diff --git a/admin-dev/ajaxfilemanager/ajax_file_upload.php b/admin-dev/ajaxfilemanager/ajax_file_upload.php
index 309490e06..b21a39c13 100755
--- a/admin-dev/ajaxfilemanager/ajax_file_upload.php
+++ b/admin-dev/ajaxfilemanager/ajax_file_upload.php
@@ -60,7 +60,7 @@
$tem[$k] = $v;
}
- $tem['path'] = backslashToSlash($path);
+ $tem['path'] = addslashes(backslashToSlash($path));
$tem['type'] = "file";
$tem['size'] = transformFileSize($tem['size']);
$tem['ctime'] = date(DATE_TIME_FORMAT, $tem['ctime']);
@@ -73,7 +73,7 @@
$info .= sprintf(", %s:'%s'", $k, $v);
}
- $info .= sprintf(", url:'%s'", getFileUrl($path));
+ $info .= sprintf(", url:'%s'", addslashes(getFileUrl($path)));
$info .= sprintf(", tipedit:'%s'", TIP_DOC_RENAME);
diff --git a/admin-dev/ajaxfilemanager/ajax_get_file_listing.php b/admin-dev/ajaxfilemanager/ajax_get_file_listing.php
index 133486637..c72110344 100755
--- a/admin-dev/ajaxfilemanager/ajax_get_file_listing.php
+++ b/admin-dev/ajaxfilemanager/ajax_get_file_listing.php
@@ -99,9 +99,9 @@
{
$v = transformFileSize($v);
}
- echo (($j++ > 1)?",":'') . "'" . $k . "':'" . $v . "'";
+ echo (($j++ > 1)?",":'') . "'" . addslashes($k) . "':'" . addslashes($v) . "'";
}
- echo (($j++ > 1)?",":'') . "'url':'" . getFileUrl($file['path']) . "'";
+ echo (($j++ > 1)?",":'') . "'url':'" . addslashes(getFileUrl($file['path'])) . "'";
echo "}\n";
}
echo "};\n";
diff --git a/admin-dev/ajaxfilemanager/inc/class.file.php b/admin-dev/ajaxfilemanager/inc/class.file.php
index 85512eb02..d35ff7a33 100755
--- a/admin-dev/ajaxfilemanager/inc/class.file.php
+++ b/admin-dev/ajaxfilemanager/inc/class.file.php
@@ -33,15 +33,15 @@
$this->fileInfo['atime'] = $this->fileStat[8];
$this->fileInfo['ctime'] = $this->fileStat[10];
$this->fileInfo['mtime'] = $this->fileStat[9];
- $this->fileInfo['path'] = $path;
- $this->fileInfo['name'] = basename($path);
+ $this->fileInfo['path'] = addslashes($path);
+ $this->fileInfo['name'] = addslashes(basename($path));
$this->fileInfo['is_writable'] = $this->isWritable();
$this->fileInfo['is_readable'] = $this->isReadable();
}elseif(is_dir($this->filePath))
{
$this->fileStat = @stat($path);
- $this->fileInfo['name'] = basename($path);
- $this->fileInfo['path'] = $path;
+ $this->fileInfo['name'] = addslashes(basename($path));
+ $this->fileInfo['path'] = addslashes($path);
$this->fileInfo['atime'] = $this->fileStat[8];
$this->fileInfo['ctime'] = $this->fileStat[10];
$this->fileInfo['mtime'] = $this->fileStat[9];
diff --git a/admin-dev/get-file-admin.php b/admin-dev/get-file-admin.php
index b37f691e5..39fcd8a85 100644
--- a/admin-dev/get-file-admin.php
+++ b/admin-dev/get-file-admin.php
@@ -25,5 +25,5 @@
*/
define('_PS_ADMIN_DIR_', getcwd());
-require(_PS_ADMIN_DIR_.'/config/config.inc.php');
+require(_PS_ADMIN_DIR_.'/../config/config.inc.php');
Controller::getController('GetFileController')->run();
\ No newline at end of file
diff --git a/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl b/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl
index 532b87e80..72beec990 100644
--- a/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl
+++ b/admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl
@@ -49,8 +49,10 @@
if (perm == 'all' && $(this).parent().parent().hasClass('parent'))
{
- checked = enabled ? 'checked': '';
- $(this).parent().parent().parent().find('.child-'+id_tab+' input[type=checkbox]').attr('checked', checked);
+ if (enabled)
+ $(this).parent().parent().parent().find('.child-'+id_tab+' input[type=checkbox]').attr('checked', 'checked');
+ else
+ $(this).parent().parent().parent().find('.child-'+id_tab+' input[type=checkbox]').removeAttr('checked');
$.ajax({
url: "{$link->getAdminLink('AdminAccess')|addslashes}",
cache: false,
@@ -68,15 +70,12 @@
},
success : function(res,textStatus,jqXHR)
{
- try
- {
+ try {
if (res == 'ok')
showSuccessMessage("{l s='Update successful'}");
else
showErrorMessage("{l s='Update error'}");
- }
- catch(e)
- {
+ } catch(e) {
jAlert('Technical error');
}
}
diff --git a/admin-dev/themes/default/template/controllers/orders/form.tpl b/admin-dev/themes/default/template/controllers/orders/form.tpl
index ca178d9a5..3593e5cae 100755
--- a/admin-dev/themes/default/template/controllers/orders/form.tpl
+++ b/admin-dev/themes/default/template/controllers/orders/form.tpl
@@ -28,13 +28,13 @@
var changed_shipping_price = false;
var shipping_price_selected_carrier = '';
var current_index = '{$current}&token={$token}';
- var admin_cart_link = '{$link->getAdminLink('AdminCarts')|escape:'html'}';
+ var admin_cart_link = '{$link->getAdminLink('AdminCarts')|addslashes}';
var cart_quantity = new Array();
var currencies = new Array();
var id_currency = '';
var id_lang = '';
- var txt_show_carts = '{l s='Show carts and orders for this customer.'}';
- var txt_hide_carts = '{l s='Hide carts and orders for this customer.'}';
+ var txt_show_carts = '{l s='Show carts and orders for this customer.' js='1'}';
+ var txt_hide_carts = '{l s='Hide carts and orders for this customer.' js='1'}';
var defaults_order_state = new Array();
var customization_errors = false;
var pic_dir = '{$pic_dir}';
@@ -661,17 +661,17 @@
{
$.each(this.customized_datas[this.id_product][this.id_product_attribute][id_address_delivery], function() {
var customized_desc = '';
- if(this.datas[1].length)
+ if (this.datas[1].length)
{
$.each(this.datas[1],function() {
- customized_desc += this.name+':'+this.value+'
';
+ customized_desc += this.name + ': ' + this.value + '
';
id_customization = this.id_customization;
});
}
- if(this.datas[0] && this.datas[0].length)
+ if (this.datas[0] && this.datas[0].length)
{
$.each(this.datas[0],function() {
- customized_desc += this.name+':
';
+ customized_desc += this.name + ':
';
id_customization = this.id_customization;
});
}
diff --git a/admin-dev/themes/default/template/controllers/products/virtualproduct.tpl b/admin-dev/themes/default/template/controllers/products/virtualproduct.tpl
index 6f46e7704..0a6c0d865 100644
--- a/admin-dev/themes/default/template/controllers/products/virtualproduct.tpl
+++ b/admin-dev/themes/default/template/controllers/products/virtualproduct.tpl
@@ -159,7 +159,10 @@
{/if}