Code cleanup.

cron.php

@@ -34,7 +34,7 @@ require_once(realpath(dirname(__FILE__)."/class2.php"));
 	
 	if(!empty($_GET['token']))
 	{
-		$pwd = $_GET['token'];	
+		$pwd = e107::getParser()->filter($_GET['token']);
 	}
 	else
 	{

e107_admin/emoticon.php

@@ -54,17 +54,17 @@ if (isset($_POST['active']))
 
 }
 
-$ns->tablerender($caption, $mes->render() . $text);
+e107::getRender()->tablerender($caption, $mes->render() . $text);
 
 /* get packs */
 require_once(e_HANDLER."file_class.php");
 $fl = e107::getFile();
 $emote = new emotec;
 $one_pack = FALSE;
-
+$filtered = e107::getParser()->filter($_POST);
 
 // Check for pack-related buttons pressed
-foreach($_POST as $key => $value)
+foreach($filtered as $key => $value)
 {
 	if(strstr($key, "subPack_"))
 	{

e107_admin/image.php

@@ -79,14 +79,17 @@ if(vartrue($_GET['action']) == 'nav' && e_AJAX_REQUEST) //XXX Doesn't work corre
 		
 		$bbcodeMode .= "&nav=1";
 			
-		$tag = ($bbcodeMode===false) ? false : $_GET['tagid']; // eg. news, news-thumbnail	
+		$tag = ($bbcodeMode===false) ? false : e107::getParser()->filter($_GET['tagid']); // eg. news, news-thumbnail
 		
 		if($_GET['search'])
 		{
-			$bbcodeMode .= "&search=".preg_replace("/[^a-z0-9]/i","",$_GET['search']);
+			$search = e107::getParser()->filter($_GET['search']);
+			$bbcodeMode .= "&search=".preg_replace("/[^a-z0-9]/i","",$search);
 		}
+
+	$for = e107::getParser()->filter($_GET['for']);
 					
-		echo e107::getMedia()->mediaSelect($_GET['for'],$tag,$bbcodeMode); 
+		echo e107::getMedia()->mediaSelect($for,$tag,$bbcodeMode);
 	
 	// require_once(e_ADMIN."footer.php");
 	exit;	
@@ -1655,6 +1658,7 @@ class media_admin_ui extends e_admin_ui
 	{
 		$fl = e107::getFile();
 		$mes = e107::getMessage();
+		$tp = e107::getParser();
 			
 		
 		if(vartrue($_POST['upload_remote_url']))
@@ -1675,7 +1679,7 @@ class media_admin_ui extends e_admin_ui
 				$fileName = empty($_POST['upload_caption']) ? str_replace(array(".php",".html",".asp",".htm"),'',$fileName)."_".time() : eHelper::dasherize(strtolower($_POST['upload_caption']));
 			}
 
-			if(!$fl->getRemoteFile($_POST['upload_url'], $fileName, 'import'))
+			if(!$fl->getRemoteFile($tp->filter($_POST['upload_url'], 'file'), $fileName, 'import'))
 			{
 				$mes->addError(IMALAN_176);
 			}
@@ -1873,9 +1877,10 @@ class media_admin_ui extends e_admin_ui
 
 			if(!empty($_POST['multiaction']))
 			{
+				$actions = $tp->filter($_POST['multiaction']);
 				$tmp = array(); $tmp1 = array(); $message = array();
 
-				foreach ($_POST['multiaction'] as $todel)
+				foreach ($actions as $todel)
 				{
 					list($usr,$path) = explode('#', $todel);
 
@@ -2364,6 +2369,7 @@ class media_admin_ui extends e_admin_ui
 		$frm = e107::getForm();
 		$mes = e107::getMessage();
 		$fl = e107::getFile();
+		$tp = e107::getParser();
 		
 
 		
@@ -2446,8 +2452,8 @@ class media_admin_ui extends e_admin_ui
 				<td class='center'>".$frm->checkbox("batch_selected[".$c."]",$f['fname'],$checked)."</td>
 				<td class='center'>".$this->preview($f)."</td>			
 				<td><a class='e-dialog' href='".$large."'>".$f['fname']."</a></td>
-				<td>".$frm->text('batch_import_name['.$c.']', ($_POST['batch_import_name'][$c] ? $_POST['batch_import_name'][$c] : $default['title']))."</td>
+				<td>".$frm->text('batch_import_name['.$c.']', ($_POST['batch_import_name'][$c] ? $tp->filter($_POST['batch_import_name'][$c]) : $default['title']))."</td>
-				<td><textarea name='batch_import_diz[".$c."]' rows='3' cols='50'>". ($_POST['batch_import_diz'][$c] ? $_POST['batch_import_diz'][$c] : $default['description'])."</textarea></td>
+				<td><textarea name='batch_import_diz[".$c."]' rows='3' cols='50'>". ($_POST['batch_import_diz'][$c] ? $tp->filter($_POST['batch_import_diz'][$c]) : $default['description'])."</textarea></td>
 			
 				<td><a href='mailto:".$default['authorEmail']."'>".$default['authorName']."</a><br />".$default['authorEmail']."</td>
 				<td>".$f['mime']."</td>
@@ -2476,7 +2482,7 @@ class media_admin_ui extends e_admin_ui
 				</tbody>
 						</table>
 						<div class='buttons-bar center form-inline'>
-						".IMALAN_123." ".$frm->selectbox('batch_category',$this->cats, $_POST['batch_category']);
+						".IMALAN_123." ".$frm->selectbox('batch_category',$this->cats, $tp->filter($_POST['batch_category']));
 			
 		//	$waterMarkPath = e_THEME.e107::getPref('sitetheme')."/images/watermark.png"; // Now performed site-wide dynamically. 				
 					
@@ -2577,7 +2583,7 @@ class media_admin_ui extends e_admin_ui
 			}	
 			
 		//	$oldpath = e_MEDIA."temp/".$file;
-			$oldpath = e_IMPORT.$file;
+			$oldpath = e_IMPORT.e107::getParser()->filter($file, 'file');
 			if(file_exists($oldpath))
 			{
 				unlink($oldpath);
@@ -2629,7 +2635,7 @@ class media_admin_ui extends e_admin_ui
 
 			if($_POST['batch_category'] == '_avatars_public' || $_POST['batch_category'] == '_avatars_private')
 			{
-				$newpath = ($_POST['batch_category'] == '_avatars_public') ? e_AVATAR_DEFAULT.$file : $newpath = e_AVATAR_UPLOAD.$file;
+				$newpath = ($_POST['batch_category'] == '_avatars_public') ? e_AVATAR_DEFAULT.$tp->filter($file, 'file') : $newpath = e_AVATAR_UPLOAD.$tp->filter($file, 'file');
 
 				if(rename($oldpath,$newpath))
 				{
@@ -2688,7 +2694,7 @@ class media_admin_ui extends e_admin_ui
 				$insert = array(
 					'media_caption'		=> $newdiz,
 					'media_description'	=> '',
-					'media_category'	=> $_POST['batch_category'],
+					'media_category'	=> $tp->filter($_POST['batch_category']),
 					'media_datestamp'	=> $f['modified'],
 					'media_url'			=> $tp->createConstants($newpath,'rel'),
 					'media_userclass'	=> '0',

e107_admin/language.php

@@ -979,26 +979,29 @@ class lanDeveloper
 	{
 		$ns = e107::getRender();
 		$mes = e107::getMessage();
+		$tp = e107::getParser();
 
 	// ------------------------------ TODO -------------------------------
 
 		if(vartrue($_POST['disabled-unused']) && vartrue($_POST['disable-unused-lanfile']))
 		{
+			$disUnusedLanFile = $tp->filter($_POST['disable-unused-lanfile'], 'file');
+
 			$mes = e107::getMessage();
 
-			$data = file_get_contents($_POST['disable-unused-lanfile']);
+			$data = file_get_contents($disUnusedLanFile);
 
 			$new = $this->disableUnused($data);
-			if(file_put_contents($_POST['disable-unused-lanfile'],$new))
+			if(file_put_contents($disUnusedLanFile,$new))
 			{
-				$mes->addSuccess(LANG_LAN_135.$_POST['disable-unused-lanfile']);//Overwriting 
+				$mes->addSuccess(LANG_LAN_135.$disUnusedLanFile);//Overwriting
 			}
 			else
 			{
-				$mes->addError(LANG_LAN_136.$_POST['disable-unused-lanfile']);//Couldn't overwrite 
+				$mes->addError(LANG_LAN_136.$disUnusedLanFile);//Couldn't overwrite
 			}
 
-			$ns->tablerender(LANG_LAN_137.SEP.$_POST['disable-unused-lanfile'],$mes->render()."<pre>".htmlentities($new)."</pre>");//Processed
+			$ns->tablerender(LANG_LAN_137.SEP.$disUnusedLanFile,$mes->render()."<pre>".htmlentities($new)."</pre>");//Processed
 		}
 
 
@@ -1010,7 +1013,7 @@ class lanDeveloper
 
 	function run()
 	{
-
+		$tp = e107::getParser();
 		$mes = e107::getMessage();
 
 		if(varset($_POST['searchDeprecated']) && varset($_POST['deprecatedLans']))
@@ -1018,7 +1021,7 @@ class lanDeveloper
 
 		//	print_a($_POST);
 			// $lanfile = $_POST['deprecatedLans'];
-			$script = $_POST['deprecatedLans'];
+			$script = $tp->filter($_POST['deprecatedLans']);
 
 			foreach($script as $k=>$scr)
 			{
@@ -1058,7 +1061,7 @@ class lanDeveloper
 
 			if($_POST['deprecatedLanFile'][0] !='auto') //override.
 			{
-				$lanfile = $_POST['deprecatedLanFile'];
+				$lanfile = $tp->filter($_POST['deprecatedLanFile'], 'file');
 			}
 
 
@@ -1068,8 +1071,10 @@ class lanDeveloper
 			$this->commonPhrases = $this->getCommon();
 
 			//	print_a($this->commonPhrases);
+			$reverse = vartrue($_POST['deprecatedLansReverse']);
+			$reverse = $tp->filter($reverse);
 
-			if($res = $this->unused($lanfile, $script, vartrue($_POST['deprecatedLansReverse'])))
+			if($res = $this->unused($lanfile, $script, $reverse))
 			{
 				return $res;
 			//	$ns->tablerender($res['caption'],$mes->render(). $res['text']);
@@ -1243,7 +1248,7 @@ class lanDeveloper
 
 		$text .= "
 								</select> ".
-			$frm->select('deprecatedLansReverse',$depOptions,$_POST['deprecatedLansReverse'],'class=select')." ";
+			$frm->select('deprecatedLansReverse',$depOptions,e107::getParser()->filter($_POST['deprecatedLansReverse']),'class=select')." ";
 
 		$search = array(e_PLUGIN,e_ADMIN,e_LANGUAGEDIR."English/",e_THEME);
 		$replace = array("Plugins ","Admin ","Core ","Themes ");

e107_admin/plugin.php

@@ -47,7 +47,8 @@ if(e_AJAX_REQUEST && isset($_GET['action'])) // Ajax
 {
 	if($_GET['action'] == 'download')
 	{
-		$string =  base64_decode($_GET['src']);	
+		$string =  base64_decode($_GET['src']);
+		$string = $tp->filter($string);
 		parse_str($string, $p);
 		
 	//	print_a($p);
@@ -93,7 +94,7 @@ class pluginmanager_form extends e_form
 	//FIXME _ there's a problem with calling this. 
 	function plugin_website($parms, $value, $id, $attributes)
 	{
-		return ($plugURL) ? "<a href='{$plugURL}' title='{$plugURL}' >".ADMIN_URL_ICON."</a>" : "";	
+		return (varset($plugURL, false)) ? "<a href='{$plugURL}' title='{$plugURL}' >".ADMIN_URL_ICON."</a>" : "";	
 		
 	}
 	
@@ -113,7 +114,7 @@ class pluginmanager_form extends e_form
 		if ($this->plug_vars['administration']['configFile'] && $this->plug['plugin_installflag'] == true)
 		{
 			$conf_file = e_PLUGIN. $this->plug['plugin_path'].'/'.$this->plug_vars['administration']['configFile'];
-			$conf_title = LAN_CONFIGURE.' '.$tp->toHtml($this->plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable");
+			$conf_title = LAN_CONFIGURE.' '.$tp->toHTML($this->plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable");
 			$plugin_icon = "<a title='{$conf_title}' href='{$conf_file}' >".$plugin_icon."</a>";
 			$plugin_config_icon = "<a class='btn btn-default' title='{$conf_title}' href='{$conf_file}' >".ADMIN_CONFIGURE_ICON."</a>";
 		}
@@ -305,6 +306,7 @@ class pluginManager{
 
     function pluginObserver()
 	{
+		$tp = e107::getParser();
 
         global $user_pref,$admin_log;
         
@@ -316,7 +318,7 @@ class pluginManager{
 
         if(isset($_POST['etrigger_ecolumns']))
 		{
-			$user_pref['admin_pluginmanager_columns'] = $_POST['e-columns'];
+			$user_pref['admin_pluginmanager_columns'] = $tp->filter($_POST['e-columns']);
 			save_prefs('user');
 		}
 
@@ -343,7 +345,7 @@ class pluginManager{
 
 		if($this->action == 'pull' && !empty($this->id))
 		{
-			$info = e107::getPlugin()->getInfo($this->id);
+			$info = e107::getPlugin()->getinfo($this->id);
 
 			if(!empty($info['plugin_path']))
 			{
@@ -762,7 +764,7 @@ class pluginManager{
 			$eplug_folder = '';
 			if(!isset($_POST['uninstall_confirm']))
 			{	// $id is already an integer
-				$this->pluginConfirmUninstall($this->id);
+				$this->pluginConfirmUninstall();
    				return;
 			}
 
@@ -788,7 +790,7 @@ class pluginManager{
 				if(file_exists($_path.'plugin.xml'))
 				{
 					unset($_POST['uninstall_confirm']);
-					$text .= $plugin->install_plugin_xml($this->id, 'uninstall', $_POST); //$_POST must be used.
+					$plugin->install_plugin_xml($this->id, 'uninstall', $tp->filter($_POST)); //$_POST must be used.
 				}
 				else
 				{	// Deprecated - plugin uses plugin.php
@@ -1399,7 +1401,7 @@ class pluginManager{
 					if ($plug_vars['administration']['configFile'] && $plug['plugin_installflag'] == true)
 					{
 						$conf_file = e_PLUGIN.$plug['plugin_path'].'/'.$plug_vars['administration']['configFile'];
-						$conf_title = LAN_CONFIGURE.' '.$tp->toHtml($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable");
+						$conf_title = LAN_CONFIGURE.' '.$tp->toHTML($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable");
 					//	$plugin_icon = "<a title='{$conf_title}' href='{$conf_file}' >".$plugin_icon."</a>";
 						$plugin_config_icon = "<a class='btn btn-default' title='{$conf_title}' href='{$conf_file}' >".ADMIN_CONFIGURE_ICON."</a>";
 					}
@@ -1448,7 +1450,7 @@ class pluginManager{
 					'plugin_description'	=> $description,
 					'plugin_compatible'		=> $this->compatibilityLabel($plug_vars['@attributes']['compatibility']),
 				
-					'plugin_website'		=> vartrue($row['authorUrl']),
+					'plugin_website'		=> vartrue($plug['authorUrl']),
 			//		'plugin_url'			=> vartrue($plugURL), // ; //  ? "<a href='{$plugURL}' title='{$plugURL}' >".ADMIN_URL_ICON."</a>" : "",
 					'plugin_notes'			=> ''
 					);	
@@ -3022,8 +3024,10 @@ class pluginBuilder
 				
 			}
 			
-			$newArray['DESCRIPTION_DESCRIPTION'] = strip_tags($tp->toHtml($newArray['DESCRIPTION_DESCRIPTION'],true));
+			$newArray['DESCRIPTION_DESCRIPTION'] = strip_tags($tp->toHTML($newArray['DESCRIPTION_DESCRIPTION'],true));
-			
+
+			$_POST['pluginPrefs'] = $tp->filter($_POST['pluginPrefs']);
+
 			foreach($_POST['pluginPrefs'] as $val)
 			{
 				if(vartrue($val['index']))
@@ -3576,15 +3580,17 @@ TEMPLATE;
 		function step4()
 		{
 			$tp = e107::getParser();
-			$pluginTitle = $_POST['xml']['main-name'] ;
+			$pluginTitle = $tp->filter($_POST['xml']['main-name']);
 			
 			if($_POST['xml'])
 			{
+				$_POST['xml'] = $tp->filter($_POST['xml']);
 				$xmlText =	$this->createXml($_POST['xml']);
 			}
 					
 			if(!empty($_POST['addons']))
 			{
+				$_POST['addons'] = $tp->filter($_POST['addons']);
 				$addonResults = $this->createAddons($_POST['addons']);
 			}
 			
@@ -3794,11 +3800,11 @@ if($_POST['pluginPrefs'] && ($vars['mode']=='main'))
 		{
 			if(vartrue($val['index']))
 			{
-				$index = $val['index'];
+				$index = $tp->filter($val['index']);
 				$type = vartrue($val['type'],'text');
 				$help = str_replace("'",'', vartrue($val['help']));
 				
-				$text .= "\t\t\t'".$index."'\t\t=> array('title'=> '".ucfirst($index)."', 'tab'=>0, 'type'=>'".$type."', 'data' => 'str', 'help'=>'".$help."'),\n";
+				$text .= "\t\t\t'".$index."'\t\t=> array('title'=> '".ucfirst($index)."', 'tab'=>0, 'type'=>'".$tp->filter($type)."', 'data' => 'str', 'help'=>'".$tp->filter($help)."'),\n";
 			}	
 	
 		}

e107_handlers/e_parse_class.php

@@ -4422,7 +4422,7 @@ return;
 	 * Filters/Validates using the PHP5 filter_var() method.
 	 * @param $text
 	 * @param $type string str|int|email|url|w|wds
-	 * @return string | boolean
+	 * @return string | boolean | array
 	 */
 	function filter($text, $type='str',$validate=false)
 	{

submitnews.php

@@ -27,7 +27,7 @@ if (!isset($pref['subnews_class']))
 
 if (!check_class($pref['subnews_class']))
 {
-	$ns->tablerender(NWSLAN_12, NWSLAN_11);
+	e107::getRender()->tablerender(NWSLAN_12, NWSLAN_11);
 	require_once(FOOTERF);
 	exit;
 }