WordPress.org
Get WordPress

Plugin Directory

Changeset 662428


Ignore:
Timestamp:
02/02/2013 09:00:47 AM (13 years ago)
Author:
tosend.it
Message:

Stable Version updated to 2.5.10 - XSS vulnerability fix

Location:
pafacile
Files:
46 edited
42 copied

Legend:

Unmodified
Added
Removed

  • pafacile/tags/2.5.10/alboPretorio/dettaglio.php

    r654497 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213function buildModuloAlboPretorio(){
    314    global $wpdb, $current_user;

  • pafacile/tags/2.5.10/alboPretorio/elenco.php

    r649783 r662428  
    1 <?php
     1<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function displayAlboPretorioPublic($params, $extraParams = array()){
    313    global $wpdb;

  • pafacile/tags/2.5.10/alboPretorio/stampa.php

    r525549 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function buildStampaAlboPretorio(){
    313    global $wpdb, $current_user;

  • pafacile/tags/2.5.10/bandi/dettaglio.php

    r648290 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
     13
    214function adminDettaglioBandi(){
    315global $wpdb;

  • pafacile/tags/2.5.10/bandi/elenco.php

    r632155 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212
    313function displayBandiPublic($params, $extraParams = array()){

  • pafacile/tags/2.5.10/delibere/dettaglio.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213global $wpdb;
    314$tableName = $wpdb->prefix . TOSENDIT_PAFACILE_DB_DELIBERE;

  • pafacile/tags/2.5.10/delibere/elenco.php

    r619814 r662428  
    11<?php
    2 #require_once 'public-contents/Delibere.php';
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    311
    412function displayDeliberePublic($params, $extraParams = array()){

  • pafacile/tags/2.5.10/determine/dettaglio.php

    r470551 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212global $wpdb, $current_user;
    313$tableName = $wpdb->prefix . TOSENDIT_PAFACILE_DB_DETERMINE;

  • pafacile/tags/2.5.10/determine/elenco.php

    r619814 r662428  
    11<?php
    22# require_once 'public-contents/Determine.php';
     3/*
     4 * Sinve Version 2.5.10
     5* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     6*/
     7if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     8        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     9        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     10)
     11    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    312
    413function displayDeterminePublic($params, $extraParams = array()){

  • pafacile/tags/2.5.10/images/tree/index.php

    r459538 r662428  
    55    $basedir = dirname(__FILE__) .'/';
    66    $structure = $_GET['structure'];
    7     if(file_exists("$basedir$structure.gif")){
     7    if(is_numeric($_GET['structure']) && file_exists("$basedir$structure.gif")){
    88        header("Location: $structure.gif");
    99        exit();
    1010    }
    11    
     11    if(!is_numeric($_GET['structure'])){
     12       
     13        die("Codice struttura invalido");
     14       
     15    }
    1216    $l = strlen($structure);
    1317    if($l==0){

  • pafacile/tags/2.5.10/incarichiProfessionali/dettaglio.php

    r559534 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function getDettaglio(){
    313    global $wpdb, $current_user;

  • pafacile/tags/2.5.10/ordinanze/dettaglio.php

    r470551 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212global $wpdb, $current_user;
    313

  • pafacile/tags/2.5.10/ordinanze/elenco.php

    r619814 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
     13
    214function displayOrdinanze(){
    315    toSendItGenericMethods::mergeSearchFilter('ricerca_ordinanze');

  • pafacile/tags/2.5.10/organi/dettaglio.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
     13
    214function organiDettaglio(){
    315   

  • pafacile/tags/2.5.10/organi/elenco.php

    r619814 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213function displayOrgani(){
    314    toSendItGenericMethods::mergeSearchFilter('ricerca_organi');

  • pafacile/tags/2.5.10/organigramma/dettaglio.php

    r611965 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
     13
    214function displayDettaglioOrganigramma(){
    315    global $wpdb;

  • pafacile/tags/2.5.10/organigramma/elenco.php

    r611965 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    211
    312

  • pafacile/tags/2.5.10/public-contents/AlboPretorio.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213/****************************************************************
    314 * Procedure per la visualizzazione pubblica dell'albo pretorio:

  • pafacile/tags/2.5.10/public-contents/BandiGare.php

    r648290 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213require_once PAFACILE_PLUING_DIRECTORY .'/public-contents/iContents.php';
    314

  • pafacile/tags/2.5.10/public-contents/Delibere.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213/****************************************************************
    314     * Procedure per la visualizzazione pubblica delle delibere:

  • pafacile/tags/2.5.10/public-contents/Determine.php

    r525549 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212   
    313    /****************************************************************

  • pafacile/tags/2.5.10/public-contents/Incarichi.php

    r559534 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213    /****************************************************************
    314     * Procedure per la visualizzaizone degli incarichi professionali

  • pafacile/tags/2.5.10/public-contents/Ordinanze.php

    r525549 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213    /****************************************************************
    314     * Procedure per la visualizzaizone delle ordinanze

  • pafacile/tags/2.5.10/public-contents/Organi.php

    r525549 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    211
    312    /* **************************************************

  • pafacile/tags/2.5.10/public-contents/Sovvenzioni.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212require_once PAFACILE_PLUING_DIRECTORY .'/public-contents/iContents.php';
    313class Sovvenzioni extends PAFacilePublicBaseClass implements iContents {
    … …  
    5767       
    5868        echo $buffer;
     69        /*
     70         * Since Ver. 2.5.10
     71         * Assenza del box di upload
     72         */
     73        toSendItGenericMethods::displayFileUploadBox($tableName, $itemId);
    5974       
    6075        return true;

  • pafacile/tags/2.5.10/readme.txt

    r661392 r662428  
    55Requires at least: 3.4
    66Tested up to: 3.5
    7 Stable tag: 2.5.9
     7Stable tag: 2.5.10
    88License: GPLv3
    99
    … …  
    1212== Description ==
    1313
    14 **NOTA:** Aggiornare immediatamente PAFacile se si sta utilizzando una versione precedente alla 2.5.9.
     14**NOTA:** Aggiornare immediatamente PAFacile se si sta utilizzando una versione precedente alla 2.5.10.
     15È stata scoperta una vulnerabilità di tipo XSS per la quale un individuo potrebbe iniettare del codice
     16Javascript in alcune delle pagine del sito veicolando eventuali codici malevoli verso gli utenti ignari. 
    1517
    1618PAFacile è un plugin sviluppato dalla [toSend.it](http://tosend.it) per venire incontro alle esigenze della Pubblica Amministrazione e degli Enti Locali creando uno strumento semplice da usare e facile da manutenere e intuitivo nella sua configurazione.
    … …  
    7274
    7375== Changelog ==
     76
     77= 2.5.10 (2013-02-02) =
     78* **Update:** Aggiunto box dei file alla sezione pubblica delle sovvenzioni. 
     79* **Security:** Corretto il codice per evitare un attacco di tipo XSS (thanks to Dejan Lukan).
    7480
    7581= 2.5.9 (2013-01-30) =

  • pafacile/tags/2.5.10/sovvenzioni/dettaglio.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function buildModuloSovvenzioni(){
    313    global $wpdb, $current_user;

  • pafacile/tags/2.5.10/sovvenzioni/elenco.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function displaySovvenzioniPublic($params, $extraParams = array()){
    313    global $wpdb;

  • pafacile/tags/2.5.10/tipiAtto/dettaglio.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function adminDettaglioTipiAtto(){
    313global $wpdb;

  • pafacile/tags/2.5.10/tipiAtto/elenco.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212/* =====================
    313 *  SINCE VERSION 1.5.6

  • pafacile/tags/2.5.10/tipiOrgani/dettaglio.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    211
    312class adminFormBuilder{

  • pafacile/tags/2.5.10/tipiOrgani/elenco.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212/* =====================
    313 *  SINCE VERSION 1.5.6

  • pafacile/tags/2.5.10/toSendItPAFacileContents.php

    r643338 r662428  
    11<?php
     2
     3/*
     4 * Sinve Version 2.5.10
     5 * Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     6 */
     7if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     8        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     9        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     10)
     11    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     12
    213require_once PAFACILE_PLUING_DIRECTORY .'/public-contents/Determine.php';
    314require_once PAFACILE_PLUING_DIRECTORY .'/public-contents/Delibere.php';

  • pafacile/tags/2.5.10/tosendit-pa.php

    r661392 r662428  
    33 * @package toSend.it
    44 * @author toSend.it di Luisa Marra
    5  * @version 2.5.9
     5 * @version 2.5.10
    66 */
    77/*
    … …  
    1010Description: PAFacile è un plugin nato per consentire alle pubbliche amministrazione di gestire la trasparenza amministrativa secondo gli obblighi di legge. Il plugin è l'unico in Italia a consentire l'adeguamento di un sito web di una pubblica amministrazione agli ultimi aggiornamenti normativa in materia di Albo Pretorio on-line, Bandi di Gara, Delbere e determinazioni, Ordinanze, Organigramma, Incarichi professionali, Sovvenzioni.
    1111Author: toSend.it di Luisa Marra
    12 Version: 2.5.9
     12Version: 2.5.10
    1313Author URI: http://toSend.it
    1414*/
    … …  
    3030#define('TOSENDIT_PAFACILE_VERSION', '2.5.7');
    3131#define('TOSENDIT_PAFACILE_VERSION', '2.5.8');
    32 define('TOSENDIT_PAFACILE_VERSION', '2.5.9');
     32#define('TOSENDIT_PAFACILE_VERSION', '2.5.9');
     33define('TOSENDIT_PAFACILE_VERSION', '2.5.10');
    3334
    3435# è PAFacile in un installazione di default

  • pafacile/tags/2.5.10/welcome.php

    r649783 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    211
    312function pageWelcomeVersionOutput($currentVersion, $minimalVersion ){

  • pafacile/trunk/alboPretorio/dettaglio.php

    r654497 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213function buildModuloAlboPretorio(){
    314    global $wpdb, $current_user;

  • pafacile/trunk/alboPretorio/elenco.php

    r649783 r662428  
    1 <?php
     1<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function displayAlboPretorioPublic($params, $extraParams = array()){
    313    global $wpdb;

  • pafacile/trunk/alboPretorio/stampa.php

    r525549 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function buildStampaAlboPretorio(){
    313    global $wpdb, $current_user;

  • pafacile/trunk/bandi/dettaglio.php

    r648290 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
     13
    214function adminDettaglioBandi(){
    315global $wpdb;

  • pafacile/trunk/bandi/elenco.php

    r632155 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212
    313function displayBandiPublic($params, $extraParams = array()){

  • pafacile/trunk/delibere/dettaglio.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213global $wpdb;
    314$tableName = $wpdb->prefix . TOSENDIT_PAFACILE_DB_DELIBERE;

  • pafacile/trunk/delibere/elenco.php

    r619814 r662428  
    11<?php
    2 #require_once 'public-contents/Delibere.php';
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    311
    412function displayDeliberePublic($params, $extraParams = array()){

  • pafacile/trunk/determine/dettaglio.php

    r470551 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212global $wpdb, $current_user;
    313$tableName = $wpdb->prefix . TOSENDIT_PAFACILE_DB_DETERMINE;

  • pafacile/trunk/determine/elenco.php

    r619814 r662428  
    11<?php
    22# require_once 'public-contents/Determine.php';
     3/*
     4 * Sinve Version 2.5.10
     5* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     6*/
     7if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     8        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     9        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     10)
     11    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    312
    413function displayDeterminePublic($params, $extraParams = array()){

  • pafacile/trunk/images/tree/index.php

    r459538 r662428  
    55    $basedir = dirname(__FILE__) .'/';
    66    $structure = $_GET['structure'];
    7     if(file_exists("$basedir$structure.gif")){
     7    if(is_numeric($_GET['structure']) && file_exists("$basedir$structure.gif")){
    88        header("Location: $structure.gif");
    99        exit();
    1010    }
    11    
     11    if(!is_numeric($_GET['structure'])){
     12       
     13        die("Codice struttura invalido");
     14       
     15    }
    1216    $l = strlen($structure);
    1317    if($l==0){

  • pafacile/trunk/incarichiProfessionali/dettaglio.php

    r559534 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function getDettaglio(){
    313    global $wpdb, $current_user;

  • pafacile/trunk/ordinanze/dettaglio.php

    r470551 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212global $wpdb, $current_user;
    313

  • pafacile/trunk/ordinanze/elenco.php

    r619814 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
     13
    214function displayOrdinanze(){
    315    toSendItGenericMethods::mergeSearchFilter('ricerca_ordinanze');

  • pafacile/trunk/organi/dettaglio.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
     13
    214function organiDettaglio(){
    315   

  • pafacile/trunk/organi/elenco.php

    r619814 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213function displayOrgani(){
    314    toSendItGenericMethods::mergeSearchFilter('ricerca_organi');

  • pafacile/trunk/organigramma/dettaglio.php

    r611965 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
     13
    214function displayDettaglioOrganigramma(){
    315    global $wpdb;

  • pafacile/trunk/organigramma/elenco.php

    r611965 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    211
    312

  • pafacile/trunk/public-contents/AlboPretorio.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213/****************************************************************
    314 * Procedure per la visualizzazione pubblica dell'albo pretorio:

  • pafacile/trunk/public-contents/BandiGare.php

    r648290 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213require_once PAFACILE_PLUING_DIRECTORY .'/public-contents/iContents.php';
    314

  • pafacile/trunk/public-contents/Delibere.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213/****************************************************************
    314     * Procedure per la visualizzazione pubblica delle delibere:

  • pafacile/trunk/public-contents/Determine.php

    r525549 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212   
    313    /****************************************************************

  • pafacile/trunk/public-contents/Incarichi.php

    r559534 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213    /****************************************************************
    314     * Procedure per la visualizzaizone degli incarichi professionali

  • pafacile/trunk/public-contents/Ordinanze.php

    r525549 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
     12
    213    /****************************************************************
    314     * Procedure per la visualizzaizone delle ordinanze

  • pafacile/trunk/public-contents/Organi.php

    r525549 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    211
    312    /* **************************************************

  • pafacile/trunk/public-contents/Sovvenzioni.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212require_once PAFACILE_PLUING_DIRECTORY .'/public-contents/iContents.php';
    313class Sovvenzioni extends PAFacilePublicBaseClass implements iContents {
    … …  
    5767       
    5868        echo $buffer;
     69        /*
     70         * Since Ver. 2.5.10
     71         * Assenza del box di upload
     72         */
     73        toSendItGenericMethods::displayFileUploadBox($tableName, $itemId);
    5974       
    6075        return true;

  • pafacile/trunk/readme.txt

    r661392 r662428  
    55Requires at least: 3.4
    66Tested up to: 3.5
    7 Stable tag: 2.5.9
     7Stable tag: 2.5.10
    88License: GPLv3
    99
    … …  
    1212== Description ==
    1313
    14 **NOTA:** Aggiornare immediatamente PAFacile se si sta utilizzando una versione precedente alla 2.5.9.
     14**NOTA:** Aggiornare immediatamente PAFacile se si sta utilizzando una versione precedente alla 2.5.10.
     15È stata scoperta una vulnerabilità di tipo XSS per la quale un individuo potrebbe iniettare del codice
     16Javascript in alcune delle pagine del sito veicolando eventuali codici malevoli verso gli utenti ignari. 
    1517
    1618PAFacile è un plugin sviluppato dalla [toSend.it](http://tosend.it) per venire incontro alle esigenze della Pubblica Amministrazione e degli Enti Locali creando uno strumento semplice da usare e facile da manutenere e intuitivo nella sua configurazione.
    … …  
    7274
    7375== Changelog ==
     76
     77= 2.5.10 (2013-02-02) =
     78* **Update:** Aggiunto box dei file alla sezione pubblica delle sovvenzioni. 
     79* **Security:** Corretto il codice per evitare un attacco di tipo XSS (thanks to Dejan Lukan).
    7480
    7581= 2.5.9 (2013-01-30) =

  • pafacile/trunk/sovvenzioni/dettaglio.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function buildModuloSovvenzioni(){
    313    global $wpdb, $current_user;

  • pafacile/trunk/sovvenzioni/elenco.php

    r643338 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function displaySovvenzioniPublic($params, $extraParams = array()){
    313    global $wpdb;

  • pafacile/trunk/tipiAtto/dettaglio.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212function adminDettaglioTipiAtto(){
    313global $wpdb;

  • pafacile/trunk/tipiAtto/elenco.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212/* =====================
    313 *  SINCE VERSION 1.5.6

  • pafacile/trunk/tipiOrgani/dettaglio.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    211
    312class adminFormBuilder{

  • pafacile/trunk/tipiOrgani/elenco.php

    r459538 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     11
    212/* =====================
    313 *  SINCE VERSION 1.5.6

  • pafacile/trunk/toSendItPAFacileContents.php

    r643338 r662428  
    11<?php
     2
     3/*
     4 * Sinve Version 2.5.10
     5 * Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     6 */
     7if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     8        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     9        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     10)
     11    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
     12
    213require_once PAFACILE_PLUING_DIRECTORY .'/public-contents/Determine.php';
    314require_once PAFACILE_PLUING_DIRECTORY .'/public-contents/Delibere.php';

  • pafacile/trunk/tosendit-pa.php

    r661392 r662428  
    33 * @package toSend.it
    44 * @author toSend.it di Luisa Marra
    5  * @version 2.5.9
     5 * @version 2.5.10
    66 */
    77/*
    … …  
    1010Description: PAFacile è un plugin nato per consentire alle pubbliche amministrazione di gestire la trasparenza amministrativa secondo gli obblighi di legge. Il plugin è l'unico in Italia a consentire l'adeguamento di un sito web di una pubblica amministrazione agli ultimi aggiornamenti normativa in materia di Albo Pretorio on-line, Bandi di Gara, Delbere e determinazioni, Ordinanze, Organigramma, Incarichi professionali, Sovvenzioni.
    1111Author: toSend.it di Luisa Marra
    12 Version: 2.5.9
     12Version: 2.5.10
    1313Author URI: http://toSend.it
    1414*/
    … …  
    3030#define('TOSENDIT_PAFACILE_VERSION', '2.5.7');
    3131#define('TOSENDIT_PAFACILE_VERSION', '2.5.8');
    32 define('TOSENDIT_PAFACILE_VERSION', '2.5.9');
     32#define('TOSENDIT_PAFACILE_VERSION', '2.5.9');
     33define('TOSENDIT_PAFACILE_VERSION', '2.5.10');
    3334
    3435# è PAFacile in un installazione di default

  • pafacile/trunk/welcome.php

    r649783 r662428  
    11<?php
     2/*
     3 * Sinve Version 2.5.10
     4* Avoid XSS vulnerability discovered by Dejan Lukan many thanks!
     5*/
     6if (!empty($_SERVER['SCRIPT_FILENAME']) &&
     7        basename(__FILE__)             == basename($_SERVER['SCRIPT_FILENAME']) &&            // Same script file
     8        basename(dirname(__FILE__)) == basename(dirname($_SERVER['SCRIPT_FILENAME']))    // Same directory
     9)
     10    die ('Please do not load this page directly. Thanks to Dejan Lukan for the notification!');
    211
    312function pageWelcomeVersionOutput($currentVersion, $minimalVersion ){
Note: See TracChangeset for help on using the changeset viewer.