diff --git a/apps/contacts/ajax/activation.php b/apps/contacts/ajax/activation.php
index 388a3b5438c6d35fc8e8148bddd37764f62a01df..74cb738ab8fccb39fce648f033d6692151442475 100644
--- a/apps/contacts/ajax/activation.php
+++ b/apps/contacts/ajax/activation.php
@@ -10,6 +10,7 @@
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
$bookid = $_POST['bookid'];
$book = OC_Contacts_App::getAddressbook($bookid);// is owner access check
diff --git a/apps/contacts/ajax/addcontact.php b/apps/contacts/ajax/addcontact.php
index ee451098f1dad6185a76b3c308ec437ca12d88e2..d15ad8c6216b1ace305942663e42defa8a55f678 100644
--- a/apps/contacts/ajax/addcontact.php
+++ b/apps/contacts/ajax/addcontact.php
@@ -27,17 +27,11 @@ function bailOut($msg) {
OCP\Util::writeLog('contacts','ajax/addcontact.php: '.$msg, OCP\Util::DEBUG);
exit();
}
-function debug($msg) {
- OCP\Util::writeLog('contacts','ajax/addcontact.php: '.$msg, OCP\Util::DEBUG);
-}
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
-
-foreach ($_POST as $key=>$element) {
- debug('_POST: '.$key.'=>'.$element);
-}
+OCP\JSON::callCheck();
$aid = isset($_POST['aid'])?$_POST['aid']:null;
if(!$aid) {
diff --git a/apps/contacts/ajax/addproperty.php b/apps/contacts/ajax/addproperty.php
index 97d38397fd18fa010248787ba636765cc70d88be..be9e849be721dc8258d962573cb1428c29bd6516 100644
--- a/apps/contacts/ajax/addproperty.php
+++ b/apps/contacts/ajax/addproperty.php
@@ -26,6 +26,7 @@
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
function bailOut($msg) {
OCP\JSON::error(array('data' => array('message' => $msg)));
diff --git a/apps/contacts/ajax/createaddressbook.php b/apps/contacts/ajax/createaddressbook.php
index af7c19eef519f2aed3300022fdf351c43c204fe6..616766bb1a0c18c02d09da08606e9da954414168 100644
--- a/apps/contacts/ajax/createaddressbook.php
+++ b/apps/contacts/ajax/createaddressbook.php
@@ -11,6 +11,7 @@
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
$userid = OCP\USER::getUser();
$name = trim(strip_tags($_POST['name']));
diff --git a/apps/contacts/ajax/cropphoto.php b/apps/contacts/ajax/cropphoto.php
index 7b286dbdb5283adf8a07a0fca54a70d8384e8a71..7006c6fc1ffd846b6f733777b7b2e87d05a1d1e8 100644
--- a/apps/contacts/ajax/cropphoto.php
+++ b/apps/contacts/ajax/cropphoto.php
@@ -27,12 +27,14 @@
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
-$tmp_path = $_GET['tmp_path'];
+$tmp_path = strip_tags($_GET['tmp_path']);
+$requesttoken = strip_tags($_GET['requesttoken']);
$id = $_GET['id'];
OCP\Util::writeLog('contacts','ajax/cropphoto.php: tmp_path: '.$tmp_path.', exists: '.file_exists($tmp_path), OCP\Util::DEBUG);
$tmpl = new OCP\Template("contacts", "part.cropphoto");
$tmpl->assign('tmp_path', $tmp_path);
$tmpl->assign('id', $id);
+$tmpl->assign('requesttoken', $requesttoken);
$page = $tmpl->fetchPage();
OCP\JSON::success(array('data' => array( 'page' => $page )));
diff --git a/apps/contacts/ajax/deletebook.php b/apps/contacts/ajax/deletebook.php
index bcf6aa4432967f78135fe16a033cc42be8000ace..4520374a23b1b2859663c220301391f39efd89bc 100644
--- a/apps/contacts/ajax/deletebook.php
+++ b/apps/contacts/ajax/deletebook.php
@@ -26,6 +26,7 @@
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
//$id = $_GET['id'];
$id = $_POST['id'];
diff --git a/apps/contacts/ajax/deletecard.php b/apps/contacts/ajax/deletecard.php
index 98ff06ebe7a5ac31c22bdeaa3a2e76defa3e3a63..f998185be416700f40d7374e1fa10cfb3ce43a92 100644
--- a/apps/contacts/ajax/deletecard.php
+++ b/apps/contacts/ajax/deletecard.php
@@ -31,6 +31,7 @@ function bailOut($msg) {
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
$id = isset($_POST['id'])?$_POST['id']:null;
if(!$id) {
diff --git a/apps/contacts/ajax/deleteproperty.php b/apps/contacts/ajax/deleteproperty.php
index a1372870344e1b4a8643ca335142bf9a9027c5ee..95fd43e0d95c91e460d86b6efc0dd9ff3d1402ea 100644
--- a/apps/contacts/ajax/deleteproperty.php
+++ b/apps/contacts/ajax/deleteproperty.php
@@ -26,6 +26,7 @@
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
$id = $_POST['id'];
$checksum = $_POST['checksum'];
diff --git a/apps/contacts/ajax/oc_photo.php b/apps/contacts/ajax/oc_photo.php
index 184217f2b72f015ee72939f03afd2ecfce114403..903d2aedfbe13b545b4f7b179eb16801bf2ad9ce 100644
--- a/apps/contacts/ajax/oc_photo.php
+++ b/apps/contacts/ajax/oc_photo.php
@@ -24,6 +24,7 @@
OCP\JSON::setContentTypeHeader('text/plain');
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
function bailOut($msg) {
OCP\JSON::error(array('data' => array('message' => $msg)));
OCP\Util::writeLog('contacts','ajax/oc_photo.php: '.$msg, OCP\Util::ERROR);
diff --git a/apps/contacts/ajax/savecrop.php b/apps/contacts/ajax/savecrop.php
index fe9e5c5b99190ade5f0d59f84f8f2bfed96a7a50..263361bafc1c384e15abc9d5a4a83bdba3fad30b 100644
--- a/apps/contacts/ajax/savecrop.php
+++ b/apps/contacts/ajax/savecrop.php
@@ -21,13 +21,26 @@
* TODO: Translatable strings.
* Remember to delete tmp file at some point.
*/
-// Init owncloud
-OCP\Util::writeLog('contacts','ajax/savecrop.php: Huzzah!!!', OCP\Util::DEBUG);
+function bailOut($msg) {
+ OCP\JSON::error(array('data' => array('message' => $msg)));
+ OCP\Util::writeLog('contacts','ajax/savecrop.php: '.$msg, OCP\Util::DEBUG);
+ exit();
+}
+function debug($msg) {
+ OCP\Util::writeLog('contacts','ajax/savecrop.php: '.$msg, OCP\Util::DEBUG);
+}
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+foreach($_POST as $key=>$value) {
+ debug('POST: '.$key.'=>'.$value);
+}
+foreach($_GET as $key=>$value) {
+ debug('GET: '.$key.'=>'.$value);
+}
+OCP\JSON::callCheck();
// foreach ($_POST as $key=>$element) {
// OCP\Util::writeLog('contacts','ajax/savecrop.php: '.$key.'=>'.$element, OCP\Util::DEBUG);
@@ -36,12 +49,6 @@ OCP\JSON::checkAppEnabled('contacts');
// Firefox and Konqueror tries to download application/json for me. --Arthur
OCP\JSON::setContentTypeHeader('text/plain');
-function bailOut($msg) {
- OCP\JSON::error(array('data' => array('message' => $msg)));
- OCP\Util::writeLog('contacts','ajax/savecrop.php: '.$msg, OCP\Util::DEBUG);
- exit();
-}
-
$image = null;
$x1 = (isset($_POST['x1']) && $_POST['x1']) ? $_POST['x1'] : 0;
diff --git a/apps/contacts/ajax/saveproperty.php b/apps/contacts/ajax/saveproperty.php
index 6509ac21f280d959de9a4815de1e98ffbe0c3767..96e082d00e911c3a3e9812ebf98ccd22dc26649f 100644
--- a/apps/contacts/ajax/saveproperty.php
+++ b/apps/contacts/ajax/saveproperty.php
@@ -26,6 +26,7 @@
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
function bailOut($msg) {
OCP\JSON::error(array('data' => array('message' => $msg)));
diff --git a/apps/contacts/ajax/updateaddressbook.php b/apps/contacts/ajax/updateaddressbook.php
index 19b5b3bddce55ed9f0e299ed4bb1282778b1bb14..68fe8f81211b796561ba278ea0717b8a320e6923 100644
--- a/apps/contacts/ajax/updateaddressbook.php
+++ b/apps/contacts/ajax/updateaddressbook.php
@@ -11,6 +11,7 @@
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
$bookid = $_POST['id'];
OC_Contacts_App::getAddressbook($bookid); // is owner access check
diff --git a/apps/contacts/ajax/uploadimport.php b/apps/contacts/ajax/uploadimport.php
index b11f380fa8a885322bf0d766db2dd1842b72128f..4c3f5eadf08f8152b6a65a849fce925b5afa77a0 100644
--- a/apps/contacts/ajax/uploadimport.php
+++ b/apps/contacts/ajax/uploadimport.php
@@ -23,14 +23,12 @@
// Check if we are a user
OCP\JSON::checkLoggedIn();
OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
function bailOut($msg) {
OCP\JSON::error(array('data' => array('message' => $msg)));
OCP\Util::writeLog('contacts','ajax/uploadimport.php: '.$msg, OCP\Util::ERROR);
exit();
}
-function debug($msg) {
- OCP\Util::writeLog('contacts','ajax/uploadimport.php: '.$msg, OCP\Util::DEBUG);
-}
$view = OCP\Files::getStorage('contacts');
$tmpfile = md5(rand());
@@ -39,7 +37,6 @@ $tmpfile = md5(rand());
$fn = (isset($_SERVER['HTTP_X_FILE_NAME']) ? $_SERVER['HTTP_X_FILE_NAME'] : false);
if($fn) {
if($view->file_put_contents('/'.$tmpfile, file_get_contents('php://input'))) {
- debug($fn.' uploaded');
OCP\JSON::success(array('data' => array('path'=>'', 'file'=>$tmpfile)));
exit();
} else {
@@ -70,7 +67,6 @@ $file=$_FILES['importfile'];
$tmpfname = tempnam(get_temp_dir(), "occOrig");
if(file_exists($file['tmp_name'])) {
if($view->file_put_contents('/'.$tmpfile, file_get_contents($file['tmp_name']))) {
- debug($fn.' uploaded');
OCP\JSON::success(array('data' => array('path'=>'', 'file'=>$tmpfile)));
} else {
bailOut(OC_Contacts_App::$l10n->t('Error uploading contacts to storage.'));
diff --git a/apps/contacts/ajax/uploadphoto.php b/apps/contacts/ajax/uploadphoto.php
index dca8ede6d601d4ee70ea0247930fcc9e83dd1231..2dc93362a149bcf7aa8244a1f7be65818eacfee6 100644
--- a/apps/contacts/ajax/uploadphoto.php
+++ b/apps/contacts/ajax/uploadphoto.php
@@ -19,14 +19,6 @@
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
*
*/
-// Init owncloud
-
-
-// Check if we are a user
-// Firefox and Konqueror tries to download application/json for me. --Arthur
-OCP\JSON::setContentTypeHeader('text/plain');
-OCP\JSON::checkLoggedIn();
-OCP\JSON::checkAppEnabled('contacts');
function bailOut($msg) {
OCP\JSON::error(array('data' => array('message' => $msg)));
OCP\Util::writeLog('contacts','ajax/uploadphoto.php: '.$msg, OCP\Util::DEBUG);
@@ -35,6 +27,16 @@ function bailOut($msg) {
function debug($msg) {
OCP\Util::writeLog('contacts','ajax/uploadphoto.php: '.$msg, OCP\Util::DEBUG);
}
+OCP\JSON::setContentTypeHeader('text/plain');
+OCP\JSON::checkLoggedIn();
+OCP\JSON::checkAppEnabled('contacts');
+foreach($_POST as $key=>$value) {
+ debug('POST: '.$key.'=>'.$value);
+}
+foreach($_GET as $key=>$value) {
+ debug('GET: '.$key.'=>'.$value);
+}
+OCP\JSON::callCheck();
// If it is a Drag'n'Drop transfer it's handled here.
$fn = (isset($_SERVER['HTTP_X_FILE_NAME']) ? $_SERVER['HTTP_X_FILE_NAME'] : false);
diff --git a/apps/contacts/js/contacts.js b/apps/contacts/js/contacts.js
index 4f8f3743dc4eb300399408edda4041aecb8eab32..436599568697d6292cf557a7d866a7ef0eddd27c 100644
--- a/apps/contacts/js/contacts.js
+++ b/apps/contacts/js/contacts.js
@@ -1150,7 +1150,7 @@ Contacts={
},
editPhoto:function(id, tmp_path){
//alert('editPhoto: ' + tmp_path);
- $.getJSON(OC.filePath('contacts', 'ajax', 'cropphoto.php'),{'tmp_path':tmp_path,'id':this.id},function(jsondata){
+ $.getJSON(OC.filePath('contacts', 'ajax', 'cropphoto.php'),{'tmp_path':tmp_path,'id':this.id,'requesttoken':requesttoken},function(jsondata){
if(jsondata.status == 'success'){
//alert(jsondata.data.page);
$('#edit_photo_dialog_img').html(jsondata.data.page);
@@ -1637,7 +1637,7 @@ $(document).ready(function(){
//}
}
};
- xhr.open('POST', OC.filePath('contacts', 'ajax', 'uploadphoto.php')+'?id='+Contacts.UI.Card.id+'&imagefile='+encodeURIComponent(file.name), true);
+ xhr.open('POST', OC.filePath('contacts', 'ajax', 'uploadphoto.php')+'?id='+Contacts.UI.Card.id+'&requesttoken='+requesttoken+'&imagefile='+encodeURIComponent(file.name), true);
xhr.setRequestHeader('Cache-Control', 'no-cache');
xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
xhr.setRequestHeader('X_FILE_NAME', encodeURIComponent(file.name));
diff --git a/apps/contacts/templates/part.contact.php b/apps/contacts/templates/part.contact.php
index 74522be37c41333712fd7f618547e01cf0e307a1..9a13aafa5e3820bddd98c69b2a8991e6c61ef49b 100644
--- a/apps/contacts/templates/part.contact.php
+++ b/apps/contacts/templates/part.contact.php
@@ -4,6 +4,7 @@ $id = isset($_['id']) ? $_['id'] : '';
<div id="card">
<form class="float" id="file_upload_form" action="<?php echo OCP\Util::linkTo('contacts', 'ajax/uploadphoto.php'); ?>" method="post" enctype="multipart/form-data" target="file_upload_target">
<input type="hidden" name="id" value="<?php echo $_['id'] ?>">
+ <input type="hidden" name="requesttoken" value="<?php echo $_['requesttoken'] ?>">
<input type="hidden" name="MAX_FILE_SIZE" value="<?php echo $_['uploadMaxFilesize'] ?>" id="max_upload">
<input type="hidden" class="max_human_file_size" value="(max <?php echo $_['uploadMaxHumanFilesize']; ?>)">
<input id="file_upload_start" type="file" accept="image/*" name="imagefile" />
diff --git a/apps/contacts/templates/part.cropphoto.php b/apps/contacts/templates/part.cropphoto.php
index 599951d9a972fb8096dfc083c99488414c635183..e10721791304c42d88299bec0a1283cf0891f970 100644
--- a/apps/contacts/templates/part.cropphoto.php
+++ b/apps/contacts/templates/part.cropphoto.php
@@ -1,6 +1,7 @@
<?php
$id = $_['id'];
$tmp_path = $_['tmp_path'];
+$requesttoken = $_['requesttoken'];
OCP\Util::writeLog('contacts','templates/part.cropphoto.php: tmp_path: '.$tmp_path.', exists: '.file_exists($tmp_path), OCP\Util::DEBUG);
?>
<script language="Javascript">
@@ -47,6 +48,7 @@ OCP\Util::writeLog('contacts','templates/part.cropphoto.php: tmp_path: '.$tmp_pa
action="<?php echo OCP\Util::linkToAbsolute('contacts', 'ajax/savecrop.php'); ?>">
<input type="hidden" id="id" name="id" value="<?php echo $id; ?>" />
+ <input type="hidden" id="requesttoken" name="requesttoken" value="<?php echo $requesttoken; ?>" />
<input type="hidden" id="tmp_path" name="tmp_path" value="<?php echo $tmp_path; ?>" />
<fieldset id="coords">
<input type="hidden" id="x1" name="x1" value="" />
diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php
index f9d879813590532865a994889bbb17b5896fc2ed..25281c452a5be1b21f91105dc6561f93b69d2b63 100644
--- a/core/templates/layout.user.php
+++ b/core/templates/layout.user.php
@@ -26,7 +26,7 @@
<?php endforeach; ?>
<script type="text/javascript">
$(function() {
- var requesttoken = '<?php echo $_['requesttoken']; ?>';
+ requesttoken = '<?php echo $_['requesttoken']; ?>';
$(document).bind('ajaxSend', function(elm, xhr, s){
if(requesttoken) {
xhr.setRequestHeader('requesttoken', requesttoken);