- 
- getAccessLevel('pipelines.removeFromPipeline') >= ACCESS_LEVEL_DELETE): ?>
-
-
-
-
+ getAccessLevel('pipelines.removeFromPipeline') >= ACCESS_LEVEL_DELETE): ?>
+
+
diff --git a/ajax/setCandidateJobOrderRating.php b/ajax/setCandidateJobOrderRating.php
index 19236e202..2d545c964 100755
--- a/ajax/setCandidateJobOrderRating.php
+++ b/ajax/setCandidateJobOrderRating.php
@@ -32,6 +32,12 @@
$interface = new SecureAJAXInterface();
+if ($_SERVER['REQUEST_METHOD'] !== 'POST')
+{
+ $interface->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+}
+
if ($_SESSION['CATS']->getAccessLevel('pipelines.editRating') < ACCESS_LEVEL_EDIT)
{
$interface->outputXMLErrorPage(-1, ERROR_NO_PERMISSION);
@@ -45,7 +51,7 @@
}
if (!$interface->isRequiredIDValid('rating', true, true) ||
- $_REQUEST['rating'] < -6 || $_REQUEST['rating'] > 5)
+ $_POST['rating'] < -6 || $_POST['rating'] > 5)
{
$interface->outputXMLErrorPage(-1, 'Invalid rating.');
die();
@@ -53,8 +59,8 @@
$siteID = $interface->getSiteID();
-$candidateJobOrderID = $_REQUEST['candidateJobOrderID'];
-$rating = $_REQUEST['rating'];
+$candidateJobOrderID = $_POST['candidateJobOrderID'];
+$rating = $_POST['rating'];
$pipelines = new Pipelines($siteID);
$pipelines->updateRatingValue($candidateJobOrderID, $rating);
diff --git a/ajax/setColumnWidth.php b/ajax/setColumnWidth.php
index f4efbe03b..ca2bc7ce9 100755
--- a/ajax/setColumnWidth.php
+++ b/ajax/setColumnWidth.php
@@ -29,9 +29,21 @@
$interface = new SecureAJAXInterface();
-$instance = $_REQUEST['instance'];
-$columnName = $_REQUEST['columnName'];
-$columnWidth = $_REQUEST['columnWidth'];
+if ($_SERVER['REQUEST_METHOD'] !== 'POST')
+{
+ $interface->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+}
+
+if (!isset($_POST['instance']) || !isset($_POST['columnName']) || !isset($_POST['columnWidth']))
+{
+ $interface->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+}
+
+$instance = $_POST['instance'];
+$columnName = $_POST['columnName'];
+$columnWidth = $_POST['columnWidth'];
$columnPreferences = $_SESSION['CATS']->getColumnPreferences($instance);
diff --git a/ajax/testEmailSettings.php b/ajax/testEmailSettings.php
index 5845e4b53..f93751b80 100755
--- a/ajax/testEmailSettings.php
+++ b/ajax/testEmailSettings.php
@@ -32,10 +32,16 @@
$interface = new SecureAJAXInterface();
+if ($_SERVER['REQUEST_METHOD'] !== 'POST')
+{
+ $interface->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+}
+
$siteID = $interface->getSiteID();
-if (!isset($_REQUEST['testEmailAddress']) ||
- empty($_REQUEST['testEmailAddress']))
+if (!isset($_POST['testEmailAddress']) ||
+ empty($_POST['testEmailAddress']))
{
$interface->outputXMLErrorPage(
-1, 'Invalid test e-mail address.'
@@ -44,8 +50,8 @@
die();
}
-if (!isset($_REQUEST['fromAddress']) ||
- empty($_REQUEST['fromAddress']))
+if (!isset($_POST['fromAddress']) ||
+ empty($_POST['fromAddress']))
{
$interface->outputXMLErrorPage(
-1, 'Invalid from e-mail address.'
@@ -54,8 +60,8 @@
die();
}
-$testEmailAddress = $_REQUEST['testEmailAddress'];
-$fromAddress = $_REQUEST['fromAddress'];
+$testEmailAddress = $_POST['testEmailAddress'];
+$fromAddress = $_POST['fromAddress'];
/* Is the test e-mail address specified valid? */
// FIXME: Validate properly.
diff --git a/db/cats_schema.sql b/db/cats_schema.sql
index 09d98616a..a308400e7 100755
--- a/db/cats_schema.sql
+++ b/db/cats_schema.sql
@@ -859,7 +859,7 @@ insert into `module_schema`(`module_schema_id`,`name`,`version`) values (9,'ext
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (10,'graphs',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (11,'home',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (12,'import',0);
-insert into `module_schema`(`module_schema_id`,`name`,`version`) values (13,'install',365);
+insert into `module_schema`(`module_schema_id`,`name`,`version`) values (13,'install',366);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (14,'joborders',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (15,'lists',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (16,'login',0);
@@ -868,9 +868,8 @@ insert into `module_schema`(`module_schema_id`,`name`,`version`) values (18,'re
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (19,'rss',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (20,'settings',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (21,'tests',0);
-insert into `module_schema`(`module_schema_id`,`name`,`version`) values (22,'toolbar',0);
-insert into `module_schema`(`module_schema_id`,`name`,`version`) values (23,'wizard',0);
-insert into `module_schema`(`module_schema_id`,`name`,`version`) values (24,'xml',0);
+insert into `module_schema`(`module_schema_id`,`name`,`version`) values (22,'wizard',0);
+insert into `module_schema`(`module_schema_id`,`name`,`version`) values (23,'xml',0);
/*Table structure for table `mru` */
diff --git a/index.php b/index.php
index e35a864f3..3a37e49e9 100644
--- a/index.php
+++ b/index.php
@@ -172,6 +172,26 @@ function stripslashes_deep($value)
}
}
+if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST' &&
+ $_SESSION['CATS']->isLoggedIn() &&
+ (!isset($careerPage) || !$careerPage) &&
+ (!isset($_GET['showCareerPortal']) || $_GET['showCareerPortal'] != '1') &&
+ (!isset($rssPage) || !$rssPage) &&
+ (!isset($xmlPage) || !$xmlPage))
+{
+ $token = null;
+
+ if (isset($_POST['csrfToken']))
+ {
+ $token = $_POST['csrfToken'];
+ }
+
+ if (!$_SESSION['CATS']->isCSRFTokenValid($token))
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, null, 'Invalid request.');
+ }
+}
+
/* Check to see if we are supposed to display the career page. */
if (((isset($careerPage) && $careerPage) ||
(isset($_GET['showCareerPortal']) && $_GET['showCareerPortal'] == '1')))
@@ -219,6 +239,11 @@ function stripslashes_deep($value)
{
if ($_GET['m'] == 'logout')
{
+ if ($_SERVER['REQUEST_METHOD'] !== 'POST')
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, null, 'Invalid request.');
+ }
+
/* There isn't really a logout module. It's just a few lines. */
$unixName = $_SESSION['CATS']->getUnixName();
@@ -233,12 +258,20 @@ function stripslashes_deep($value)
$URI .= '&s=' . $unixName;
}
- if (isset($_GET['message']))
+ if (isset($_POST['message']))
+ {
+ $URI .= '&message=' . urlencode($_POST['message']);
+ }
+ else if (isset($_GET['message']))
{
$URI .= '&message=' . urlencode($_GET['message']);
}
- if (isset($_GET['messageSuccess']))
+ if (isset($_POST['messageSuccess']))
+ {
+ $URI .= '&messageSuccess=' . urlencode($_POST['messageSuccess']);
+ }
+ else if (isset($_GET['messageSuccess']))
{
$URI .= '&messageSuccess=' . urlencode($_GET['messageSuccess']);
}
diff --git a/js/lib.js b/js/lib.js
index cb80e2e59..4e1c389c3 100755
--- a/js/lib.js
+++ b/js/lib.js
@@ -220,25 +220,19 @@ function urlDecode(text)
}
/**
- * Converts a JavaScript array to a seralize()-formatted PHP array in string
- * format.
+ * Converts a JavaScript array to a URL-safe JSON string.
*
- * PHP: $myArray = unserialize(urldecode($_POST['myArray']));
- * Remember this is unsafe input and it should not be trusted!
- *
- * Pass this through urlEncode() (above) before adding to a request.
+ * Used for DataGrid "Selected" bulk actions; the server expects JSON for
+ * exportIDs in dynamicArgument.
*/
function serializeArray(array)
{
- var string = 'a:' + array.length + ':{';
-
- for (var i = 0; i < array.length; ++i)
+ if (!(array instanceof Array))
{
- string += 'i:' + i + ';s:' + String(array[i]).length + ':"'
- + String(array[i]) + '";';
+ array = [];
}
-
- return string + '}';
+
+ return encodeURIComponent(JSON.stringify(array));
}
/**
@@ -342,6 +336,20 @@ function AJAX_getPOSTSessionID(sessionCookie)
function AJAX_POST(http, url, POSTData, callBack, timeout, sessionCookie,
silentTimeout)
{
+ if (POSTData == null)
+ {
+ POSTData = '';
+ }
+
+ if (typeof CATSCsrfToken != 'undefined' && CATSCsrfToken !== null &&
+ CATSCsrfToken !== '')
+ {
+ if (POSTData.indexOf('csrfToken=') == -1)
+ {
+ POSTData += '&csrfToken=' + encodeURIComponent(CATSCsrfToken);
+ }
+ }
+
/* Add a random hash to the POST data to keep IE from caching it. */
POSTData += AJAX_getRandomPOSTHash();
diff --git a/js/lists.js b/js/lists.js
index 09edc620c..50157f3a0 100755
--- a/js/lists.js
+++ b/js/lists.js
@@ -205,7 +205,34 @@ function deleteListFromListView(savedListID, numberEntries)
return;
}
- document.location.href = CATSIndexName + '?m=lists&a=deleteStaticList&savedListID=' + savedListID;
+ var form = document.createElement('form');
+ form.method = 'post';
+ form.action = CATSIndexName + '?m=lists&a=deleteStaticList';
+
+ var postback = document.createElement('input');
+ postback.type = 'hidden';
+ postback.name = 'postback';
+ postback.value = 'postback';
+ form.appendChild(postback);
+
+ var savedListInput = document.createElement('input');
+ savedListInput.type = 'hidden';
+ savedListInput.name = 'savedListID';
+ savedListInput.value = savedListID;
+ form.appendChild(savedListInput);
+
+ if (typeof CATSCsrfToken != 'undefined' && CATSCsrfToken !== null &&
+ CATSCsrfToken !== '')
+ {
+ var csrfToken = document.createElement('input');
+ csrfToken.type = 'hidden';
+ csrfToken.name = 'csrfToken';
+ csrfToken.value = CATSCsrfToken;
+ form.appendChild(csrfToken);
+ }
+
+ document.body.appendChild(form);
+ form.submit();
}
function deleteListRow(savedListID, sessionCookie, numberEntries)
@@ -350,4 +377,3 @@ function addItemsToList(sessionCookie, dataItemType)
false
);
}
-
diff --git a/js/quickAction.js b/js/quickAction.js
index 5156ad009..75a825010 100755
--- a/js/quickAction.js
+++ b/js/quickAction.js
@@ -121,3 +121,72 @@ function showQuickActionAddToPipeline(menuDataItemId)
/* Create a popup window for adding this candidate to the job order / pipeline */
showPopWin(CATSIndexName + '?m=candidates&a=considerForJobSearch&candidateID=' + menuDataItemId, 750, 390, null);
};
+
+function quickActionPostFromUrl(url, confirmMessage)
+{
+ if (confirmMessage && !confirm(confirmMessage))
+ {
+ return false;
+ }
+
+ var parts = url.split('?');
+ var action = parts[0];
+ var query = (parts.length > 1) ? parts[1] : '';
+ var params = {};
+ var actionParams = [];
+
+ if (query.length > 0)
+ {
+ var pairs = query.split('&');
+ for (var i = 0; i < pairs.length; i++)
+ {
+ if (pairs[i] === '')
+ {
+ continue;
+ }
+
+ var keyValue = pairs[i].split('=');
+ var key = decodeURIComponent(keyValue[0].replace(/\+/g, ' '));
+ var value = keyValue.length > 1 ? decodeURIComponent(keyValue[1].replace(/\+/g, ' ')) : '';
+
+ if (key === 'm' || key === 'a')
+ {
+ actionParams.push(encodeURIComponent(key) + '=' + encodeURIComponent(value));
+ }
+ else
+ {
+ params[key] = value;
+ }
+ }
+ }
+
+ params.postback = 'postback';
+
+ if (typeof CATSCsrfToken != 'undefined' && CATSCsrfToken !== null &&
+ CATSCsrfToken !== '' && typeof params.csrfToken == 'undefined')
+ {
+ params.csrfToken = CATSCsrfToken;
+ }
+
+ var form = document.createElement('form');
+ form.method = 'post';
+ form.action = action + (actionParams.length ? ('?' + actionParams.join('&')) : '');
+
+ for (var name in params)
+ {
+ if (!params.hasOwnProperty(name))
+ {
+ continue;
+ }
+
+ var input = document.createElement('input');
+ input.type = 'hidden';
+ input.name = name;
+ input.value = params[name];
+ form.appendChild(input);
+ }
+
+ document.body.appendChild(form);
+ form.submit();
+ return false;
+}
diff --git a/js/wizardIntro.js b/js/wizardIntro.js
index f7c620e87..769ab26f9 100755
--- a/js/wizardIntro.js
+++ b/js/wizardIntro.js
@@ -60,7 +60,7 @@ function deleteUser(id)
{
failAction = 'alert("Unable to delete that user.");';
userActionSuccess = 'cancelAddUser(); loadPage("current");';
- userAction('DeleteUser&userID=' + id);
+ userActionPost('DeleteUser', 'userID=' + id);
}
function keyGood()
@@ -253,3 +253,67 @@ function userAction(action)
ajaxObj.open("GET",url,true);
ajaxObj.send(null);
}
+
+function userActionPost(action, postData)
+{
+ var ajaxObj;
+ var url = '?m=settings&a=ajax_wizard' + action;
+ var payload = 'postback=postback&' + postData;
+
+ if (typeof CATSCsrfToken != 'undefined' && CATSCsrfToken !== null &&
+ CATSCsrfToken !== '' && payload.indexOf('csrfToken=') == -1)
+ {
+ payload += '&csrfToken=' + encodeURIComponent(CATSCsrfToken);
+ }
+
+ try
+ {
+ // Firefox, Opera 8.0+, Safari
+ ajaxObj = new XMLHttpRequest();
+ }
+ catch (e)
+ {
+ // Internet Explorer
+ try
+ {
+ ajaxObj = new ActiveXObject("Msxml2.XMLHTTP");
+ }
+ catch (e)
+ {
+ try
+ {
+ ajaxObj = new ActiveXObject("Microsoft.XMLHTTP");
+ }
+ catch (e)
+ {
+ alert("Your browser does not support AJAX!");
+ return false;
+ }
+ }
+ }
+ ajaxObj.onreadystatechange = function()
+ {
+ if (ajaxObj.readyState == 4)
+ {
+ if (ajaxObj.responseText == 'Ok')
+ {
+ if (userActionSuccess != '') eval(userActionSuccess);
+ }
+ else
+ {
+ if (failAction != '')
+ {
+ eval(failAction);
+ }
+ else
+ {
+ alert(ajaxObj.responseText);
+ }
+ }
+ }
+ }
+
+ ajaxObj.open("POST", url, true);
+ ajaxObj.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
+ ajaxObj.send(payload);
+}
diff --git a/lib/AJAXInterface.php b/lib/AJAXInterface.php
index daf5fddf8..4dc50abc6 100755
--- a/lib/AJAXInterface.php
+++ b/lib/AJAXInterface.php
@@ -215,6 +215,22 @@ public function __construct()
die();
}
+ if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST')
+ {
+ $token = null;
+
+ if (isset($_POST['csrfToken']))
+ {
+ $token = $_POST['csrfToken'];
+ }
+
+ if (!$_SESSION['CATS']->isCSRFTokenValid($token))
+ {
+ $this->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+ }
+ }
+
/* Grab the current user's site ID. */
$this->_siteID = $_SESSION['CATS']->getSiteID();
diff --git a/lib/DataGrid.php b/lib/DataGrid.php
index c79b94a26..4aa62195b 100755
--- a/lib/DataGrid.php
+++ b/lib/DataGrid.php
@@ -253,10 +253,32 @@ public static function get($indentifier, $parameters, $misc = 0)
}
$parameters[$index] = $_REQUEST['dynamicArgument' . md5($indentifier)];
-
- if ($index = 'exportIDs')
+
+ if ($index === 'exportIDs')
{
- $parameters['exportIDs'] = json_decode(urldecode($parameters['exportIDs']), true);
+ $decoded = json_decode($parameters['exportIDs'], true);
+ if (!is_array($decoded))
+ {
+ $decoded = array();
+ }
+
+ $parameters['exportIDs'] = array();
+ foreach ($decoded as $value)
+ {
+ if (is_scalar($value))
+ {
+ $intValue = (int) $value;
+ if ($intValue > 0 && !in_array($intValue, $parameters['exportIDs']))
+ {
+ $parameters['exportIDs'][] = $intValue;
+ }
+ }
+ }
+
+ if (empty($parameters['exportIDs']))
+ {
+ $parameters['exportIDs'] = array(0);
+ }
}
}
}
@@ -292,13 +314,24 @@ public static function get($indentifier, $parameters, $misc = 0)
*/
public static function getFromRequest()
{
- if (!isset($_REQUEST['i']) || !isset($_REQUEST['p']))
+ if (!isset($_REQUEST['i']) || $_REQUEST['i'] === '')
{
- trigger_error('getFromRequest datagrid failed : no request variables i or p set.');
+ trigger_error('getFromRequest datagrid failed : no request variables i set.');
+ return null;
}
$indentifier = $_REQUEST['i'];
- $parameters = json_decode($_REQUEST['p'], true);
+ $parameters = array();
+
+ if (isset($_REQUEST['p']))
+ {
+ $decoded = json_decode($_REQUEST['p'], true);
+
+ if (is_array($decoded))
+ {
+ $parameters = $decoded;
+ }
+ }
return self::get($indentifier, $parameters);
}
@@ -1980,23 +2013,23 @@ public function getInnerActionAreaItem($actionTitle, $actionURL, $allowAll = tru
if ($allowAll)
{
$html = sprintf(
- '',
+ '',
htmlspecialchars($actionTitle),
md5($this->_instanceName),
$actionURL,
urlencode($this->_instanceName),
- urlencode(serialize($newParameterArraySelected)),
+ urlencode(json_encode($newParameterArraySelected)),
md5($this->_instanceName),
md5($this->_instanceName),
$actionURL,
urlencode($this->_instanceName),
- urlencode(serialize($newParameterArrayAll))
+ urlencode(json_encode($newParameterArrayAll))
);
}
else
{
$html = sprintf(
- '
', "\n";
+ echo $openTag,
+ '',
+ $closeTag,
+ ' ', "\n";
$escapedURL = htmlspecialchars($savedSearchRow['URL']);
@@ -481,9 +497,12 @@ public static function printSavedSearch($savedSearchRS)
}
$escapedURL = '/'.$escapedURL;
- echo '',
- '
';
+ echo ' ';
echo '', "\n";
echo '', "\n";
+ '. Powered by OpenCATS.', "\n";
echo 'This maintenance action must be triggered via POST.
', + 'This starts the attachment reindex process.
', + '', + ''; + die(); +} + include_once('./config.php'); include_once(LEGACY_ROOT . '/lib/DatabaseConnection.php'); include_once(LEGACY_ROOT . '/lib/ModuleUtility.php'); diff --git a/modules/install/ajax/attachmentsToThreeDirectory.php b/modules/install/ajax/attachmentsToThreeDirectory.php index b56902158..11329abb6 100755 --- a/modules/install/ajax/attachmentsToThreeDirectory.php +++ b/modules/install/ajax/attachmentsToThreeDirectory.php @@ -27,6 +27,24 @@ * $Id: attachmentsToThreeDirectory.php 2336 2007-04-14 22:01:51Z will $ */ +if ($_SERVER['REQUEST_METHOD'] !== 'POST') +{ + header('Content-Type: text/html; charset=UTF-8'); + + $actionURL = htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); + + echo '', + 'This maintenance action must be triggered via POST.
', + 'This starts the attachment migration to the three-directory layout.
', + '', + ''; + die(); +} + include_once('./config.php'); include_once(LEGACY_ROOT . '/lib/DatabaseConnection.php'); diff --git a/modules/install/ajax/maint.php b/modules/install/ajax/maint.php index 020d99e6b..3a3fba924 100755 --- a/modules/install/ajax/maint.php +++ b/modules/install/ajax/maint.php @@ -27,6 +27,24 @@ * $Id: maint.php 3346 2007-10-29 22:40:53Z brian $ */ +if ($_SERVER['REQUEST_METHOD'] !== 'POST') +{ + header('Content-Type: text/html; charset=UTF-8'); + + $actionURL = htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); + + echo '', + 'This maintenance action must be triggered via POST.
', + 'This page starts maintenance mode and related installer tasks.
', + '', + ''; + die(); +} + if (file_exists('./modules.cache')) { @unlink('./modules.cache'); diff --git a/modules/install/ajax/ui.php b/modules/install/ajax/ui.php index d9443f96c..301d00067 100755 --- a/modules/install/ajax/ui.php +++ b/modules/install/ajax/ui.php @@ -42,6 +42,13 @@ } @ini_set('memory_limit', '192M'); +if ($_SERVER['REQUEST_METHOD'] !== 'POST') +{ + die('Invalid request.'); +} + +$_REQUEST = $_POST; + if (file_exists('modules.cache')) @unlink('modules.cache'); if (!isset($_REQUEST['a']) || empty($_REQUEST['a'])) diff --git a/modules/joborders/ConsiderSearchModal.tpl b/modules/joborders/ConsiderSearchModal.tpl index 160bb7329..c5cad4193 100755 --- a/modules/joborders/ConsiderSearchModal.tpl +++ b/modules/joborders/ConsiderSearchModal.tpl @@ -70,15 +70,25 @@