Download as
Browse Code »

Commit b06bcef9f243fc28e35899b16e471f7a6e2438c0

Authored by Edmar Moretti
1 parent f0a58e72
Exists in master and in 7 other branches composer, doc-root, docker, guia, licenca, readme, unmaintened

Atualização do sistema de adm

Showing 28 changed files with 197 additions and 156 deletions   Show diff stats
admin/abrefontemapfile.php
View file @f0a58e7
... ... @@ -1,73 +0,0 @@
1   -<html>
2   -<style>
3   -body {
4   - font: 14pt arial, helvetica, clean, sans-serif;
5   - color: rgb(100, 100, 100);
6   -}
7   -</style>
8   -<body>
9   - <?php
10   - /*
11   - Title: abrefontemapfile
12   -
13   - Abre no navegador a p&aacute;gina com os metadados sobre um tema.
14   -
15   - O link para os metadados &eacute; obtido do banco de administra&ccedil;&atilde;o.
16   -
17   - Para usar esse programa digite <http://localhost/i3geo/admin/abrefontemapfile.php?tema=codigo>
18   -
19   - Parametro:
20   -
21   - tema {string} - codigo do tema (nome do mapfile existente em i3geo/temas)
22   -
23   - Licenca:
24   -
25   - GPL2
26   -
27   - i3Geo Interface Integrada de Ferramentas de Geoprocessamento para Internet
28   -
29   - Direitos Autorais Reservados (c) 2006 Minist&eacute;rio do Meio Ambiente Brasil
30   - Desenvolvedor: Edmar Moretti edmar.moretti@gmail.com
31   -
32   - Este programa &eacute; software livre; voc&ecirc; pode redistribu&iacute;-lo
33   - e/ou modific&aacute;-lo sob os termos da Licen&ccedil;a P&uacute;blica Geral
34   - GNU conforme publicada pela Free Software Foundation;
35   -
36   - Este programa &eacute; distribu&iacute;do na expectativa de que seja &uacute;til,
37   - por&eacute;m, SEM NENHUMA GARANTIA; nem mesmo a garantia impl&iacute;cita
38   - de COMERCIABILIDADE OU ADEQUA&Ccedil;&Atilde;O A UMA FINALIDADE ESPEC&Iacute;FICA.
39   - Consulte a Licen&ccedil;a P&uacute;blica Geral do GNU para mais detalhes.
40   - Voc&ecirc; deve ter recebido uma cópia da Licen&ccedil;a P&uacute;blica Geral do
41   - GNU junto com este programa; se n&atilde;o, escreva para a
42   - Free Software Foundation, Inc., no endere&ccedil;o
43   - 59 Temple Street, Suite 330, Boston, MA 02111-1307 USA.
44   -
45   - Arquivo:
46   -
47   - i3geo/admin/abrefontemapfile.php
48   - */
49   - error_reporting(0);
50   - if(!isset($locaplic))
51   - {
52   - $locaplic = "";
53   - include(dirname(__FILE__)."/../ms_configura.php");
54   - }
55   - include_once($locaplic."/classesphp/pega_variaveis.php");
56   - include_once($locaplic."/admin/php/admin.php");
57   - if(!isset($tema))
58   - {
59   - echo "Nenhum tema definido.";exit;
60   - }
61   - $editor = verificaEditores($editores);
62   - $dbh = "";
63   - include($locaplic."/admin/php/conexao.php");
64   - $r = pegaDados("select * from ".$esquemaadmin."i3geoadmin_temas where codigo_tema = '$tema'");
65   - error_reporting(0);
66   - $link = $r[0]["link_tema"];
67   - if($link == "")
68   - {
69   - echo "O link para a fonte n&atilde;o est&aacute; cadastrado. Entre em contato com o administrador do sistema.";
70   - }
71   - else
72   - {echo "<meta http-equiv='refresh' content='0;url=$link'>";}
73   -?>
74 0 \ No newline at end of file
admin/admin.db
View file @b06bcef
No preview for this file type
admin/php/admin.php
  Diff comments   View file @b06bcef
... ... @@ -41,7 +41,8 @@ if(!file_exists($dir_tmp)){
41 41 @mkdir ($dir_tmp,0744);
42 42 chmod($dir_tmp,0744);
43 43 }
44   -include_once($locaplic."/classesphp/pega_variaveis.php");
  44 +//TODO retirar daqui
  45 +//include_once($locaplic."/classesphp/pega_variaveis.php");
45 46 error_reporting(0);
46 47  
47 48 //
... ... @@ -66,7 +67,8 @@ if(!empty($esquemaadmin)){
66 67 function testaNumerico($valores){
67 68 foreach ($valores as $valor) {
68 69 if(!empty($valor) && !is_numeric($valor)) {
69   - echo "valor nao numerico";
  70 + ob_clean();
  71 + header ( "HTTP/1.1 403 valor nao numerico" );
70 72 exit;
71 73 }
72 74 }
... ...
admin/php/arvore.php
  Diff comments   View file @b06bcef
... ... @@ -42,6 +42,9 @@ Cada opera&amp;ccedil;&amp;atilde;o possu&amp;iacute; seus próprios par&amp;acirc;metros, que de
42 42  
43 43 */
44 44 include_once(dirname(__FILE__)."/login.php");
  45 +$id = $_GET["id"];
  46 +testaNumerico([$id]);
  47 +
45 48 $funcoesEdicao = array(
46 49 "ADICIONARTEMARAIZ",
47 50 "ADICIONARTEMARAIZGRUPO",
... ... @@ -69,6 +72,7 @@ if($idioma == &quot;&quot;)
69 72 {
70 73 $idioma = "pt";
71 74 }
  75 +
72 76 error_reporting(0);
73 77 //faz a busca da fun&ccedil;&atilde;o que deve ser executada
74 78 switch (strtoupper($funcao))
... ... @@ -539,7 +543,8 @@ switch (strtoupper($funcao))
539 543 Altera o registro de um n&iacute;vel 3 (temas)
540 544 */
541 545 function alteraN3(){
542   - global $publicado,$n3_perfil,$id,$id_n2,$id_tema,$ordem,$esquemaadmin;
  546 + global $publicado,$id,$id_n2,$id_tema,$ordem,$esquemaadmin;
  547 + $n3_perfil = $_GET["n3_perfil"];
543 548 try {
544 549 require_once("conexao.php");
545 550 if($id != ""){
... ... @@ -576,7 +581,8 @@ function alteraN3(){
576 581 Altera o registro de um n&iacute;vel 2
577 582 */
578 583 function alteraN2(){
579   - global $publicado,$n2_perfil,$id,$id_subgrupo,$id_n1,$esquemaadmin;
  584 + global $publicado,$id,$id_subgrupo,$id_n1,$esquemaadmin;
  585 + $n2_perfil = $_GET["n2_perfil"];
580 586 try {
581 587 require("conexao.php");
582 588 if($id != ""){
... ... @@ -612,7 +618,8 @@ function alteraN2(){
612 618 Altera o registro de um n&iacute;vel 1 (grupos)
613 619 */
614 620 function alteraN1(){
615   - global $publicado,$n1_perfil,$id_grupo,$id,$id_menu,$esquemaadmin;
  621 + global $publicado,$id_grupo,$id,$id_menu,$esquemaadmin;
  622 + $n1_perfil = $_GET["n1_perfil"];
616 623 try{
617 624 require("conexao.php");
618 625 if($id != ""){
... ...
admin/php/atlas.php
  Diff comments   View file @b06bcef
... ... @@ -40,6 +40,13 @@ Cada opera&amp;ccedil;&amp;atilde;o possu&amp;iacute; seus proprios par&amp;acirc;metros, que de
40 40  
41 41 */
42 42 include_once(dirname(__FILE__)."/login.php");
  43 +
  44 +$id = $_GET["id"];
  45 +$id_atlas = $_GET["id_atlas"];
  46 +$id_prancha = $_GET["id_prancha"];
  47 +
  48 +testaSafeNumerico([$id,$id_atlas,$id_prancha]);
  49 +
43 50 $funcoesEdicao = array(
44 51 "ALTERARATLAS",
45 52 "ALTERARPRANCHA",
... ... @@ -437,27 +444,27 @@ function dadosAtlas()
437 444 }
438 445 function alterarAtlas()
439 446 {
440   - global $esquemaadmin,$publicado_atlas,$id_atlas,$basemapfile_atlas,$desc_atlas,$h_atlas,$w_atlas,$icone_atlas,$link_atlas,$pranchadefault_atlas,$template_atlas,$tipoguias_atlas,$titulo_atlas,$ordem_atlas;
  447 + global $esquemaadmin,$id_atlas;
441 448 try{
442 449 include("conexao.php");
443 450 if($id_atlas != ""){
444 451 if($convUTF){
445   - $desc_atlas = utf8_encode($desc_atlas);
446   - $titulo_atlas = utf8_encode($titulo_atlas);
  452 + $_GET["desc_atlas"] = utf8_encode($_GET["desc_atlas"]);
  453 + $_GET["titulo_atlas"] = utf8_encode($_GET["titulo_atlas"]);
447 454 }
448 455 $dataCol = array(
449   - "publicado_atlas"=>$publicado_atlas,
450   - "ordem_atlas"=>$ordem_atlas == "" ? 0 : $ordem_atlas,
451   - "basemapfile_atlas"=>$basemapfile_atlas,
452   - "desc_atlas"=>$desc_atlas,
453   - "h_atlas"=>$h_atlas == "" ? 0 : $h_atlas,
454   - "w_atlas"=>$w_atlas == "" ? 0 : $w_atlas,
455   - "icone_atlas"=>$icone_atlas,
456   - "link_atlas"=>$link_atlas,
457   - "pranchadefault_atlas"=>$pranchadefault_atlas,
458   - "template_atlas"=>$template_atlas,
459   - "tipoguias_atlas"=>$tipoguias_atlas,
460   - "titulo_atlas"=>$titulo_atlas
  456 + "publicado_atlas"=>$_GET["publicado_atlas"],
  457 + "ordem_atlas"=>$_GET["ordem_atlas"] == "" ? 0 : $_GET["ordem_atlas"],
  458 + "basemapfile_atlas"=>$_GET["basemapfile_atlas"],
  459 + "desc_atlas"=>$_GET["desc_atlas"],
  460 + "h_atlas"=>$_GET["h_atlas"] == "" ? 0 : $_GET["h_atlas"],
  461 + "w_atlas"=>$_GET["w_atlas"] == "" ? 0 : $_GET["w_atlas"],
  462 + "icone_atlas"=>$_GET["icone_atlas"],
  463 + "link_atlas"=>$_GET["link_atlas"],
  464 + "pranchadefault_atlas"=>$_GET["pranchadefault_atlas"],
  465 + "template_atlas"=>$_GET["template_atlas"],
  466 + "tipoguias_atlas"=>$_GET["tipoguias_atlas"],
  467 + "titulo_atlas"=>$_GET["titulo_atlas"]
461 468 );
462 469 i3GeoAdminUpdate($dbhw,"i3geoadmin_atlas",$dataCol,"WHERE id_atlas = $id_atlas");
463 470 $retorna = $id_atlas;
... ... @@ -492,23 +499,24 @@ function alterarAtlas()
492 499 }
493 500 function alterarPrancha()
494 501 {
495   - global $esquemaadmin,$mapext_prancha,$id_atlas,$id_prancha,$desc_prancha,$h_prancha,$w_prancha,$icone_prancha,$link_prancha,$titulo_prancha,$ordem_prancha;
  502 + global $esquemaadmin,$id_atlas,$id_prancha;
  503 +
496 504 try{
497 505 include("conexao.php");
498 506 if($id_prancha != ""){
499 507 if($convUTF){
500   - $desc_prancha = utf8_encode($desc_prancha);
501   - $titulo_prancha = utf8_encode($titulo_prancha);
  508 + $_GET["desc_prancha"] = utf8_encode($_GET["desc_prancha"]);
  509 + $_GET["titulo_prancha"] = utf8_encode($_GET["titulo_prancha"]);
502 510 }
503 511 $dataCol = array(
504   - "ordem_prancha"=>$ordem_prancha,
505   - "mapext_prancha"=>$mapext_prancha,
506   - "desc_prancha"=>$desc_prancha,
507   - "h_prancha"=>$h_prancha == "" ? 0 : $h_prancha,
508   - "w_prancha"=>$w_prancha == "" ? 0 : $w_prancha,
509   - "icone_prancha"=>$icone_prancha,
510   - "link_prancha"=>$link_prancha,
511   - "titulo_prancha"=>$titulo_prancha
  512 + "ordem_prancha"=>$_GET["ordem_prancha"],
  513 + "mapext_prancha"=>$_GET["mapext_prancha"],
  514 + "desc_prancha"=>$_GET["desc_prancha"],
  515 + "h_prancha"=>$_GET["h_prancha"] == "" ? 0 : $_GET["h_prancha"],
  516 + "w_prancha"=>$_GET["w_prancha"] == "" ? 0 : $_GET["w_prancha"],
  517 + "icone_prancha"=>$_GET["icone_prancha"],
  518 + "link_prancha"=>$_GET["link_prancha"],
  519 + "titulo_prancha"=>$_GET["titulo_prancha"]
512 520 );
513 521 i3GeoAdminUpdate($dbhw,"i3geoadmin_atlasp",$dataCol,"WHERE id_prancha = $id_prancha");
514 522 $retorna = $id_prancha;
... ... @@ -522,8 +530,8 @@ function alterarPrancha()
522 530 "ordem_prancha"=>$o,
523 531 "mapext_prancha"=>'',
524 532 "desc_prancha"=>'',
525   - "h_prancha"=>$h_prancha == "" ? 0 : $h_prancha,
526   - "w_prancha"=>$w_prancha == "" ? 0 : $w_prancha,
  533 + "h_prancha"=>$_GET["h_prancha"] == "" ? 0 : $_GET["h_prancha"],
  534 + "w_prancha"=>$_GET["w_prancha"] == "" ? 0 : $_GET["w_prancha"],
527 535 "icone_prancha"=>'',
528 536 "link_prancha"=>'',
529 537 "titulo_prancha"=>'',
... ... @@ -540,14 +548,14 @@ function alterarPrancha()
540 548 }
541 549 }
542 550 function alterarTema(){
543   - global $esquemaadmin,$id_tema,$id_prancha,$codigo_tema,$ligado_tema,$ordem_tema;
  551 + global $esquemaadmin,$id_tema,$id_prancha;
544 552 try{
545 553 include("conexao.php");
546 554 if($id_tema != ""){
547 555 $dataCol = array(
548   - "ordem_tema"=>$ordem_tema,
549   - "codigo_tema"=>$codigo_tema,
550   - "ligado_tema"=>$ligado_tema
  556 + "ordem_tema"=>$_GET["ordem_tema"],
  557 + "codigo_tema"=>$_GET["codigo_tema"],
  558 + "ligado_tema"=>$_GET["ligado_tema"]
551 559 );
552 560 i3GeoAdminUpdate($dbhw,"i3geoadmin_atlast",$dataCol,"WHERE id_tema = $id_tema");
553 561 $retorna = $id_tema;
... ... @@ -558,8 +566,8 @@ function alterarTema(){
558 566 $o = $o[0]['o'] + 1;
559 567 $dataCol = array(
560 568 "ordem_tema"=>$o,
561   - "codigo_tema"=>$codigo_tema,
562   - "ligado_tema"=>$ligado_tema,
  569 + "codigo_tema"=>$_GET["codigo_tema"],
  570 + "ligado_tema"=>$_GET["ligado_tema"],
563 571 "id_prancha"=>$id_prancha
564 572 );
565 573 $retorna = i3GeoAdminInsertUnico($dbhw,"i3geoadmin_atlast",$dataCol,"codigo_tema","id_tema");
... ...
admin/php/login.php
  Diff comments   View file @b06bcef
... ... @@ -62,13 +62,13 @@ error_reporting(0);
62 62 //
63 63 //pega as variaveis passadas com get ou post
64 64 //
65   -include_once(dirname(__FILE__)."/../../classesphp/pega_variaveis.php");
  65 +include_once(dirname(__FILE__)."/../safe.php");
66 66 include_once(dirname(__FILE__)."/admin.php");
67 67 error_reporting(0);
68 68 session_write_close();
69 69 session_name("i3GeoLogin");
70 70 //se o usuario estiver tentando fazer login
71   -if(!empty($usuario) && !empty($senha)){
  71 +if(!empty($_POST["usuario"]) && !empty($_POST["senha"])){
72 72 logoutUsuario();
73 73 session_regenerate_id();
74 74 $_SESSION = array();
... ... @@ -97,6 +97,9 @@ switch (strtoupper($funcao))
97 97  
98 98 */
99 99 case "LOGIN":
  100 + $usuario = $_POST["usuario"];
  101 + $senha = $_POST["senha"];
  102 +
100 103 $teste = autenticaUsuario($usuario,$senha);
101 104 if($teste != false){
102 105 $_SESSION["usuario"] = $usuario;
... ... @@ -137,12 +140,11 @@ switch (strtoupper($funcao))
137 140 */
138 141 case "VALIDAOPERACAOSESSAO":
139 142 $retorno = "nao";
140   - if($operacao == ""){
  143 + if($_GET["operacao"] == ""){
141 144 $retorno = "sim";
142 145 }
143 146 else{
144   - //echo "oi";exit;
145   - if(verificaOperacaoSessao($operacao) == true){
  147 + if(verificaOperacaoSessao($_GET["operacao"]) == true){
146 148 $retorno = "sim";
147 149 }
148 150 else{
... ... @@ -163,8 +165,8 @@ switch (strtoupper($funcao))
163 165 */
164 166 case "RECUPERARSENHA":
165 167 $retorno = false;
166   - if(!empty($usuario)){
167   - $retorno = recuperarSenha($usuario);
  168 + if(!empty($_POST["usuario"])){
  169 + $retorno = recuperarSenha($_POST["usuario"]);
168 170 }
169 171 cpjson($retorno);
170 172 break;
... ... @@ -181,8 +183,8 @@ switch (strtoupper($funcao))
181 183 */
182 184 case "ALTERARSENHA":
183 185 $retorno = false;
184   - if(!empty($usuario)){
185   - $retorno = alterarSenha($usuario,$novaSenha);
  186 + if(!empty($_POST["usuario"])){
  187 + $retorno = alterarSenha($_POST["usuario"],$_POST["novaSenha"]);
186 188 }
187 189 cpjson($retorno);
188 190 break;
... ...
admin/php/xml.php
  Diff comments   View file @b06bcef
... ... @@ -119,12 +119,13 @@ Retorno:
119 119  
120 120 RSS
121 121 */
122   -function geraRSScomentariosTemas($locaplic,$id_tema="")
123   -{
  122 +function geraRSScomentariosTemas($locaplic,$id_tema=""){
124 123 global $esquemaadmin;
  124 + xml_testaNum([$id_tema]);
125 125 $sql = "select '' as tipo_ws, b.nome_tema||' '||a.data as nome_ws,a.openidnome||' '||a.openidurl||' &lt;br&gt;'||a.comentario as desc_ws, a.openidnome as autor_ws, b.link_tema as link_ws from ".$esquemaadmin."i3geoadmin_comentarios as a,".$esquemaadmin."i3geoadmin_temas as b where a.id_tema = b.id_tema ";
126   - if($id_tema != "")
127   - {$sql .= " and a.id_tema = $id_tema ";}
  126 + if($id_tema != ""){
  127 + $sql .= " and a.id_tema = $id_tema ";
  128 + }
128 129 return geraXmlRSS($locaplic,$sql,"Lista de comentarios");
129 130 }
130 131 /*
... ... @@ -145,6 +146,7 @@ RSS
145 146 function geraRSStemas($locaplic,$id_n2,$output="xml")
146 147 {
147 148 global $esquemaadmin;
  149 + xml_testaNum([$id_n2]);
148 150 $sql = "
149 151 select '' as tipo_ws, i3geoadmin_temas.codigo_tema as id_ws,i3geoadmin_temas.nome_tema as nome_ws,'' as desc_ws,'php/parsemapfile.php?id='||i3geoadmin_temas.codigo_tema as link_ws,i3geoadmin_temas.link_tema as autor_ws
150 152 from ".$esquemaadmin."i3geoadmin_n3 as n3
... ... @@ -173,6 +175,7 @@ RSS
173 175 function geraRSStemasRaiz($locaplic,$id,$nivel)
174 176 {
175 177 global $esquemaadmin;
  178 + xml_testaNum([$id,$nivel]);
176 179 $sql = "
177 180 select '' as tipo_ws, i3geoadmin_temas.codigo_tema as id_ws,i3geoadmin_temas.nome_tema as nome_ws,'' as desc_ws,'php/parsemapfile.php?id='||i3geoadmin_temas.codigo_tema as link_ws,i3geoadmin_temas.link_tema as autor_ws
178 181 from ".$esquemaadmin."i3geoadmin_raiz as r
... ... @@ -199,6 +202,7 @@ RSS
199 202 function geraRSSsubgrupos($locaplic,$id_n1,$output="json")
200 203 {
201 204 global $esquemaadmin;
  205 + xml_testaNum([$id_n1]);
202 206 $sql = "select '' as tipo_ws, n2.id_n2 as id_ws,g.nome_subgrupo as nome_ws,'' as desc_ws,'rsstemas.php?id='||n2.id_n2 as link_ws,'' as autor_ws from ".$esquemaadmin."i3geoadmin_n2 as n2,".$esquemaadmin."i3geoadmin_subgrupos as g ";
203 207 $sql .= " where g.id_subgrupo = n2.id_subgrupo and n2.id_n1 = '$id_n1' and n2.n2_perfil = '' and n2.publicado != 'NAO' order by nome_ws";
204 208 return geraXmlRSS($locaplic,$sql,"Lista de sub-grupos",$output);
... ... @@ -737,6 +741,7 @@ function geraRSSmapas($locaplic,$output)
737 741 function geraXmlMenutemas($perfil,$id_menu,$tipo,$locaplic)
738 742 {
739 743 global $esquemaadmin;
  744 + xml_testaNum([$id_menu]);
740 745 $dbh = "";
741 746 include($locaplic."/admin/php/conexao.php");
742 747 if (!isset($perfil)){$perfil = "";}
... ... @@ -794,6 +799,7 @@ function geraXmlMenutemas($perfil,$id_menu,$tipo,$locaplic)
794 799 function geraXmlMenutemas_pegasubgrupos($id_n1,$xml,$dbh,$tipo,$perfil)
795 800 {
796 801 global $esquemaadmin;
  802 + xml_testaNum([$id_n1]);
797 803 $q = "select subgrupos.id_subgrupo,nome_subgrupo,id_n2,n2.n2_perfil as perfil from ".$esquemaadmin."i3geoadmin_n2 as n2,".$esquemaadmin."i3geoadmin_subgrupos as subgrupos where n2.id_n1 = $id_n1 and n2.id_subgrupo = subgrupos.id_subgrupo ";
798 804 //echo $q;exit;
799 805 $qsgrupos = $dbh->query($q);
... ... @@ -821,6 +827,7 @@ function geraXmlMenutemas_pegasubgrupos($id_n1,$xml,$dbh,$tipo,$perfil)
821 827 function geraXmlMenutemas_pegatemas($id_n2,$xml,$dbh,$perfil)
822 828 {
823 829 global $esquemaadmin;
  830 + xml_testaNum([$id_n2]);
824 831 $q = "select nome_tema,codigo_tema,desc_tema,link_tema,tipoa_tema,tags_tema,kml_tema,ogc_tema,download_tema,n3.n3_perfil as perfil from ".$esquemaadmin."i3geoadmin_n3 as n3,".$esquemaadmin."i3geoadmin_temas as temas where n3.id_n2 = $id_n2 and n3.id_tema = temas.id_tema ";
825 832 $qtemas = $dbh->query($q);
826 833 $xml = geraXmlMenutemas_notema($qtemas,$xml,$perfil);
... ... @@ -863,6 +870,7 @@ function geraXmlMenutemas_notema($qtemas,$xml,$perfil)
863 870 function geraXmlAtlas_pegapranchas($xml,$id_atlas,$dbh)
864 871 {
865 872 global $esquemaadmin;
  873 + xml_testaNum([$id_atlas]);
866 874 $q = "select * from ".$esquemaadmin."i3geoadmin_atlasp as p where p.id_atlas = $id_atlas order by ordem_prancha";
867 875 $qpranchas = $dbh->query($q);
868 876 foreach($qpranchas as $row)
... ... @@ -886,6 +894,7 @@ function geraXmlAtlas_pegapranchas($xml,$id_atlas,$dbh)
886 894 function geraXmlAtlas_pegatemas($xml,$id_prancha,$dbh)
887 895 {
888 896 global $esquemaadmin;
  897 + xml_testaNum([$id_prancha]);
889 898 $q = "select t.codigo_tema,t.ligado_tema from ".$esquemaadmin."i3geoadmin_atlast as t where t.id_prancha = '$id_prancha' order by ordem_tema";
890 899 //echo $q;
891 900 $qtemas = $dbh->query($q);
... ... @@ -901,6 +910,7 @@ function geraXmlAtlas_pegatemas($xml,$id_prancha,$dbh)
901 910 function geraXmlSistemas_pegafuncoes($perfil,$xml,$id_sistema,$dbh)
902 911 {
903 912 global $esquemaadmin;
  913 + xml_testaNum([$id_sistema]);
904 914 $q = "select * from ".$esquemaadmin."i3geoadmin_sistemasf where id_sistema = '$id_sistema'";
905 915 $qtemas = $dbh->query($q);
906 916 foreach($qtemas as $row)
... ... @@ -943,5 +953,13 @@ function entity_decode($texto)
943 953 {
944 954 return html_entity_decode($texto);
945 955 }
946   -
  956 +function xml_testaNum($valores){
  957 + foreach ($valores as $valor) {
  958 + if(!empty($valor) && !is_numeric($valor)) {
  959 + ob_clean();
  960 + header ( "HTTP/1.1 403 valor nao numerico" );
  961 + exit;
  962 + }
  963 + }
  964 +}
947 965 ?>
... ...
admin/rsscomentariostemas.php
  Diff comments   View file @b06bcef
... ... @@ -41,11 +41,13 @@ error_reporting(0);
41 41 if(!isset($locaplic)){
42 42 include(dirname(__FILE__)."/../ms_configura.php");
43 43 }
44   -include_once($locaplic."/classesphp/pega_variaveis.php");
45   -include_once($locaplic."/admin/php/xml.php");
  44 +include_once(dirname(__FILE__)."/../classesphp/sani_request.php");
46 45 $parametros = array_merge($_POST,$_GET);
47   -if(empty($parametros["id_tema"]))
48   -{$parametros["id_tema"] = "";}
  46 +include_once($locaplic."/admin/php/xml.php");
  47 +
  48 +if(empty($parametros["id_tema"])){
  49 + $parametros["id_tema"] = "";
  50 +}
49 51 echo header("Content-type: application/xml");
50 52 echo geraRSScomentariosTemas($locaplic,$parametros["id_tema"]);
51 53 ?>
... ...
admin/rssgrupos.php
  Diff comments   View file @b06bcef
... ... @@ -36,7 +36,7 @@ error_reporting(0);
36 36 if(!isset($locaplic)){
37 37 include(dirname(__FILE__)."/../ms_configura.php");
38 38 }
39   -include_once($locaplic."/classesphp/pega_variaveis.php");
  39 +include_once(dirname(__FILE__)."/../classesphp/sani_request.php");
40 40 include_once($locaplic."/admin/php/xml.php");
41 41 $output = "xml";
42 42 if(strtolower($_GET["output"]) == "json" || strtolower($_POST["output"]) == "json"){
... ...
admin/rssmapas.php
  Diff comments   View file @b06bcef
... ... @@ -36,7 +36,7 @@ error_reporting(0);
36 36 if(!isset($locaplic)){
37 37 include(dirname(__FILE__)."/../ms_configura.php");
38 38 }
39   -include_once($locaplic."/classesphp/pega_variaveis.php");
  39 +include_once(dirname(__FILE__)."/../classesphp/sani_request.php");
40 40 include_once($locaplic."/admin/php/xml.php");
41 41 $output = "xml";
42 42 if(strtolower($_GET["output"]) == "json" || strtolower($_POST["output"]) == "json"){
... ...
admin/rsssubgrupos.php
  Diff comments   View file @b06bcef
... ... @@ -42,12 +42,13 @@ error_reporting(0);
42 42 if(!isset($locaplic)){
43 43 include(dirname(__FILE__)."/../ms_configura.php");
44 44 }
45   -include_once($locaplic."/classesphp/pega_variaveis.php");
  45 +include_once(dirname(__FILE__)."/../classesphp/sani_request.php");
  46 +$_GET = array_merge($_GET,$_POST);
46 47 include_once($locaplic."/admin/php/xml.php");
47 48 $output = "xml";
48 49 if(strtolower($_GET["output"]) == "json" || strtolower($_POST["output"]) == "json"){
49 50 $output = "json";
50 51 }
51 52 echo header("Content-type: application/".$output);
52   -echo geraRSSsubgrupos($locaplic,$id,$output);
  53 +echo geraRSSsubgrupos($locaplic,$_GET["id"],$output);
53 54 ?>
... ...
admin/rsstemas.php
  Diff comments   View file @b06bcef
... ... @@ -42,12 +42,13 @@ error_reporting(0);
42 42 if(!isset($locaplic)){
43 43 include(dirname(__FILE__)."/../ms_configura.php");
44 44 }
45   -include_once($locaplic."/classesphp/pega_variaveis.php");
  45 +include_once(dirname(__FILE__)."/../classesphp/sani_request.php");
  46 +$_GET = array_merge($_GET,$_POST);
46 47 include_once($locaplic."/admin/php/xml.php");
47 48 $output = "xml";
48 49 if(strtolower($_GET["output"]) == "json" || strtolower($_POST["output"]) == "json"){
49 50 $output = "json";
50 51 }
51 52 echo header("Content-type: application/".$output);
52   -echo geraRSStemas($locaplic,$id,$output);
  53 +echo geraRSStemas($locaplic,$_GET["id"],$output);
53 54 ?>
... ...
admin/rsstemasdownload.php
  Diff comments   View file @b06bcef
... ... @@ -39,7 +39,8 @@ error_reporting(0);
39 39 if(!isset($locaplic)){
40 40 include(dirname(__FILE__)."/../ms_configura.php");
41 41 }
42   -include_once($locaplic."/classesphp/pega_variaveis.php");
  42 +include_once(dirname(__FILE__)."/../classesphp/sani_request.php");
  43 +$_GET = array_merge($_GET,$_POST);
43 44 include_once($locaplic."/admin/php/xml.php");
44 45 echo header("Content-type: application/xml");
45 46 echo geraRSStemasDownload($locaplic);
... ...
admin/rsstemaskml.php
  Diff comments   View file @b06bcef
... ... @@ -39,7 +39,8 @@ error_reporting(0);
39 39 if(!isset($locaplic)){
40 40 include(dirname(__FILE__)."/../ms_configura.php");
41 41 }
42   -include_once($locaplic."/classesphp/pega_variaveis.php");
  42 +include_once(dirname(__FILE__)."/../classesphp/sani_request.php");
  43 +$_GET = array_merge($_GET,$_POST);
43 44 include_once($locaplic."/admin/php/xml.php");
44 45 echo header("Content-type: application/xml");
45 46 echo geraRSStemasKml($locaplic);
... ...
admin/rsstemasogc.php
  Diff comments   View file @b06bcef
... ... @@ -38,7 +38,8 @@ error_reporting(0);
38 38 if(!isset($locaplic)){
39 39 include(dirname(__FILE__)."/../ms_configura.php");
40 40 }
41   -include_once($locaplic."/classesphp/pega_variaveis.php");
  41 +include_once(dirname(__FILE__)."/../classesphp/sani_request.php");
  42 +$_GET = array_merge($_GET,$_POST);
42 43 include_once($locaplic."/admin/php/xml.php");
43 44 echo header("Content-type: application/xml");
44 45 echo geraRSStemasOgc($locaplic);
... ...
admin/rsstemasraiz.php
  Diff comments   View file @b06bcef
... ... @@ -44,8 +44,9 @@ error_reporting(0);
44 44 if(!isset($locaplic)){
45 45 include(dirname(__FILE__)."/../ms_configura.php");
46 46 }
47   -include_once($locaplic."/classesphp/pega_variaveis.php");
  47 +include_once(dirname(__FILE__)."/../classesphp/sani_request.php");
  48 +$_GET = array_merge($_GET,$_POST);
48 49 include_once($locaplic."/admin/php/xml.php");
49 50 echo header("Content-type: application/xml");
50   -echo geraRSStemasRaiz($locaplic,$id,$nivel);
  51 +echo geraRSStemasRaiz($locaplic,$_GET["id"],$_GET["nivel"]);
51 52 ?>
... ...
admin/safe.php 0 → 100755
  Diff comments   View file @b06bcef
... ... @@ -0,0 +1,69 @@
  1 +<?php
  2 +include_once (dirname(__FILE__)."/../classesphp/sani_request.php");
  3 +$_GET = array_merge($_GET,$_POST);
  4 +if(!empty($_GET["g_sid"])){
  5 + $g_sid = $_GET["g_sid"];
  6 + session_name("i3GeoPHP");
  7 + session_id($g_sid);
  8 + session_start();
  9 + $statusFerramentas = $_SESSION["statusFerramentas"];
  10 + $imgurl = $_SESSION["imgurl"];
  11 + $tmpurl = $_SESSION["tmpurl"];
  12 + $map_file = $_SESSION["map_file"];
  13 + $mapext = $_SESSION["mapext"];
  14 + $locaplic = $_SESSION["locaplic"];
  15 + $mapext = $_SESSION["mapext"];
  16 + $ler_extensoes = $_SESSION["ler_extensoes"];
  17 + $perfil = $_SESSION["perfil"];
  18 + $interface = $_SESSION["interface"];
  19 + $kmlurl = $_SESSION["kmlurl"];
  20 + $mapdir = $_SESSION["mapdir"];
  21 + $imgdir = $_SESSION["imgdir"];
  22 + $contadorsalva = $_SESSION["contadorsalva"];
  23 + $fingerprint = $_SESSION['fingerprint'];
  24 + $editores = $_SESSION['editores'];
  25 +}
  26 +else{
  27 + $g_sid = "";
  28 +}
  29 +//variaveis mais comuns
  30 +$funcao = $_GET["funcao"];
  31 +$perfil = $_GET["perfil"];
  32 +$tipo = $_GET["tipo"];
  33 +$tipoRetorno = $_GET["tipoRetorno"];
  34 +$idioma = $_GET["idioma"];
  35 +$movimento = $_GET["movimento"];
  36 +$tabela = $_GET["tabela"];
  37 +$publicado = $_GET["publicado"];
  38 +
  39 +$nivel = $_GET["nivel"];
  40 +$id_menu = $_GET["id_menu"];
  41 +$id_grupo = $_GET["id_grupo"];
  42 +$id_subgrupo = $_GET["id_subgrupo"];
  43 +
  44 +$id_n1 = $_GET["id_n1"];
  45 +$id_n2 = $_GET["id_n2"];
  46 +$id_n3 = $_GET["id_n3"];
  47 +$id_raiz = $_GET["id_raiz"];
  48 +$id_tema = $_GET["id_tema"];
  49 +$ordem = $_GET["ordem"];
  50 +
  51 +testaSafeNumerico([$id_subgrupo,$id_grupo,$ordem,$nivel,$id_menu,$id_n1,$id_n2,$id_n3,$id_raiz,$id_tema]);
  52 +
  53 +if(isset($fingerprint) && !empty($g_sid)) {
  54 + $f = explode(",",$fingerprint);
  55 + if($f[0] != md5('I3GEOSEC' . $_SERVER['HTTP_USER_AGENT'] . session_id())){
  56 + cpjson(". Tentativa de acesso nao permitida. Inicie um novo mapa.");
  57 + return;
  58 + }
  59 +}
  60 +function testaSafeNumerico($valores){
  61 + foreach ($valores as $valor) {
  62 + if(!empty($valor) && !is_numeric($valor)) {
  63 + ob_clean();
  64 + header ( "HTTP/1.1 403 valor nao numerico" );
  65 + exit;
  66 + }
  67 + }
  68 +}
  69 +?>
0 70 \ No newline at end of file
... ...
admin/xmlatlas.php
  Diff comments   View file @b06bcef
... ... @@ -4,8 +4,8 @@ error_reporting(0);
4 4 if(!isset($locaplic)){
5 5 include(dirname(__FILE__)."/../ms_configura.php");
6 6 }
7   -include_once($locaplic."/classesphp/pega_variaveis.php");
  7 +include_once($locaplic."/admin/safe.php");
8 8 include_once($locaplic."/admin/php/xml.php");
9 9 echo header("Content-type: application/xml");
10   -echo geraXmlAtlas($locaplic,$editores);
  10 +echo geraXmlAtlas($locaplic);
11 11 ?>
... ...
admin/xmlgeorss.php
  Diff comments   View file @b06bcef
... ... @@ -39,7 +39,7 @@ error_reporting(0);
39 39 if(!isset($locaplic)){
40 40 include(dirname(__FILE__)."/../ms_configura.php");
41 41 }
42   -include_once($locaplic."/classesphp/pega_variaveis.php");
  42 +include_once($locaplic."/admin/safe.php");
43 43 include_once($locaplic."/admin/php/xml.php");
44 44 $output = "xml";
45 45 if(strtolower($_GET["output"]) == "json" || strtolower($_POST["output"]) == "json"){
... ...
admin/xmlidentifica.php
  Diff comments   View file @b06bcef
... ... @@ -43,9 +43,9 @@ error_reporting(0);
43 43 if(!isset($locaplic)){
44 44 include(dirname(__FILE__)."/../ms_configura.php");
45 45 }
46   -include_once($locaplic."/classesphp/pega_variaveis.php");
  46 +include_once($locaplic."/admin/safe.php");
47 47 include_once($locaplic."/admin/php/xml.php");
48 48 if(!isset($perfil)){$perfil = "";}
49 49 echo header("Content-type: application/xml");
50   -echo geraXmlIdentifica($perfil,$locaplic,$editores);
  50 +echo geraXmlIdentifica($perfil,$locaplic);
51 51 ?>
... ...
admin/xmlkmlrss.php
  Diff comments   View file @b06bcef
... ... @@ -38,7 +38,7 @@ error_reporting(0);
38 38 if(!isset($locaplic)){
39 39 include(dirname(__FILE__)."/../ms_configura.php");
40 40 }
41   -include_once($locaplic."/classesphp/pega_variaveis.php");
  41 +include_once($locaplic."/admin/safe.php");
42 42 include_once($locaplic."/admin/php/xml.php");
43 43 echo header("Content-type: application/xml");
44 44 echo geraXmlKmlrss($locaplic);
... ...
admin/xmllinksdownload.php
  Diff comments   View file @b06bcef
... ... @@ -39,7 +39,7 @@ error_reporting(0);
39 39 if(!isset($locaplic)){
40 40 include(dirname(__FILE__)."/../ms_configura.php");
41 41 }
42   -include_once($locaplic."/classesphp/pega_variaveis.php");
  42 +include_once($locaplic."/admin/safe.php");
43 43 include_once($locaplic."/admin/php/xml.php");
44 44 echo header("Content-type: application/xml");
45 45 echo geraXmlDownload($locaplic);
... ...
admin/xmlmapas.php
  Diff comments   View file @b06bcef
... ... @@ -39,9 +39,9 @@ error_reporting(0);
39 39 if(!isset($locaplic)){
40 40 include(dirname(__FILE__)."/../ms_configura.php");
41 41 }
42   -include_once($locaplic."/classesphp/pega_variaveis.php");
  42 +include_once($locaplic."/admin/safe.php");
43 43 include_once($locaplic."/admin/php/xml.php");
44 44 if(!isset($perfil)){$perfil = "";}
45 45 echo header("Content-type: application/xml");
46   -echo geraXmlMapas($perfil,$locaplic,$editores);
  46 +echo geraXmlMapas($perfil,$locaplic);
47 47 ?>
... ...
admin/xmlmenutemas.php
  Diff comments   View file @b06bcef
... ... @@ -3,7 +3,7 @@ error_reporting(0);
3 3 if(!isset($locaplic)){
4 4 include(dirname(__FILE__)."/../ms_configura.php");
5 5 }
6   -include_once($locaplic."/classesphp/pega_variaveis.php");
  6 +include_once($locaplic."/admin/safe.php");
7 7 include_once($locaplic."/admin/php/xml.php");
8 8 if(!isset($perfil)){$perfil = "";}
9 9 if(!isset($id_menu)){$id_menu = "";}
... ...
admin/xmlmetaestatogc.php
  Diff comments   View file @b06bcef
... ... @@ -38,7 +38,7 @@ error_reporting(0);
38 38 if(!isset($locaplic)){
39 39 include(dirname(__FILE__)."/../ms_configura.php");
40 40 }
41   -include_once($locaplic."/classesphp/pega_variaveis.php");
  41 +include_once($locaplic."/admin/safe.php");
42 42 include_once($locaplic."/admin/php/xml.php");
43 43 echo header("Content-type: application/xml");
44 44 echo geraXmlWMSmetaestat($locaplic);
... ...
admin/xmlservicoswms.php
  Diff comments   View file @b06bcef
... ... @@ -39,7 +39,7 @@ error_reporting(0);
39 39 if(!isset($locaplic)){
40 40 include(dirname(__FILE__)."/../ms_configura.php");
41 41 }
42   -include_once($locaplic."/classesphp/pega_variaveis.php");
  42 +include_once($locaplic."/admin/safe.php");
43 43 include_once($locaplic."/admin/php/xml.php");
44 44 $output = "xml";
45 45 if(strtolower($_GET["output"]) == "json" || strtolower($_POST["output"]) == "json"){
... ...
admin/xmlservicosws.php
  Diff comments   View file @b06bcef
... ... @@ -39,7 +39,7 @@ error_reporting(0);
39 39 if(!isset($locaplic)){
40 40 include(dirname(__FILE__)."/../ms_configura.php");
41 41 }
42   -include_once($locaplic."/classesphp/pega_variaveis.php");
  42 +include_once($locaplic."/admin/safe.php");
43 43 include_once($locaplic."/admin/php/xml.php");
44 44  
45 45 $output = "xml";
... ...
admin/xmlsistemas.php
  Diff comments   View file @b06bcef
... ... @@ -39,9 +39,9 @@ error_reporting(0);
39 39 if(!isset($locaplic)){
40 40 include(dirname(__FILE__)."/../ms_configura.php");
41 41 }
42   -include_once($locaplic."/classesphp/pega_variaveis.php");
  42 +include_once($locaplic."/admin/safe.php");
43 43 include_once($locaplic."/admin/php/xml.php");
44 44 if(!isset($perfil)){$perfil = "";}
45 45 echo header("Content-type: application/xml");
46   -echo geraXmlSistemas($perfil,$locaplic,$editores);
  46 +echo geraXmlSistemas($perfil,$locaplic);
47 47 ?>
... ...