Subversion Repositories ALCASAR

Compare Revisions

Ignore whitespace Rev 2195 → Rev 2197

/CHANGELOG
18,6 → 18,7
- Fix broken SQL library path in autoregistration.php.
- Fix loop redirection after connection in case of imputability logs warn.
- Fix test if installed on a VMware
- Fix ticket print link after user creation.
SECU
- Fix vulnerabilities in the user part (1 SQL injection & 2 XSS).
- Remove ALCASAR version visible in the user part.
/web/acc/manager/htdocs/user_new.php
136,17 → 136,17
if ($show != 3) //utilisateur normal
{
//Appel du ticket d'impression , passage en paramètres des valeurs à afficher
echo' <form name="impression" method="post" action="ticket_user.php" target=_blank>
echo' <form name="impression" method="post" action="ticket_user.php" target="_blank">
<input type="hidden" name="langue_imp" value="'.$langue_imp.'">
<input type="hidden" name="log_imp" value="'.$login.'">
<input type="hidden" name="log_imp" value="'.$login.'">
<input type="hidden" name="passwd_imp" value="'.$passwd_imp.'">
<input type="hidden" name="sto_imp" value="'.$sto_imp.'">
<input type="hidden" name="mas_imp" value="'.$mas_imp.'">
<input type="hidden" name="mds_imp" value="'.$mds_imp.'">
<input type="hidden" name="mms_imp" value="'.$mms_imp.'">
<input type="hidden" name="exp_imp" value="'.$Expiration.'">
<input type="hidden" name="sto_imp" value="'.$sto_imp.'">
<input type="hidden" name="mas_imp" value="'.$mas_imp.'">
<input type="hidden" name="mds_imp" value="'.$mds_imp.'">
<input type="hidden" name="mms_imp" value="'.$mms_imp.'">
<input type="hidden" name="exp_imp" value="'.$Expiration.'">
</form>';
echo' <script type="text/javascript"> document.forms["impression"].submit();</script>';
echo' <a href="#" onclick="document.forms[\'impression\'].submit();">Ticket</a>';
//fin ticket impression
}
else //utilisateur = adresse mac
427,8 → 427,6
echo "</table>";
if($create == 1)
{
$ticket_name="ticket_".$login.".pdf";
echo "<a href=\"$ticket_name\">Ticket</a><br/><br/>";
echo "<center><a href=\"user_admin.php?login=$login\">$l_show_profile</a></center>";
}
else