From 56ba9a8347cd6ac5cca08811e403eb72b629e7f8 Mon Sep 17 00:00:00 2001 From: Daniel Schwen Date: Thu, 11 Feb 2016 13:36:48 -0700 Subject: [PATCH] Move security check into Functions.php and fix it (#309) --- churchinfo/AddEvent.php | 14 +- churchinfo/AutoPaymentDelete.php | 4 +- churchinfo/AutoPaymentEditor.php | 169 ++++---- churchinfo/BackupDatabase.php | 14 +- churchinfo/BatchWinnerEntry.php | 10 +- churchinfo/CSVExport.php | 14 +- churchinfo/CSVImport.php | 16 +- churchinfo/Canvas05Editor.php | 34 +- churchinfo/CanvassAutomation.php | 37 +- churchinfo/CanvassEditor.php | 43 +- churchinfo/CartToEvent.php | 8 +- churchinfo/CartToFamily.php | 6 +- churchinfo/CartToGroup.php | 4 +- churchinfo/CartView.php | 17 +- churchinfo/CheckVersion.php | 2 +- churchinfo/Checkin.php | 94 ++--- churchinfo/Default.php | 31 +- churchinfo/DepositSlipEditor.php | 134 +++--- churchinfo/DirectoryReports.php | 56 ++- churchinfo/DonatedItemDelete.php | 2 +- churchinfo/DonatedItemEditor.php | 68 ++-- churchinfo/DonationFundEditor.php | 22 +- churchinfo/EditEventAttendees.php | 41 +- churchinfo/EditEventTypes.php | 12 +- churchinfo/ElectronicPaymentList.php | 28 +- churchinfo/EventAttendance.php | 15 +- churchinfo/EventEditor.php | 32 +- churchinfo/EventNames.php | 25 +- churchinfo/FamilyCustomFieldsEditor.php | 10 +- churchinfo/FamilyEditor.php | 68 ++-- churchinfo/FamilyList.php | 6 +- churchinfo/FamilyView.php | 100 +++-- churchinfo/FinancialReports.php | 8 +- churchinfo/FindDepositSlip.php | 4 +- churchinfo/FindFundRaiser.php | 5 +- churchinfo/FundRaiserEditor.php | 30 +- churchinfo/GenerateSeedData.php | 2 +- churchinfo/GetText.php | 4 +- churchinfo/GroupEditor.php | 11 +- churchinfo/GroupList.php | 6 +- churchinfo/GroupMeeting.php | 5 +- churchinfo/GroupPropsEditor.php | 12 +- churchinfo/GroupPropsFormEditor.php | 30 +- churchinfo/GroupReports.php | 39 +- churchinfo/GroupView.php | 36 +- churchinfo/ImageDelete.php | 2 +- churchinfo/ImageUpload.php | 2 +- churchinfo/Include/CountryDropDown.php | 128 +++--- churchinfo/Include/Functions.php | 382 ++++++++++-------- churchinfo/Include/Header-function.php | 61 +-- churchinfo/Include/HeaderNotLoggedIn.php | 4 +- churchinfo/LettersAndLabels.php | 14 +- churchinfo/ListEvents.php | 10 +- churchinfo/ManageEnvelopes.php | 2 +- churchinfo/MapUsingGoogle.php | 7 +- churchinfo/MemberRoleChange.php | 7 +- churchinfo/MembersDashboard.php | 11 +- churchinfo/Menu.php | 37 +- churchinfo/NoteDelete.php | 4 +- churchinfo/NoteEditor.php | 4 +- churchinfo/OptionManager.php | 16 +- churchinfo/PaddleNumDelete.php | 2 +- churchinfo/PaddleNumEditor.php | 4 +- churchinfo/PaddleNumList.php | 14 +- churchinfo/PersonCustomFieldsEditor.php | 30 +- churchinfo/PersonEditor.php | 52 ++- churchinfo/PersonToGroup.php | 8 +- churchinfo/PersonView.php | 66 ++- churchinfo/PledgeDelete.php | 4 +- churchinfo/PledgeDetails.php | 4 +- churchinfo/PledgeEditor.php | 37 +- churchinfo/PrintView.php | 6 +- churchinfo/PropertyAssign.php | 6 +- churchinfo/PropertyDelete.php | 4 +- churchinfo/PropertyEditor.php | 11 +- churchinfo/PropertyTypeDelete.php | 6 +- churchinfo/PropertyTypeEditor.php | 5 +- churchinfo/PropertyUnassign.php | 8 +- churchinfo/QuerySQL.php | 6 +- churchinfo/QueryView.php | 14 +- churchinfo/RPCdummy.php | 6 +- churchinfo/Register.php | 10 +- churchinfo/ReminderReport.php | 4 +- churchinfo/ReportList.php | 5 +- churchinfo/Reports/SundaySchoolClassList.php | 8 +- churchinfo/SelectDelete.php | 23 +- churchinfo/SelectList.php | 27 +- churchinfo/SettingsGeneral.php | 4 +- churchinfo/SettingsReport.php | 2 +- churchinfo/SettingsUser.php | 6 +- churchinfo/SundaySchool.php | 8 +- churchinfo/SundaySchoolClassView.php | 48 +-- churchinfo/TaxReport.php | 8 +- churchinfo/UserDelete.php | 6 +- churchinfo/UserEditor.php | 7 +- churchinfo/UserList.php | 4 +- churchinfo/UserPasswordChange.php | 12 +- churchinfo/UserReset.php | 6 +- churchinfo/VolunteerOpportunityEditor.php | 9 +- churchinfo/WhyCameEditor.php | 20 +- churchinfo/eGive.php | 22 +- churchinfo/mailchimp/MailChimpDashboard.php | 6 +- .../mailchimp/MailChimpMissingReport.php | 6 +- .../vendor/fpdf17/makefont/makefont.php | 4 +- churchinfo/vendor/google-map/GoogleMap.php | 4 +- .../sdk-php-1.8.0/lib/AuthorizeNetARB.php | 2 +- .../sdk-php-1.8.0/lib/AuthorizeNetCIM.php | 2 +- .../sdk-php-1.8.0/lib/AuthorizeNetTD.php | 2 +- 108 files changed, 1223 insertions(+), 1354 deletions(-) mode change 100755 => 100644 churchinfo/eGive.php diff --git a/churchinfo/AddEvent.php b/churchinfo/AddEvent.php index 3526006c8a..a0a4c14e74 100644 --- a/churchinfo/AddEvent.php +++ b/churchinfo/AddEvent.php @@ -118,10 +118,10 @@

-

@@ -174,7 +174,7 @@ - +
@@ -309,8 +309,8 @@ - - + + - + diff --git a/churchinfo/AutoPaymentDelete.php b/churchinfo/AutoPaymentDelete.php index 204d374e66..bbc4ccb4b4 100644 --- a/churchinfo/AutoPaymentDelete.php +++ b/churchinfo/AutoPaymentDelete.php @@ -75,6 +75,4 @@ - + diff --git a/churchinfo/AutoPaymentEditor.php b/churchinfo/AutoPaymentEditor.php index 63b34433db..bcb906906a 100644 --- a/churchinfo/AutoPaymentEditor.php +++ b/churchinfo/AutoPaymentEditor.php @@ -42,7 +42,7 @@ $tEmail=$fam_Email; $iInterval = 1; $iFund = 1; - + $bEnableBankDraft=0; $bEnableCreditCard=0; @@ -58,9 +58,9 @@ $tRoute=""; $tAccount=""; $tAccountVanco=""; - + $nAmount = 0; - + $sSQL = "INSERT INTO autopayment_aut ( aut_FamID, aut_EnableBankDraft, @@ -117,9 +117,9 @@ "'" . 1 . "'," . "'" . date ("YmdHis") . "'," . $_SESSION['iUserID'] . - ")"; + ")"; RunQuery($sSQL); - + $sSQL = "SELECT MAX(aut_ID) AS iAutID FROM autopayment_aut"; $rsAutID = RunQuery($sSQL); extract(mysql_fetch_array($rsAutID)); @@ -165,7 +165,7 @@ $tCreditCard = FilterInput ($_POST["CreditCard"]); $tExpMonth = FilterInput ($_POST["ExpMonth"]); $tExpYear = FilterInput ($_POST["ExpYear"]); - + $tBankName = FilterInput ($_POST["BankName"]); $tRoute = FilterInput ($_POST["Route"]); $tAccount = FilterInput ($_POST["Account"]); @@ -260,7 +260,7 @@ $customerid = "$iAutID"; // This is an optional value that can be used to indicate a unique customer ID that is used in your system // put aut_ID into the $customerid field // Create object to preform API calls - + $workingobj = new VancoTools($VancoUserid, $VancoPassword, $VancoClientid, $VancoEnc_key, $VancoTest); // Call Login API to receive a session ID to be used in future API calls $sessionid = $workingobj->vancoLoginRequest(); @@ -269,7 +269,7 @@ } ?> - @@ -482,7 +482,7 @@ function VancoErrorString (errNo) case 1070: return "Transaction Cannot Be Voided"; case 1073: return "Transaction Processed More Than 25 Minutes Ago"; case 1127: return "Declined - Tran Not Permitted"; - case 1128: return "Unable To Process, Please Try Again"; + case 1128: return "Unable To Process, Please Try Again"; } } @@ -497,24 +497,25 @@ function CreatePaymentMethod() accountNum = Account.value; if (document.getElementById("EnableCreditCard").checked) accountNum = CreditCard.value; - + $.ajax({ type: "POST", - url: "", - data: { "sessionid":"", - "nvpvar":"", - "newcustomer":"true", - "accounttype":accountType, - "accountnumber":accountNum, - "routingnumber":Route.value, - "expmonth": ExpMonth.value, - "expyear": ExpYear.value, + url: "", + data: { "sessionid":"", + "nvpvar":"", + "newcustomer":"true", + "accounttype":accountType, + "accountnumber":accountNum, + "routingnumber":Route.value, + "expmonth": ExpMonth.value, + "expyear": ExpYear.value, "email": Email.value, - "name":FirstName.value + " " + LastName.value, - "billingaddr1":Address1.value, - "billingcity":City.value, - "billingstate":State.value, - "billingzip":Zip.value, + "name":FirstName.value + " " + LastName.value, + "billingaddr1":Address1.value, + "billingcity":City.value, + "billingstate":State.value, + "billingzip":Zip.value, "name_on_card":FirstName.value + " " + LastName.value }, dataType: 'jsonp', @@ -525,7 +526,7 @@ function CreatePaymentMethod() var errorList = vancodata["errorlist"]; $.ajax({ type: "POST", - url: "", + url: "", data: vancodata, dataType: 'json', async: true, @@ -545,9 +546,9 @@ function CreatePaymentMethod() errorArr = errorList.split(','); errorStr = ""; for (var i = 0; i < errorArr.length; i++) - errorStr += "Error " + errorArr[i] + ": " + VancoErrorString(Number(errorArr[i])) + "\n"; + errorStr += "Error " + errorArr[i] + ": " + VancoErrorString(Number(errorArr[i])) + "\n"; alert (errorStr); - window.location = ""; + window.location = ""; } }, error: function (jqXHR, textStatus, errorThrown, nashuadata) { @@ -563,7 +564,7 @@ function CreatePaymentMethod() }); } - @@ -598,7 +599,7 @@ function CreatePaymentMethod() if ($iFamily == $fam_ID) { echo " selected"; } echo ">" . $fam_Name . " " . FormatAddressLine($fam_Address1, $fam_City, $fam_State); } - ?> + ?> @@ -624,13 +625,13 @@ function CreatePaymentMethod() - - + + - - + + @@ -652,130 +653,130 @@ function CreatePaymentMethod() if ($fun_active != 'true') echo " (" . gettext("inactive") . ")"; echo "" ; } - ?> + ?> - + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - - + + - - - + + - - + + - - + + - - + + - - - - + + + - - - - + + + - - 0) { ?> - Save this record to enable storing private data at Vanco - - @@ -786,6 +787,4 @@ function CreatePaymentMethod() - + diff --git a/churchinfo/BackupDatabase.php b/churchinfo/BackupDatabase.php index adc613073a..e8a2074f5d 100644 --- a/churchinfo/BackupDatabase.php +++ b/churchinfo/BackupDatabase.php @@ -29,7 +29,7 @@ if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') { die ("The Backup Utility will not work on a Windows based Server"); -} +} if (isset($sGZIPname)) $hasGZIP = true; if (isset($sZIPname)) $hasZIP = true; @@ -79,7 +79,7 @@
- + - + diff --git a/churchinfo/BatchWinnerEntry.php b/churchinfo/BatchWinnerEntry.php index 599d85bcb0..cd4c05bd84 100644 --- a/churchinfo/BatchWinnerEntry.php +++ b/churchinfo/BatchWinnerEntry.php @@ -52,12 +52,12 @@ // Get Items for the drop-down $sDonatedItemsSQL = "SELECT di_ID, di_Item, di_title, di_multibuy FROM donateditem_di - WHERE di_FR_ID = '" . $iCurrentFundraiser . "' ORDER BY SUBSTR(di_Item,1,1), CONVERT(SUBSTR(di_Item,2,3),SIGNED)"; + WHERE di_FR_ID = '" . $iCurrentFundraiser . "' ORDER BY SUBSTR(di_Item,1,1), CONVERT(SUBSTR(di_Item,2,3),SIGNED)"; $rsDonatedItems = RunQuery($sDonatedItemsSQL); //Get Paddles for the drop-down -$sPaddleSQL = "SELECT pn_ID, pn_Num, pn_per_ID, - a.per_FirstName AS buyerFirstName, +$sPaddleSQL = "SELECT pn_ID, pn_Num, pn_per_ID, + a.per_FirstName AS buyerFirstName, a.per_LastName AS buyerLastName FROM paddlenum_pn LEFT JOIN person_per a on a.per_ID=pn_per_ID @@ -116,6 +116,4 @@ - + diff --git a/churchinfo/CSVExport.php b/churchinfo/CSVExport.php index c3e4c1375b..d110166688 100644 --- a/churchinfo/CSVExport.php +++ b/churchinfo/CSVExport.php @@ -29,7 +29,7 @@ require "Include/Functions.php"; // If user does not have CSV Export permission, redirect to the menu. -if (!$bExportCSV) +if (!$bExportCSV) { Redirect("Menu.php"); exit; @@ -192,7 +192,7 @@ - 0) or ($numFamCustomFields > 0)) {?> + 0) or ($numFamCustomFields > 0)) { ?> 0) { ?>
@@ -258,7 +258,7 @@ { extract($aRow); ?> - + @@ -275,7 +275,7 @@ { extract($aRow); ?> - + @@ -337,7 +337,7 @@   - " id="BirthdayDate2"> + " id="BirthdayDate2">
@@ -405,6 +405,4 @@ $("#EnterDate1").datepicker({format:'yyyy-mm-dd'}); $("#EnterDate2").datepicker({format:'yyyy-mm-dd'}); - + diff --git a/churchinfo/CSVImport.php b/churchinfo/CSVImport.php index b086dae61d..9bc03e5fd3 100644 --- a/churchinfo/CSVImport.php +++ b/churchinfo/CSVImport.php @@ -118,7 +118,7 @@ function AssignRoles() // Set the page title and include HTML header $sPageTitle = "CSV Import"; -require "Include/Header.php";?> +require "Include/Header.php"; ?>
@@ -267,8 +267,8 @@ function AssignRoles()



@@ -876,10 +876,10 @@ function AssignRoles() { // Display the select file form ?> -

+


- " + " name="UploadCSV">
@@ -890,14 +890,14 @@ function AssignRoles()
- +
@@ -769,7 +769,7 @@
- > + >
@@ -796,7 +796,7 @@


- name="FamilySubmit"> + " name="FamilySubmit">
@@ -806,14 +806,14 @@
- " . $sWeddingDateError ?> +
-
+
>


- name="FamilySubmit"> + " name="FamilySubmit">
@@ -876,17 +876,17 @@


- name="FamilySubmit"> + " name="FamilySubmit">
+ if (($aSecurityType[$fam_custom_FieldSec] == 'bAll') or ($_SESSION[$aSecurityType[$fam_custom_FieldSec]])) { ?>
- +


- name="FamilySubmit"> + " name="FamilySubmit">
@@ -912,7 +912,7 @@ -
new person records."); }?>


+
new person records."); } ?>


@@ -944,21 +944,21 @@ for ($iCount = 1; $iCount <= $iFamilyMemberRows; $iCount++) { - ?> - + ?> + @@ -1014,15 +1014,15 @@ - + ?> +
+ ?>   - + ".$fam_HomePhone.""; echo ""; diff --git a/churchinfo/FamilyView.php b/churchinfo/FamilyView.php index 336205b0f3..01c649d95e 100644 --- a/churchinfo/FamilyView.php +++ b/churchinfo/FamilyView.php @@ -185,9 +185,9 @@ function getFamilyPhoto($iFamilyID) { ?>
0)) { ?> - + - Manage Family + Manage Family



@@ -220,11 +220,11 @@ function getFamilyPhoto($iFamilyID) {
- -

- - Edit - + +

+ + Edit +
  • Address: @@ -326,10 +326,10 @@ function getFamilyPhoto($iFamilyID) {
+
- +
- + - + - + @@ -1000,13 +1000,13 @@ - - + ?> + @@ -1074,6 +1074,4 @@ $("#WeddingDate").datepicker({format:'yyyy-mm-dd'}); - + diff --git a/churchinfo/FamilyList.php b/churchinfo/FamilyList.php index ac6ed26faa..2e4fa9fcbf 100644 --- a/churchinfo/FamilyList.php +++ b/churchinfo/FamilyList.php @@ -46,19 +46,19 @@ extract($aRow); ?>
+ - + - ".$fam_Address1." ".$fam_Address2." - + - +


-
+

@@ -536,29 +536,29 @@ function getFamilyPhoto($iFamilyID) { else $sRowClass = "RowColorB"; - ?> + ?> -
-   +   -   +   -   +   -   +   -   +   - Edit + Edit - Delete + Delete   @@ -572,7 +572,7 @@ function getFamilyPhoto($iFamilyID) {

- +

@@ -650,29 +650,29 @@ function getFamilyPhoto($iFamilyID) { $sRowClass = "PaymentRowColorB"; } - ?> + ?> - + -   +   -   +   -   +   -   +   -   +   -   +   -   +     @@ -681,10 +681,10 @@ function getFamilyPhoto($iFamilyID) {   - Edit + Edit - Delete + Delete   @@ -698,13 +698,13 @@ function getFamilyPhoto($iFamilyID) { } } // if bShowPledges - ?> + ?>

- - + +

@@ -712,7 +712,7 @@ function getFamilyPhoto($iFamilyID) {

- +

@@ -735,7 +735,7 @@ function getFamilyPhoto($iFamilyID) { //Loop through all the notes while($aRow = mysql_fetch_array($rsNotes)){ extract($aRow); - ?> + ?>
@@ -752,19 +752,19 @@ function getFamilyPhoto($iFamilyID) { echo $EnteredFirstName . " " . $EnteredLastName; } else { echo $EditedFirstName . " " . $EditedLastName; - }?> + } ?> - +

- + - + @@ -788,11 +788,11 @@ function getFamilyPhoto($iFamilyID) { @@ -178,7 +178,7 @@
- +
@@ -301,11 +301,11 @@
- +
- +
- +
@@ -493,7 +493,7 @@
-

+

@@ -512,7 +512,7 @@
- +
@@ -520,7 +520,7 @@
- - + diff --git a/churchinfo/ImageDelete.php b/churchinfo/ImageDelete.php index 00e557fd0f..63fc3deec1 100644 --- a/churchinfo/ImageDelete.php +++ b/churchinfo/ImageDelete.php @@ -27,4 +27,4 @@ Redirect($redirectURL); -?> \ No newline at end of file +?> diff --git a/churchinfo/ImageUpload.php b/churchinfo/ImageUpload.php index 120f39d99e..5cc390c9cc 100644 --- a/churchinfo/ImageUpload.php +++ b/churchinfo/ImageUpload.php @@ -66,4 +66,4 @@ } else { Redirect($redirectURL . "&ProfileImageUploadedError=true"); } -?> \ No newline at end of file +?> diff --git a/churchinfo/Include/CountryDropDown.php b/churchinfo/Include/CountryDropDown.php index b51d46acba..5da2525e68 100644 --- a/churchinfo/Include/CountryDropDown.php +++ b/churchinfo/Include/CountryDropDown.php @@ -28,31 +28,31 @@