = '/</';
$pattern[2] = "/>/";
$pattern[3] = '/\n/';
$pattern[4] = '/"/';
$pattern[5] = "/'/";
$pattern[6] = "/%/";
$pattern[7] = '/\(/';
$pattern[8] = '/\)/';
$pattern[9] = '/\+/';
$pattern[10] = '/-/';
$replacement[0] = '&amp;';
$replacement[1] = '&lt;';
$replacement[2] = '&gt;';
$replacement[3] = '<br />';
$replacement[4] = '&quot;';
$replacement[5] = '&#39;';
$replacement[6] = '&#37;';
$replacement[7] = '&#40;';
$replacement[8] = '&#41;';
$replacement[9] = '&#43;';
$replacement[10] = '&#45;';
return preg_replace($pattern, $replacement, $string);
}
// make int int!
function sanitize_int($integer, $min='', $max='')
{
$int = preg_replace("#[^0-9]#", "", $integer);
if((($min != '') && ($int < $min)) || (($max != '') && ($int > $max)))
{
return FALSE;
}
if ($int=='')
{
return null;
}
return $int;
}
// sanitize a username
// TODO: define the exact format of the username
// allow for instance 0-9a-zA-Z@_-.
function sanitize_user($string)
{
$username_length=64;
$string=mb_substr($string,0,$username_length);
return $string;
}
// sanitize a username
// TODO: define the exact format of the username
// allow for instance 0-9a-zA-Z@_-.
function sanitize_userfullname($string)
{
$username_length=50;
$string=mb_substr($string,0,$username_length);
return $string;
}
function sanitize_labelname($string)
{
$labelname_length=100;
$string=mb_substr($string,0,$labelname_length);
return $string;
}
// make float float!
function sanitize_float($float, $min='', $max='')
{
$float = str_replace(',','.',$float);
$float = floatval($float);
if((($min != '') && ($float < $min)) || (($max != '') && ($float > $max)))
return FALSE;
return $float;
}
// glue together all the other functions
function sanitize($input, $flags, $min='', $max='')
{
if($flags & PARANOID) $input = sanitize_paranoid_string($input, $min, $max);
if($flags & INT) $input = sanitize_int($input, $min, $max);
if($flags & FLOAT) $input = sanitize_float($input, $min, $max);
if($flags & HTML) $input = sanitize_html_string($input, $min, $max);
if($flags & LDAP) $input = sanitize_ldap_string($input, $min, $max);
if($flags & SYSTEM) $input = sanitize_system_string($input, $min, $max);
return $input;
}
function check_paranoid_string($input, $min='', $max='')
{
if($input != sanitize_paranoid_string($input, $min, $max))
return FALSE;
return TRUE;
}
function check_int($input, $min='', $max='')
{
if($input != sanitize_int($input, $min, $max))
return FALSE;
return TRUE;
}
function check_float($input, $min='', $max='')
{
if($input != sanitize_float($input, $min, $max))
return FALSE;
return TRUE;
}
function check_html_string($input, $min='', $max='')
{
if($input != sanitize_html_string($input, $min, $max))
return FALSE;
return TRUE;
}
function check_ldap_string($input, $min='', $max='')
{
if($input != sanitize_string($input, $min, $max))
return FALSE;
return TRUE;
}
function check_system_string($input, $min='', $max='')
{
if($input != sanitize_system_string($input, $min, $max, TRUE))
return FALSE;
return TRUE;
}
// glue together all the other functions
function check($input, $flags, $min='', $max='')
{
$oldput = $input;
if($flags & UTF8) $input = my_utf8_decode($input);
if($flags & PARANOID) $input = sanitize_paranoid_string($input, $min, $max);
if($flags & INT) $input = sanitize_int($input, $min, $max);
if($flags & FLOAT) $input = sanitize_float($input, $min, $max);
if($flags & HTML) $input = sanitize_html_string($input, $min, $max);
if($flags & LDAP) $input = sanitize_ldap_string($input, $min, $max);
if($flags & SYSTEM) $input = sanitize_system_string($input, $min, $max, TRUE);
if($input != $oldput)
return FALSE;
return TRUE;
}
function sanitize_languagecode($codetosanitize) {
return preg_replace('/[^a-z0-9-]/i', '', $codetosanitize);
}
function sanitize_languagecodeS($codestringtosanitize) {
$codearray=explode(" ",trim($codestringtosanitize));
$codearray=array_map("sanitize_languagecode",$codearray);
return implode(" ",$codearray);
}
function sanitize_token($codetosanitize) {
return preg_replace('/[^_a-z0-9]/i', '', $codetosanitize);
}
function sanitize_signedint($integer, $min='', $max='')
{
$int = (int) $integer;
if((($min != '') && ($int < $min)) || (($max != '') && ($int > $max)))
{
return FALSE; // Oops! Outside limits.
}
return $int;
};
<?php
/*
* $Id: sanitize.php 9999 2011-04-12 11:34:54Z c_schmitz $
*
* Copyright (c) 2002,2003 Free Software Foundation
* developed under the custody of the
* Open Web Application Security Project
* (http://www.owasp.org)
*
* This file is part of the PHP Filters.
* PHP Filters is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* PHP Filters is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
* See the GNU General Public License for more details.
*
* If you are not able to view the LICENSE, which should
* always be possible within a valid and working PHP Filters release,
* please write to the Free Software Foundation, Inc.,
* 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
* to get a copy of the GNU General Public License or to report a
* possible license violation.
*/
///////////////////////////////////////
// sanitize.inc.php
// Sanitization functions for PHP
// by: Gavin Zuchlinski, Jamie Pratt, Hokkaido
// webpage: http://libox.net
// Last modified: December 21, 2003
//
// Many thanks to those on the webappsec list for helping me improve these functions
///////////////////////////////////////
// Function list:
// sanitize_paranoid_string($string) -- input string, returns string stripped of all non
// alphanumeric
// sanitize_system_string($string) -- input string, returns string stripped of special
// characters
// sanitize_html_string($string) -- input string, returns string with html replacements
// for special characters
// sanitize_int($integer) -- input integer, returns ONLY the integer (no extraneous
// characters
// sanitize_float($float) -- input float, returns ONLY the float (no extraneous
// characters)
// sanitize($input, $flags) -- input any variable, performs sanitization
// functions specified in flags. flags can be bitwise
// combination of PARANOID, SQL, SYSTEM, HTML, INT, FLOAT, LDAP,
// UTF8
// sanitize_email($email) -- input any string, all non-email chars will be removed
// sanitize_user($string) -- total length check (and more ??)
// sanitize_userfullname($string) -- total length check (and more ??)
//
//
///////////////////////////////////////
//
// 20031121 jp - added defines for magic_quotes and register_globals, added ; to replacements
// in sanitize_sql_string() function, created rudimentary testing pages
// 20031221 gz - added nice_addslashes and changed sanitize_sql_string to use it
// 20070213 lemeur - marked sanitize_sql_string as obsolete, should use db_quote instead
// 20071025 c_schmitz - added sanitize_email
// 20071032 lemeur - added sanitize_user and sanitize_userfullname
//
/////////////////////////////////////////
define("PARANOID", 1);
//define("SQL", 2);
define("SYSTEM", 4);
define("HTML", 8);
define("INT", 16);
define("FLOAT", 32);
define("LDAP", 64);
define("UTF8", 128);
// get magic_quotes_gpc ini setting - jp
$magic_quotes = (bool) @ini_get('magic_quotes_gpc');
if ($magic_quotes == TRUE) { define("MAGIC_QUOTES", 1); } else { define("MAGIC_QUOTES", 0); }
// addslashes wrapper to check for gpc_magic_quotes - gz
function nice_addslashes($string)
{
// if magic quotes is on the string is already quoted, just return it
if(MAGIC_QUOTES)
return $string;
else
return addslashes($string);
}
/**
* Function: sanitize_filename
* Returns a sanitized string, typically for URLs.
*
* Parameters:
* $string - The string to sanitize.
* $force_lowercase - Force the string to lowercase?
* $alphanumeric - If set to *true*, will remove all non-alphanumeric characters.
*/
function sanitize_filename($string, $force_lowercase = true, $alphanumeric = false) {
$strip = array("~", "`", "!", "@", "#", "$", "%", "^", "&", "*", "(", ")", "_", "=", "+", "[", "{", "]",
"}", "\\", "|", ";", ":", "\"", "'", "&#8216;", "&#8217;", "&#8220;", "&#8221;", "&#8211;", "&#8212;",
"—", "–", ",", "<", ".", ">", "/", "?");
$lastdot=strrpos($string, ".");
$clean = trim(str_replace($strip, "_", strip_tags($string)));
$clean = preg_replace('/\s+/', "-", $clean);
$clean = ($alphanumeric) ? preg_replace("/[^a-zA-Z0-9]/", "", $clean) : $clean ;
if ($lastdot !== false) {
$clean= substr_replace ( $clean , '.' , $lastdot , 1 );
}
return ($force_lowercase) ?
(function_exists('mb_strtolower')) ?
mb_strtolower($clean, 'UTF-8') :
strtolower($clean) :
$clean;
}
// paranoid sanitization -- only let the alphanumeric set through
function sanitize_paranoid_string($string, $min='', $max='')
{
if (isset($string))
{
$string = preg_replace("/[^_.a-zA-Z0-9]/", "", $string);
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return $string;
}
}
function sanitize_cquestions($string, $min='', $max='')
{
if (isset($string))
{
$string = preg_replace("/[^_.a-zA-Z0-9+#]/", "", $string);
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return $string;
}
}
function sanitize_email($email) {
// Handles now emails separated with a semikolon
$emailarray=explode(';',$email);
for ($i = 0; $i <= count($emailarray)-1; $i++)
{
$emailarray[$i]=preg_replace("/[^`'a-zA-Z0-9;+_=|.$%&#!{*~?}^@-]/i", "", $emailarray[$i]);
}
return implode(';',$emailarray);
}
// sanitize a string in prep for passing a single argument to system() (or similar)
function sanitize_system_string($string, $min='', $max='')
{
if (isset($string))
{
$pattern = '/(;|\||`|>|<|&|^|"|'."\n|\r|'".'|{|}|[|]|\)|\()/i'; // no piping, passing possible environment variables ($),
// seperate commands, nested execution, file redirection,
// background processing, special commands (backspace, etc.), quotes
// newlines, or some other special characters
$string = preg_replace($pattern, '', $string);
$string = '"'.preg_replace('/\$/', '\\\$', $string).'"'; //make sure this is only interpretted as ONE argument
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max))) return FALSE;
return $string;
}
}
function sanitize_xss_string($string)
{
if (isset($string))
{
$bad = array ('*','^','&','\'','-',';','\"','(',')','%','$','?');
return str_replace($bad, '',$string);
}
}
// sanitize a string for SQL input (simple slash out quotes and slashes)
function sanitize_sql_db_tablename($string)
{
$bad = array ('*','^','&','\'','-',';','\"','(',')','%','$','?');
return str_replace($bad, "",$string);
}
// sanitize a string for SQL input (simple slash out quotes and slashes)
function sanitize_ldap_string($string, $min='', $max='')
{
$pattern = '/(\)|\(|\||&)/';
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return preg_replace($pattern, '', $string);
}
// sanitize a string for HTML (make sure nothing gets interpretted!)
function sanitize_html_string($string)
{
$pattern[0] = '/\&/';
$pattern[1] = '/</';
$pattern[2] = "/>/";
$pattern[3] = '/\n/';
$pattern[4] = '/"/';
$pattern[5] = "/'/";
$pattern[6] = "/%/";
$pattern[7] = '/\(/';
$pattern[8] = '/\)/';
$pattern[9] = '/\+/';
$pattern[10] = '/-/';
$replacement[0] = '&amp;';
$replacement[1] = '&lt;';
$replacement[2] = '&gt;';
$replacement[3] = '<br />';
$replacement[4] = '&quot;';
$replacement[5] = '&#39;';
$replacement[6] = '&#37;';
$replacement[7] = '&#40;';
$replacement[8] = '&#41;';
$replacement[9] = '&#43;';
$replacement[10] = '&#45;';
return preg_replace($pattern, $replacement, $string);
}
// make int int!
function sanitize_int($integer, $min='', $max='')
{
$int = preg_replace("#[^0-9]#", "", $integer);
if((($min != '') && ($int < $min)) || (($max != '') && ($int > $max)))
{
return FALSE;
}
if ($int=='')
{
return null;
}
return $int;
}
// sanitize a username
// TODO: define the exact format of the username
// allow for instance 0-9a-zA-Z@_-.
function sanitize_user($string)
{
$username_length=64;
$string=mb_substr($string,0,$username_length);
return $string;
}
// sanitize a username
// TODO: define the exact format of the username
// allow for instance 0-9a-zA-Z@_-.
function sanitize_userfullname($string)
{
$username_length=50;
$string=mb_substr($string,0,$username_length);
return $string;
}
function sanitize_labelname($string)
{
$labelname_length=100;
$string=mb_substr($string,0,$labelname_length);
return $string;
}
// make float float!
function sanitize_float($float, $min='', $max='')
{
$float = str_replace(',','.',$float);
$float = floatval($float);
if((($min != '') && ($float < $min)) || (($max != '') && ($float > $max)))
return FALSE;
return $float;
}
// glue together all the other functions
function sanitize($input, $flags, $min='', $max='')
{
if($flags & PARANOID) $input = sanitize_paranoid_string($input, $min, $max);
if($flags & INT) $input = sanitize_int($input, $min, $max);
if($flags & FLOAT) $input = sanitize_float($input, $min, $max);
if($flags & HTML) $input = sanitize_html_string($input, $min, $max);
if($flags & LDAP) $input = sanitize_ldap_string($input, $min, $max);
if($flags & SYSTEM) $input = sanitize_system_string($input, $min, $max);
return $input;
}
function check_paranoid_string($input, $min='', $max='')
{
if($input != sanitize_paranoid_string($input, $min, $max))
return FALSE;
return TRUE;
}
function check_int($input, $min='', $max='')
{
if($input != sanitize_int($input, $min, $max))
return FALSE;
return TRUE;
}
function check_float($input, $min='', $max='')
{
if($input != sanitize_float($input, $min, $max))
return FALSE;
return TRUE;
}
function check_html_string($input, $min='', $max='')
{
if($input != sanitize_html_string($input, $min, $max))
return FALSE;
return TRUE;
}
function check_ldap_string($input, $min='', $max='')
{
if($input != sanitize_string($input, $min, $max))
return FALSE;
return TRUE;
}
function check_system_string($input, $min='', $max='')
{
if($input != sanitize_system_string($input, $min, $max, TRUE))
return FALSE;
return TRUE;
}
// glue together all the other functions
function check($input, $flags, $min='', $max='')
{
$oldput = $input;
if($flags & UTF8) $input = my_utf8_decode($input);
if($flags & PARANOID) $input = sanitize_paranoid_string($input, $min, $max);
if($flags & INT) $input = sanitize_int($input, $min, $max);
if($flags & FLOAT) $input = sanitize_float($input, $min, $max);
if($flags & HTML) $input = sanitize_html_string($input, $min, $max);
if($flags & LDAP) $input = sanitize_ldap_string($input, $min, $max);
if($flags & SYSTEM) $input = sanitize_system_string($input, $min, $max, TRUE);
if($input != $oldput)
return FALSE;
return TRUE;
}
function sanitize_languagecode($codetosanitize) {
return preg_replace('/[^a-z0-9-]/i', '', $codetosanitize);
}
function sanitize_languagecodeS($codestringtosanitize) {
$codearray=explode(" ",trim($codestringtosanitize));
$codearray=array_map("sanitize_languagecode",$codearray);
return implode(" ",$codearray);
}
function sanitize_token($codetosanitize) {
return preg_replace('/[^_a-z0-9]/i', '', $codetosanitize);
}
function sanitize_signedint($integer, $min='', $max='')
{
$int = (int) $integer;
if((($min != '') && ($int < $min)) || (($max != '') && ($int > $max)))
{
return FALSE; // Oops! Outside limits.
}
return $int;
};

194
include/limesurvey/classes/core/startup.php
View File

@@ -1,97 +1,97 @@
<?php
if(ob_get_contents() !== false)
{
ob_clean();
};
ob_start();
@ini_set("session.bug_compat_warn", 0); //Turn this off until first "Next" warning is worked out
if (@ini_get('register_globals') == '1' || strtolower(@ini_get('register_globals')) == 'on')
{
deregister_globals();
}
/*
* Remove variables created by register_globals from the global scope
* Thanks to Matt Kavanagh
*/
function deregister_globals()
{
$not_unset = array(
'GLOBALS' => true,
'_GET' => true,
'_POST' => true,
'_COOKIE' => true,
'_REQUEST' => true,
'_SERVER' => true,
'_SESSION' => true,
'_ENV' => true,
'_FILES' => true
);
// Not only will array_merge and array_keys give a warning if
// a parameter is not an array, array_merge will actually fail.
// So we check if _SESSION has been initialised.
if (!isset($_SESSION) || !is_array($_SESSION))
{
$_SESSION = array();
}
// Merge all into one extremely huge array; unset this later
$input = array_merge(
array_keys($_GET),
array_keys($_POST),
array_keys($_COOKIE),
array_keys($_SERVER),
array_keys($_SESSION),
array_keys($_ENV),
array_keys($_FILES)
);
foreach ($input as $varname)
{
if (isset($not_unset[$varname]))
{
// Hacking attempt. No point in continuing.
exit;
}
unset($GLOBALS[$varname]);
}
unset($input);
}
/**
* This function converts a standard # array to a PHP array without having to resort to JSON_decode which is available from 5.2x and up only
*
* @param string $json String with JSON data
* @return array
*/
if ( !function_exists('json_decode') ){
function json_decode($content, $assoc=false){
global $homedir;
require_once($homedir."/classes/json/JSON.php");
if ( $assoc ){
$json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);
} else {
$json = new Services_JSON;
}
return $json->decode($content);
}
}
if ( !function_exists('json_encode') ){
function json_encode($content){
global $homedir;
require_once($homedir."/classes/json/JSON.php");
$json = new Services_JSON;
return $json->encode($content);
}
}
?>
<?php
if(ob_get_contents() !== false)
{
ob_clean();
};
ob_start();
@ini_set("session.bug_compat_warn", 0); //Turn this off until first "Next" warning is worked out
if (@ini_get('register_globals') == '1' || strtolower(@ini_get('register_globals')) == 'on')
{
deregister_globals();
}
/*
* Remove variables created by register_globals from the global scope
* Thanks to Matt Kavanagh
*/
function deregister_globals()
{
$not_unset = array(
'GLOBALS' => true,
'_GET' => true,
'_POST' => true,
'_COOKIE' => true,
'_REQUEST' => true,
'_SERVER' => true,
'_SESSION' => true,
'_ENV' => true,
'_FILES' => true
);
// Not only will array_merge and array_keys give a warning if
// a parameter is not an array, array_merge will actually fail.
// So we check if _SESSION has been initialised.
if (!isset($_SESSION) || !is_array($_SESSION))
{
$_SESSION = array();
}
// Merge all into one extremely huge array; unset this later
$input = array_merge(
array_keys($_GET),
array_keys($_POST),
array_keys($_COOKIE),
array_keys($_SERVER),
array_keys($_SESSION),
array_keys($_ENV),
array_keys($_FILES)
);
foreach ($input as $varname)
{
if (isset($not_unset[$varname]))
{
// Hacking attempt. No point in continuing.
exit;
}
unset($GLOBALS[$varname]);
}
unset($input);
}
/**
* This function converts a standard # array to a PHP array without having to resort to JSON_decode which is available from 5.2x and up only
*
* @param string $json String with JSON data
* @return array
*/
if ( !function_exists('json_decode') ){
function json_decode($content, $assoc=false){
global $homedir;
require_once($homedir."/classes/json/JSON.php");
if ( $assoc ){
$json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);
} else {
$json = new Services_JSON;
}
return $json->decode($content);
}
}
if ( !function_exists('json_encode') ){
function json_encode($content){
global $homedir;
require_once($homedir."/classes/json/JSON.php");
$json = new Services_JSON;
return $json->encode($content);
}
}
?>

1322
include/limesurvey/classes/core/surveytranslator.php
View File

File diff suppressed because it is too large Load Diff