oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix a form injection problem with the EMS. Addresses bug #11773.

Browse source
This commit is contained in:
Colin Kuskie 2010-10-11 13:11:56 -07:00
parent c50688f987
commit 106fcaedf7
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/changelog/7.x.x.txt
View file

@ -2,6 +2,7 @@
- fixed #11903: Unnecessary debug in Thingy - fixed #11903: Unnecessary debug in Thingy
- fixed #11908: Inbox messages linger after deleting a user - fixed #11908: Inbox messages linger after deleting a user
- fixed #11909: Wrong message count in the inbox - fixed #11909: Wrong message count in the inbox
- fixed #11773: Form injection in the EMS event ordering code.
7.10.2 7.10.2
- fixed #11884: Editing Templates impossible / Code editor not loaded - fixed #11884: Editing Templates impossible / Code editor not loaded

6
lib/WebGUI/Asset/Wobject/EventManagementSystem.pm
View file

@ -2456,7 +2456,8 @@ Method to move an event down one position in display order
sub www_moveEventMetaFieldDown { sub www_moveEventMetaFieldDown {
my $self = shift; my $self = shift;
return $self->session->privilege->insufficient unless ($self->canEdit); return $self->session->privilege->insufficient unless ($self->canEdit);
$self->moveCollateralDown('EMSEventMetaField', 'fieldId', $self->session->form->get("fieldId")); my $fieldId = $self->session->form->get("fieldId");
$self->moveCollateralDown('EMSEventMetaField', 'fieldId', $fieldId);
return $self->www_manageEventMetaFields; return $self->www_manageEventMetaFields;
} }
@ -2471,7 +2472,8 @@ Method to move an event metdata field up one position in display order
sub www_moveEventMetaFieldUp { sub www_moveEventMetaFieldUp {
my $self = shift; my $self = shift;
return $self->session->privilege->insufficient unless ($self->canEdit); return $self->session->privilege->insufficient unless ($self->canEdit);
$self->moveCollateralUp('EMSEventMetaField', 'fieldId', $self->session->form->get("fieldId")); my $fieldId = $self->session->form->get("fieldId");
$self->moveCollateralUp('EMSEventMetaField', 'fieldId', $fieldId);
return $self->www_manageEventMetaFields; return $self->www_manageEventMetaFields;
} }