- 
- getAccessLevel('pipelines.removeFromPipeline') >= ACCESS_LEVEL_DELETE): ?>
-
-
-
-
+ getAccessLevel('pipelines.removeFromPipeline') >= ACCESS_LEVEL_DELETE): ?>
+
+
diff --git a/ajax/setCandidateJobOrderRating.php b/ajax/setCandidateJobOrderRating.php
index 19236e202..2d545c964 100755
--- a/ajax/setCandidateJobOrderRating.php
+++ b/ajax/setCandidateJobOrderRating.php
@@ -32,6 +32,12 @@
$interface = new SecureAJAXInterface();
+if ($_SERVER['REQUEST_METHOD'] !== 'POST')
+{
+ $interface->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+}
+
if ($_SESSION['CATS']->getAccessLevel('pipelines.editRating') < ACCESS_LEVEL_EDIT)
{
$interface->outputXMLErrorPage(-1, ERROR_NO_PERMISSION);
@@ -45,7 +51,7 @@
}
if (!$interface->isRequiredIDValid('rating', true, true) ||
- $_REQUEST['rating'] < -6 || $_REQUEST['rating'] > 5)
+ $_POST['rating'] < -6 || $_POST['rating'] > 5)
{
$interface->outputXMLErrorPage(-1, 'Invalid rating.');
die();
@@ -53,8 +59,8 @@
$siteID = $interface->getSiteID();
-$candidateJobOrderID = $_REQUEST['candidateJobOrderID'];
-$rating = $_REQUEST['rating'];
+$candidateJobOrderID = $_POST['candidateJobOrderID'];
+$rating = $_POST['rating'];
$pipelines = new Pipelines($siteID);
$pipelines->updateRatingValue($candidateJobOrderID, $rating);
diff --git a/ajax/setColumnWidth.php b/ajax/setColumnWidth.php
index f4efbe03b..ca2bc7ce9 100755
--- a/ajax/setColumnWidth.php
+++ b/ajax/setColumnWidth.php
@@ -29,9 +29,21 @@
$interface = new SecureAJAXInterface();
-$instance = $_REQUEST['instance'];
-$columnName = $_REQUEST['columnName'];
-$columnWidth = $_REQUEST['columnWidth'];
+if ($_SERVER['REQUEST_METHOD'] !== 'POST')
+{
+ $interface->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+}
+
+if (!isset($_POST['instance']) || !isset($_POST['columnName']) || !isset($_POST['columnWidth']))
+{
+ $interface->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+}
+
+$instance = $_POST['instance'];
+$columnName = $_POST['columnName'];
+$columnWidth = $_POST['columnWidth'];
$columnPreferences = $_SESSION['CATS']->getColumnPreferences($instance);
diff --git a/ajax/testEmailSettings.php b/ajax/testEmailSettings.php
index 5845e4b53..f93751b80 100755
--- a/ajax/testEmailSettings.php
+++ b/ajax/testEmailSettings.php
@@ -32,10 +32,16 @@
$interface = new SecureAJAXInterface();
+if ($_SERVER['REQUEST_METHOD'] !== 'POST')
+{
+ $interface->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+}
+
$siteID = $interface->getSiteID();
-if (!isset($_REQUEST['testEmailAddress']) ||
- empty($_REQUEST['testEmailAddress']))
+if (!isset($_POST['testEmailAddress']) ||
+ empty($_POST['testEmailAddress']))
{
$interface->outputXMLErrorPage(
-1, 'Invalid test e-mail address.'
@@ -44,8 +50,8 @@
die();
}
-if (!isset($_REQUEST['fromAddress']) ||
- empty($_REQUEST['fromAddress']))
+if (!isset($_POST['fromAddress']) ||
+ empty($_POST['fromAddress']))
{
$interface->outputXMLErrorPage(
-1, 'Invalid from e-mail address.'
@@ -54,8 +60,8 @@
die();
}
-$testEmailAddress = $_REQUEST['testEmailAddress'];
-$fromAddress = $_REQUEST['fromAddress'];
+$testEmailAddress = $_POST['testEmailAddress'];
+$fromAddress = $_POST['fromAddress'];
/* Is the test e-mail address specified valid? */
// FIXME: Validate properly.
diff --git a/index.php b/index.php
index e35a864f3..ad6b13ba7 100644
--- a/index.php
+++ b/index.php
@@ -172,6 +172,32 @@ function stripslashes_deep($value)
}
}
+if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST' &&
+ $_SESSION['CATS']->isLoggedIn() &&
+ (!isset($careerPage) || !$careerPage) &&
+ (!isset($_GET['showCareerPortal']) || $_GET['showCareerPortal'] != '1') &&
+ (!isset($rssPage) || !$rssPage) &&
+ (!isset($xmlPage) || !$xmlPage))
+{
+ $module = isset($_GET['m']) ? $_GET['m'] : '';
+
+ if ($module == '' || $module == 'logout' ||
+ ModuleUtility::moduleRequiresAuthentication($module))
+ {
+ $token = null;
+
+ if (isset($_POST['csrfToken']))
+ {
+ $token = $_POST['csrfToken'];
+ }
+
+ if (!$_SESSION['CATS']->isCSRFTokenValid($token))
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, null, 'Invalid request.');
+ }
+ }
+}
+
/* Check to see if we are supposed to display the career page. */
if (((isset($careerPage) && $careerPage) ||
(isset($_GET['showCareerPortal']) && $_GET['showCareerPortal'] == '1')))
@@ -219,6 +245,11 @@ function stripslashes_deep($value)
{
if ($_GET['m'] == 'logout')
{
+ if ($_SERVER['REQUEST_METHOD'] !== 'POST')
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, null, 'Invalid request.');
+ }
+
/* There isn't really a logout module. It's just a few lines. */
$unixName = $_SESSION['CATS']->getUnixName();
@@ -233,12 +264,20 @@ function stripslashes_deep($value)
$URI .= '&s=' . $unixName;
}
- if (isset($_GET['message']))
+ if (isset($_POST['message']))
+ {
+ $URI .= '&message=' . urlencode($_POST['message']);
+ }
+ else if (isset($_GET['message']))
{
$URI .= '&message=' . urlencode($_GET['message']);
}
- if (isset($_GET['messageSuccess']))
+ if (isset($_POST['messageSuccess']))
+ {
+ $URI .= '&messageSuccess=' . urlencode($_POST['messageSuccess']);
+ }
+ else if (isset($_GET['messageSuccess']))
{
$URI .= '&messageSuccess=' . urlencode($_GET['messageSuccess']);
}
diff --git a/js/lib.js b/js/lib.js
index cb80e2e59..4ab3884f6 100755
--- a/js/lib.js
+++ b/js/lib.js
@@ -342,6 +342,20 @@ function AJAX_getPOSTSessionID(sessionCookie)
function AJAX_POST(http, url, POSTData, callBack, timeout, sessionCookie,
silentTimeout)
{
+ if (POSTData == null)
+ {
+ POSTData = '';
+ }
+
+ if (typeof CATSCsrfToken != 'undefined' && CATSCsrfToken !== null &&
+ CATSCsrfToken !== '')
+ {
+ if (POSTData.indexOf('csrfToken=') == -1)
+ {
+ POSTData += '&csrfToken=' + encodeURIComponent(CATSCsrfToken);
+ }
+ }
+
/* Add a random hash to the POST data to keep IE from caching it. */
POSTData += AJAX_getRandomPOSTHash();
diff --git a/js/lists.js b/js/lists.js
index 09edc620c..50157f3a0 100755
--- a/js/lists.js
+++ b/js/lists.js
@@ -205,7 +205,34 @@ function deleteListFromListView(savedListID, numberEntries)
return;
}
- document.location.href = CATSIndexName + '?m=lists&a=deleteStaticList&savedListID=' + savedListID;
+ var form = document.createElement('form');
+ form.method = 'post';
+ form.action = CATSIndexName + '?m=lists&a=deleteStaticList';
+
+ var postback = document.createElement('input');
+ postback.type = 'hidden';
+ postback.name = 'postback';
+ postback.value = 'postback';
+ form.appendChild(postback);
+
+ var savedListInput = document.createElement('input');
+ savedListInput.type = 'hidden';
+ savedListInput.name = 'savedListID';
+ savedListInput.value = savedListID;
+ form.appendChild(savedListInput);
+
+ if (typeof CATSCsrfToken != 'undefined' && CATSCsrfToken !== null &&
+ CATSCsrfToken !== '')
+ {
+ var csrfToken = document.createElement('input');
+ csrfToken.type = 'hidden';
+ csrfToken.name = 'csrfToken';
+ csrfToken.value = CATSCsrfToken;
+ form.appendChild(csrfToken);
+ }
+
+ document.body.appendChild(form);
+ form.submit();
}
function deleteListRow(savedListID, sessionCookie, numberEntries)
@@ -350,4 +377,3 @@ function addItemsToList(sessionCookie, dataItemType)
false
);
}
-
diff --git a/js/quickAction.js b/js/quickAction.js
index 5156ad009..75a825010 100755
--- a/js/quickAction.js
+++ b/js/quickAction.js
@@ -121,3 +121,72 @@ function showQuickActionAddToPipeline(menuDataItemId)
/* Create a popup window for adding this candidate to the job order / pipeline */
showPopWin(CATSIndexName + '?m=candidates&a=considerForJobSearch&candidateID=' + menuDataItemId, 750, 390, null);
};
+
+function quickActionPostFromUrl(url, confirmMessage)
+{
+ if (confirmMessage && !confirm(confirmMessage))
+ {
+ return false;
+ }
+
+ var parts = url.split('?');
+ var action = parts[0];
+ var query = (parts.length > 1) ? parts[1] : '';
+ var params = {};
+ var actionParams = [];
+
+ if (query.length > 0)
+ {
+ var pairs = query.split('&');
+ for (var i = 0; i < pairs.length; i++)
+ {
+ if (pairs[i] === '')
+ {
+ continue;
+ }
+
+ var keyValue = pairs[i].split('=');
+ var key = decodeURIComponent(keyValue[0].replace(/\+/g, ' '));
+ var value = keyValue.length > 1 ? decodeURIComponent(keyValue[1].replace(/\+/g, ' ')) : '';
+
+ if (key === 'm' || key === 'a')
+ {
+ actionParams.push(encodeURIComponent(key) + '=' + encodeURIComponent(value));
+ }
+ else
+ {
+ params[key] = value;
+ }
+ }
+ }
+
+ params.postback = 'postback';
+
+ if (typeof CATSCsrfToken != 'undefined' && CATSCsrfToken !== null &&
+ CATSCsrfToken !== '' && typeof params.csrfToken == 'undefined')
+ {
+ params.csrfToken = CATSCsrfToken;
+ }
+
+ var form = document.createElement('form');
+ form.method = 'post';
+ form.action = action + (actionParams.length ? ('?' + actionParams.join('&')) : '');
+
+ for (var name in params)
+ {
+ if (!params.hasOwnProperty(name))
+ {
+ continue;
+ }
+
+ var input = document.createElement('input');
+ input.type = 'hidden';
+ input.name = name;
+ input.value = params[name];
+ form.appendChild(input);
+ }
+
+ document.body.appendChild(form);
+ form.submit();
+ return false;
+}
diff --git a/js/wizardIntro.js b/js/wizardIntro.js
index f7c620e87..769ab26f9 100755
--- a/js/wizardIntro.js
+++ b/js/wizardIntro.js
@@ -60,7 +60,7 @@ function deleteUser(id)
{
failAction = 'alert("Unable to delete that user.");';
userActionSuccess = 'cancelAddUser(); loadPage("current");';
- userAction('DeleteUser&userID=' + id);
+ userActionPost('DeleteUser', 'userID=' + id);
}
function keyGood()
@@ -253,3 +253,67 @@ function userAction(action)
ajaxObj.open("GET",url,true);
ajaxObj.send(null);
}
+
+function userActionPost(action, postData)
+{
+ var ajaxObj;
+ var url = '?m=settings&a=ajax_wizard' + action;
+ var payload = 'postback=postback&' + postData;
+
+ if (typeof CATSCsrfToken != 'undefined' && CATSCsrfToken !== null &&
+ CATSCsrfToken !== '' && payload.indexOf('csrfToken=') == -1)
+ {
+ payload += '&csrfToken=' + encodeURIComponent(CATSCsrfToken);
+ }
+
+ try
+ {
+ // Firefox, Opera 8.0+, Safari
+ ajaxObj = new XMLHttpRequest();
+ }
+ catch (e)
+ {
+ // Internet Explorer
+ try
+ {
+ ajaxObj = new ActiveXObject("Msxml2.XMLHTTP");
+ }
+ catch (e)
+ {
+ try
+ {
+ ajaxObj = new ActiveXObject("Microsoft.XMLHTTP");
+ }
+ catch (e)
+ {
+ alert("Your browser does not support AJAX!");
+ return false;
+ }
+ }
+ }
+ ajaxObj.onreadystatechange = function()
+ {
+ if (ajaxObj.readyState == 4)
+ {
+ if (ajaxObj.responseText == 'Ok')
+ {
+ if (userActionSuccess != '') eval(userActionSuccess);
+ }
+ else
+ {
+ if (failAction != '')
+ {
+ eval(failAction);
+ }
+ else
+ {
+ alert(ajaxObj.responseText);
+ }
+ }
+ }
+ }
+
+ ajaxObj.open("POST", url, true);
+ ajaxObj.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
+ ajaxObj.send(payload);
+}
diff --git a/lib/AJAXInterface.php b/lib/AJAXInterface.php
index daf5fddf8..4dc50abc6 100755
--- a/lib/AJAXInterface.php
+++ b/lib/AJAXInterface.php
@@ -215,6 +215,22 @@ public function __construct()
die();
}
+ if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST')
+ {
+ $token = null;
+
+ if (isset($_POST['csrfToken']))
+ {
+ $token = $_POST['csrfToken'];
+ }
+
+ if (!$_SESSION['CATS']->isCSRFTokenValid($token))
+ {
+ $this->outputXMLErrorPage(-1, 'Invalid request.');
+ die();
+ }
+ }
+
/* Grab the current user's site ID. */
$this->_siteID = $_SESSION['CATS']->getSiteID();
diff --git a/lib/DataGrid.php b/lib/DataGrid.php
index c79b94a26..43dfa2104 100755
--- a/lib/DataGrid.php
+++ b/lib/DataGrid.php
@@ -2009,6 +2009,80 @@ public function getInnerActionAreaItem($actionTitle, $actionURL, $allowAll = tru
return $html;
}
+
+ /**
+ * Returns HTML to render a POST action under the action menu.
+ *
+ * @param string action title
+ * @param string action URL
+ * @param boolean (true) action can be applied to all items across every page
+ * @return string generated HTML
+ */
+ public function getInnerActionAreaItemPost($actionTitle, $actionURL, $allowAll = true)
+ {
+ //TODO: If nothing is selected, display an error popup.
+
+ $newParameterArraySelected = $this->_parameters;
+ $newParameterArraySelected['rangeStart'] = 0;
+ $newParameterArraySelected['maxResults'] = 100000000;
+ $newParameterArraySelected['exportIDs'] = '
', "\n";
+ echo $openTag,
+ '',
+ $closeTag,
+ ' ', "\n";
$escapedURL = htmlspecialchars($savedSearchRow['URL']);
@@ -481,9 +497,12 @@ public static function printSavedSearch($savedSearchRS)
}
$escapedURL = '/'.$escapedURL;
- echo '',
- '
';
+ echo ' ';
echo '', "\n";
echo '', "\n";
echo '', "\n";
+ if (isset($_SESSION['CATS']) && $_SESSION['CATS']->isLoggedIn())
+ {
+ $csrfToken = $_SESSION['CATS']->getCSRFToken();
+ echo '', "\n";
+ echo '', "\n";
+ }
$headIncludes[] = 'main.css';
diff --git a/main.css b/main.css
index b806329e8..7af638d50 100755
--- a/main.css
+++ b/main.css
@@ -424,7 +424,8 @@ p.noteUnsized
color: #666666;
}
-p.warning
+p.warning,
+div.warning
{
background-image: url('images/orange_gradient.jpg');
background-repeat: repeat-x;
@@ -776,6 +777,29 @@ p.freeformbottom
border: 1px solid #a4a4a4;
}
+button.linkButton
+{
+ background: none;
+ border: none;
+ padding: 0;
+ margin: 0;
+ cursor: pointer;
+ display: inline;
+ color: #00008b;
+ text-decoration: none;
+ font: normal normal normal 12px/130% Arial, Tahoma, sans-serif;
+}
+
+button.linkButton:hover
+{
+ text-decoration: underline;
+}
+
+button.linkButton.jobLinkHot
+{
+ color: #ff0000;
+}
+
.buttonCalendar
{
height: 20px;
diff --git a/modules/calendar/CalendarUI.js b/modules/calendar/CalendarUI.js
index 5d0755844..765e37a21 100755
--- a/modules/calendar/CalendarUI.js
+++ b/modules/calendar/CalendarUI.js
@@ -424,8 +424,34 @@ function confirmDeleteEntry()
return;
}
- document.location = getCurrentCalendarUrl() + '&a=deleteEvent&eventID='
- + document.getElementById('eventIDEdit').value;
+ var form = document.createElement('form');
+ form.method = 'post';
+ form.action = getCurrentCalendarUrl() + '&a=deleteEvent';
+
+ var postback = document.createElement('input');
+ postback.type = 'hidden';
+ postback.name = 'postback';
+ postback.value = 'postback';
+ form.appendChild(postback);
+
+ var eventID = document.createElement('input');
+ eventID.type = 'hidden';
+ eventID.name = 'eventID';
+ eventID.value = document.getElementById('eventIDEdit').value;
+ form.appendChild(eventID);
+
+ if (typeof CATSCsrfToken != 'undefined' && CATSCsrfToken !== null &&
+ CATSCsrfToken !== '')
+ {
+ var csrfToken = document.createElement('input');
+ csrfToken.type = 'hidden';
+ csrfToken.name = 'csrfToken';
+ csrfToken.value = CATSCsrfToken;
+ form.appendChild(csrfToken);
+ }
+
+ document.body.appendChild(form);
+ form.submit();
}
/* Hides all the main window views (month, week, day, etc). */
diff --git a/modules/calendar/CalendarUI.php b/modules/calendar/CalendarUI.php
index 234a38d00..24fe19448 100755
--- a/modules/calendar/CalendarUI.php
+++ b/modules/calendar/CalendarUI.php
@@ -77,7 +77,14 @@ public function handleRequest()
break;
case 'deleteEvent':
- $this->onDeleteEvent();
+ if ($this->isPostBack())
+ {
+ $this->onDeleteEvent();
+ }
+ else
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, $this, 'Invalid request.');
+ }
break;
case 'showCalendar':
@@ -692,12 +699,12 @@ private function onDeleteEvent()
}
/* Bail out if we don't have a valid event ID. */
- if (!$this->isRequiredIDValid('eventID', $_GET))
+ if (!$this->isRequiredIDValid('eventID', $_POST))
{
CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid event ID.');
}
- $eventID = $_GET['eventID'];
+ $eventID = $_POST['eventID'];
if (!eval(Hooks::get('CALENDAR_DELETE_PRE'))) return;
diff --git a/modules/candidates/CandidatesUI.php b/modules/candidates/CandidatesUI.php
index 7b7d13aef..971045048 100755
--- a/modules/candidates/CandidatesUI.php
+++ b/modules/candidates/CandidatesUI.php
@@ -125,13 +125,20 @@ public function handleRequest()
break;
- case 'delete':
- if ($this->getUserAccessLevel('candidates.delete') < ACCESS_LEVEL_DELETE)
- {
- CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
- }
- $this->onDelete();
- break;
+ case 'delete':
+ if ($this->getUserAccessLevel('candidates.delete') < ACCESS_LEVEL_DELETE)
+ {
+ CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
+ }
+ if ($this->isPostBack())
+ {
+ $this->onDelete();
+ }
+ else
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, $this, 'Invalid request.');
+ }
+ break;
case 'search':
if ($this->getUserAccessLevel('candidates.search') < ACCESS_LEVEL_READ)
@@ -180,13 +187,20 @@ public function handleRequest()
* Add candidate to pipeline after selecting a job order for which
* to consider a candidate (in the modal window).
*/
- case 'addToPipeline':
- if ($this->getUserAccessLevel('pipelines.addToPipeline') < ACCESS_LEVEL_EDIT)
- {
- CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
- }
- $this->onAddToPipeline();
- break;
+ case 'addToPipeline':
+ if ($this->getUserAccessLevel('pipelines.addToPipeline') < ACCESS_LEVEL_EDIT)
+ {
+ CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
+ }
+ if ($this->isPostBack())
+ {
+ $this->onAddToPipeline();
+ }
+ else
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADFIELDS, $this, 'Invalid request.');
+ }
+ break;
case 'addCandidateTags':
if ($this->getUserAccessLevel('candidates.addCandidateTags') < ACCESS_LEVEL_EDIT )
@@ -221,13 +235,20 @@ public function handleRequest()
break;
/* Remove a candidate from a pipeline. */
- case 'removeFromPipeline':
- if ($this->getUserAccessLevel('pipelines.removeFromPipeline') < ACCESS_LEVEL_DELETE)
- {
- CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
- }
- $this->onRemoveFromPipeline();
- break;
+ case 'removeFromPipeline':
+ if ($this->getUserAccessLevel('pipelines.removeFromPipeline') < ACCESS_LEVEL_DELETE)
+ {
+ CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
+ }
+ if ($this->isPostBack())
+ {
+ $this->onRemoveFromPipeline();
+ }
+ else
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, $this, 'Invalid request.');
+ }
+ break;
case 'addEditImage':
if ($this->getUserAccessLevel('candidates.addEditImage') < ACCESS_LEVEL_EDIT)
@@ -266,22 +287,36 @@ public function handleRequest()
break;
/* Administrators can hide a candidate from a site with this action. */
- case 'administrativeHideShow':
- if ($this->getUserAccessLevel('candidates.hidden') < ACCESS_LEVEL_MULTI_SA)
- {
- CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
- }
- $this->administrativeHideShow();
- break;
+ case 'administrativeHideShow':
+ if ($this->getUserAccessLevel('candidates.hidden') < ACCESS_LEVEL_MULTI_SA)
+ {
+ CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
+ }
+ if ($this->isPostBack())
+ {
+ $this->administrativeHideShow();
+ }
+ else
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, $this, 'Invalid request.');
+ }
+ break;
/* Delete a candidate attachment */
- case 'deleteAttachment':
- if ($this->getUserAccessLevel('candidates.deleteAttachment') < ACCESS_LEVEL_DELETE)
- {
- CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
- }
- $this->onDeleteAttachment();
- break;
+ case 'deleteAttachment':
+ if ($this->getUserAccessLevel('candidates.deleteAttachment') < ACCESS_LEVEL_DELETE)
+ {
+ CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
+ }
+ if ($this->isPostBack())
+ {
+ $this->onDeleteAttachment();
+ }
+ else
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, $this, 'Invalid request.');
+ }
+ break;
/* Hot List Page */
/* FIXME: function savedList() missing
@@ -331,30 +366,51 @@ public function handleRequest()
$this->mergeDuplicates();
break;
- case 'mergeInfo':
- if ($this->getUserAccessLevel('candidates.duplicates') < ACCESS_LEVEL_SA)
- {
- CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
- }
- $this->mergeDuplicatesInfo();
- break;
+ case 'mergeInfo':
+ if ($this->getUserAccessLevel('candidates.duplicates') < ACCESS_LEVEL_SA)
+ {
+ CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
+ }
+ if ($this->isPostBack())
+ {
+ $this->mergeDuplicatesInfo();
+ }
+ else
+ {
+ CommonErrors::fatal(COMMONERROR_BADFIELDS, $this, 'Invalid request.');
+ }
+ break;
/* Remove duplicity warning from a new candidate */
- case 'removeDuplicity':
- if ($this->getUserAccessLevel('candidates.duplicates') < ACCESS_LEVEL_SA)
- {
- CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
- }
- $this->removeDuplicity();
- break;
-
- case 'addDuplicates':
- if ($this->getUserAccessLevel('candidates.duplicates') < ACCESS_LEVEL_SA)
- {
- CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
- }
- $this->addDuplicates();
- break;
+ case 'removeDuplicity':
+ if ($this->getUserAccessLevel('candidates.duplicates') < ACCESS_LEVEL_SA)
+ {
+ CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
+ }
+ if ($this->isPostBack())
+ {
+ $this->removeDuplicity();
+ }
+ else
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADFIELDS, $this, 'Invalid request.');
+ }
+ break;
+
+ case 'addDuplicates':
+ if ($this->getUserAccessLevel('candidates.duplicates') < ACCESS_LEVEL_SA)
+ {
+ CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
+ }
+ if ($this->isPostBack())
+ {
+ $this->addDuplicates();
+ }
+ else
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADFIELDS, $this, 'Invalid request.');
+ }
+ break;
/* Main candidates page. */
case 'listByView':
@@ -388,11 +444,42 @@ public function publicAddCandidate($isModal, $transferURI, $moduleDirectory)
CommonErrors::fatalModal(COMMONERROR_RECORDERROR, $this, 'Failed to add candidate.');
}
- $transferURI = str_replace(
- '__CANDIDATE_ID__', $candidateID, $transferURI
- );
- CATSUtility::transferRelativeURI($transferURI);
- }
+ $transferURI = str_replace(
+ '__CANDIDATE_ID__', $candidateID, $transferURI
+ );
+
+ if (strpos($transferURI, 'a=addToPipeline') !== false)
+ {
+ parse_str($transferURI, $params);
+ $action = CATSUtility::getIndexName();
+ if (isset($params['m']) && isset($params['a']))
+ {
+ $action .= '?m=' . urlencode($params['m']) . '&a=' . urlencode($params['a']);
+ unset($params['m']);
+ unset($params['a']);
+ }
+
+ echo '';
+ echo '';
+ echo '';
+ echo '';
+ return;
+ }
+
+ CATSUtility::transferRelativeURI($transferURI);
+ }
/*
@@ -1404,15 +1491,15 @@ private function onEdit()
/*
* Called by handleRequest() to process deleting a candidate.
*/
- private function onDelete()
- {
- /* Bail out if we don't have a valid candidate ID. */
- if (!$this->isRequiredIDValid('candidateID', $_GET))
- {
- CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
- }
-
- $candidateID = $_GET['candidateID'];
+ private function onDelete()
+ {
+ /* Bail out if we don't have a valid candidate ID. */
+ if (!$this->isRequiredIDValid('candidateID', $_POST))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+
+ $candidateID = $_POST['candidateID'];
if (!eval(Hooks::get('CANDIDATE_DELETE'))) return;
@@ -1558,33 +1645,33 @@ private function considerForJobSearch($candidateIDArray = array())
* Called by handleRequest() to process adding a candidate to a pipeline
* in the modal dialog.
*/
- private function onAddToPipeline()
- {
- /* Bail out if we don't have a valid job order ID. */
- if (!$this->isRequiredIDValid('jobOrderID', $_GET))
- {
- CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid job order ID.');
- }
-
- if (isset($_GET['candidateID']))
- {
- /* Bail out if we don't have a valid candidate ID. */
- if (!$this->isRequiredIDValid('candidateID', $_GET))
- {
- CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
- }
-
- $candidateIDArray = array($_GET['candidateID']);
- }
- else
- {
- if (!isset($_REQUEST['candidateIDArrayStored']) || !$this->isRequiredIDValid('candidateIDArrayStored', $_REQUEST, true))
- {
- CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid candidateIDArrayStored parameter.');
- return;
- }
-
- $candidateIDArray = $_SESSION['CATS']->retrieveData($_REQUEST['candidateIDArrayStored']);
+ private function onAddToPipeline()
+ {
+ /* Bail out if we don't have a valid job order ID. */
+ if (!$this->isRequiredIDValid('jobOrderID', $_POST))
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid job order ID.');
+ }
+
+ if (isset($_POST['candidateID']))
+ {
+ /* Bail out if we don't have a valid candidate ID. */
+ if (!$this->isRequiredIDValid('candidateID', $_POST))
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+
+ $candidateIDArray = array($_POST['candidateID']);
+ }
+ else
+ {
+ if (!isset($_POST['candidateIDArrayStored']) || !$this->isRequiredIDValid('candidateIDArrayStored', $_POST, true))
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid candidateIDArrayStored parameter.');
+ return;
+ }
+
+ $candidateIDArray = $_SESSION['CATS']->retrieveData($_POST['candidateIDArrayStored']);
if (!is_array($candidateIDArray))
{
@@ -1606,7 +1693,7 @@ private function onAddToPipeline()
}
- $jobOrderID = $_GET['jobOrderID'];
+ $jobOrderID = $_POST['jobOrderID'];
if (!eval(Hooks::get('CANDIDATE_ADD_TO_PIPELINE_PRE'))) return;
@@ -1855,22 +1942,22 @@ private function onAddActivityChangeStatus()
* Called by handleRequest() to process removing a candidate from the
* pipeline for a job order.
*/
- private function onRemoveFromPipeline()
- {
- /* Bail out if we don't have a valid candidate ID. */
- if (!$this->isRequiredIDValid('candidateID', $_GET))
- {
- CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
- }
-
- /* Bail out if we don't have a valid job order ID. */
- if (!$this->isRequiredIDValid('jobOrderID', $_GET))
- {
- CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid job order ID.');
- }
-
- $candidateID = $_GET['candidateID'];
- $jobOrderID = $_GET['jobOrderID'];
+ private function onRemoveFromPipeline()
+ {
+ /* Bail out if we don't have a valid candidate ID. */
+ if (!$this->isRequiredIDValid('candidateID', $_POST))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+
+ /* Bail out if we don't have a valid job order ID. */
+ if (!$this->isRequiredIDValid('jobOrderID', $_POST))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid job order ID.');
+ }
+
+ $candidateID = $_POST['candidateID'];
+ $jobOrderID = $_POST['jobOrderID'];
if (!eval(Hooks::get('CANDIDATE_REMOVE_FROM_PIPELINE_PRE'))) return;
@@ -2360,22 +2447,22 @@ private function onCreateAttachment()
/*
* Called by handleRequest() to process deleting an attachment.
*/
- private function onDeleteAttachment()
- {
- /* Bail out if we don't have a valid attachment ID. */
- if (!$this->isRequiredIDValid('attachmentID', $_GET))
- {
- CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid attachment ID.');
- }
-
- /* Bail out if we don't have a valid candidate ID. */
- if (!$this->isRequiredIDValid('candidateID', $_GET))
- {
- CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
- }
-
- $candidateID = $_GET['candidateID'];
- $attachmentID = $_GET['attachmentID'];
+ private function onDeleteAttachment()
+ {
+ /* Bail out if we don't have a valid attachment ID. */
+ if (!$this->isRequiredIDValid('attachmentID', $_POST))
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid attachment ID.');
+ }
+
+ /* Bail out if we don't have a valid candidate ID. */
+ if (!$this->isRequiredIDValid('candidateID', $_POST))
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+
+ $candidateID = $_POST['candidateID'];
+ $attachmentID = $_POST['attachmentID'];
if (!eval(Hooks::get('CANDIDATE_ON_DELETE_ATTACHMENT_PRE'))) return;
@@ -2391,24 +2478,24 @@ private function onDeleteAttachment()
//TODO: Document me.
//Only accessable by MSA users - hides this job order from everybody by
- private function administrativeHideShow()
- {
- /* Bail out if we don't have a valid joborder ID. */
- if (!$this->isRequiredIDValid('candidateID', $_GET))
- {
- CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid Job Order ID.');
- }
-
- /* Bail out if we don't have a valid status ID. */
- if (!$this->isRequiredIDValid('state', $_GET, true))
- {
- CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid state ID.');
- }
-
- $candidateID = $_GET['candidateID'];
-
- // FIXME: Checkbox?
- $state = (boolean) $_GET['state'];
+ private function administrativeHideShow()
+ {
+ /* Bail out if we don't have a valid joborder ID. */
+ if (!$this->isRequiredIDValid('candidateID', $_POST))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid Job Order ID.');
+ }
+
+ /* Bail out if we don't have a valid status ID. */
+ if (!$this->isRequiredIDValid('state', $_POST, true))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid state ID.');
+ }
+
+ $candidateID = $_POST['candidateID'];
+
+ // FIXME: Checkbox?
+ $state = (boolean) $_POST['state'];
$candidates = new Candidates($this->_siteID);
$candidates->administrativeHideShow($candidateID, $state);
@@ -3477,11 +3564,20 @@ private function findDuplicateCandidateSearch()
$this->_template->display('./modules/candidates/LinkDuplicity.tpl');
}
- private function mergeDuplicates()
- {
- $candidates = new Candidates($this->_siteID);
- $oldCandidateID = $_GET['oldCandidateID'];
- $newCandidateID = $_GET['newCandidateID'];
+ private function mergeDuplicates()
+ {
+ if (!$this->isRequiredIDValid('oldCandidateID', $_GET))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+ if (!$this->isRequiredIDValid('newCandidateID', $_GET))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+
+ $candidates = new Candidates($this->_siteID);
+ $oldCandidateID = $_GET['oldCandidateID'];
+ $newCandidateID = $_GET['newCandidateID'];
$rsOld = $candidates->getWithDuplicity($oldCandidateID);
$rsNew = $candidates->getWithDuplicity($newCandidateID);
@@ -3494,12 +3590,21 @@ private function mergeDuplicates()
$this->_template->display('./modules/candidates/Merge.tpl');
}
- private function mergeDuplicatesInfo()
- {
- $candidates = new Candidates($this->_siteID);
- $params = array();
- $params['firstName'] = $_POST['firstName'];
- $params['middleName'] = $_POST['middleName'];
+ private function mergeDuplicatesInfo()
+ {
+ $candidates = new Candidates($this->_siteID);
+ if (!$this->isRequiredIDValid('oldCandidateID', $_POST))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+ if (!$this->isRequiredIDValid('newCandidateID', $_POST))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+
+ $params = array();
+ $params['firstName'] = $_POST['firstName'];
+ $params['middleName'] = $_POST['middleName'];
$params['lastName'] = $_POST['lastName'];
if(isset($_POST['email']))
{
@@ -3512,37 +3617,54 @@ private function mergeDuplicatesInfo()
$params['phoneCell'] = $_POST['phoneCell'];
$params['phoneWork'] = $_POST['phoneWork'];
$params['phoneHome'] = $_POST['phoneHome'];
- $params['address'] = $_POST['address'];
- $params['website'] = $_POST['website'];
- $params['oldCandidateID'] = $_POST['oldCandidateID'];
- $params['newCandidateID'] = $_POST['newCandidateID'];
-
- $candidates->mergeDuplicates($params, $candidates->getWithDuplicity($params['newCandidateID']));
- $this->_template->assign('isFinishedMode', true);
- $this->_template->display('./modules/candidates/Merge.tpl');
- }
+ $params['address'] = $_POST['address'];
+ $params['website'] = $_POST['website'];
+ $params['oldCandidateID'] = $_POST['oldCandidateID'];
+ $params['newCandidateID'] = $_POST['newCandidateID'];
+
+ $candidates->mergeDuplicates($params, $candidates->getWithDuplicity($params['newCandidateID']));
+ CATSUtility::transferRelativeURI(
+ 'm=candidates&a=show&candidateID=' . $params['oldCandidateID']
+ );
+ }
- private function removeDuplicity()
- {
- $candidates = new Candidates($this->_siteID);
- $oldCandidateID = $_GET['oldCandidateID'];
- $newCandidateID = $_GET['newCandidateID'];
- $candidates->removeDuplicity($oldCandidateID, $newCandidateID);
- $url = CATSUtility::getIndexName()."?m=candidates";
- header("Location: " . $url); /* Redirect browser */
- exit();
- }
+ private function removeDuplicity()
+ {
+ $candidates = new Candidates($this->_siteID);
+ if (!$this->isRequiredIDValid('oldCandidateID', $_POST))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+ if (!$this->isRequiredIDValid('newCandidateID', $_POST))
+ {
+ CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+ $oldCandidateID = $_POST['oldCandidateID'];
+ $newCandidateID = $_POST['newCandidateID'];
+ $candidates->removeDuplicity($oldCandidateID, $newCandidateID);
+ $url = CATSUtility::getIndexName()."?m=candidates";
+ header("Location: " . $url); /* Redirect browser */
+ exit();
+ }
- private function addDuplicates()
- {
- $candidates = new Candidates($this->_siteID);
- $oldCandidateID = $_GET['candidateID'];
- $newCandidateID = $_GET['duplicateCandidateID'];
- $candidates->addDuplicates($newCandidateID, $oldCandidateID);
- $this->_template->assign('isFinishedMode', true);
- $this->_template->display('./modules/candidates/LinkDuplicity.tpl');
- }
+ private function addDuplicates()
+ {
+ $candidates = new Candidates($this->_siteID);
+ if (!$this->isRequiredIDValid('candidateID', $_POST))
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+ if (!$this->isRequiredIDValid('duplicateCandidateID', $_POST))
+ {
+ CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid candidate ID.');
+ }
+ $oldCandidateID = $_POST['candidateID'];
+ $newCandidateID = $_POST['duplicateCandidateID'];
+ $candidates->addDuplicates($newCandidateID, $oldCandidateID);
+ $this->_template->assign('isFinishedMode', true);
+ $this->_template->display('./modules/candidates/LinkDuplicity.tpl');
+ }
}
?>
diff --git a/modules/candidates/ConsiderSearchModal.tpl b/modules/candidates/ConsiderSearchModal.tpl
index cc0150418..82317b95b 100755
--- a/modules/candidates/ConsiderSearchModal.tpl
+++ b/modules/candidates/ConsiderSearchModal.tpl
@@ -72,9 +72,14 @@
This maintenance action must be triggered via POST.
', + 'This starts the attachment reindex process.
', + '', + ''; + die(); +} + include_once('./config.php'); include_once(LEGACY_ROOT . '/lib/DatabaseConnection.php'); include_once(LEGACY_ROOT . '/lib/ModuleUtility.php'); diff --git a/modules/install/ajax/attachmentsToThreeDirectory.php b/modules/install/ajax/attachmentsToThreeDirectory.php index b56902158..11329abb6 100755 --- a/modules/install/ajax/attachmentsToThreeDirectory.php +++ b/modules/install/ajax/attachmentsToThreeDirectory.php @@ -27,6 +27,24 @@ * $Id: attachmentsToThreeDirectory.php 2336 2007-04-14 22:01:51Z will $ */ +if ($_SERVER['REQUEST_METHOD'] !== 'POST') +{ + header('Content-Type: text/html; charset=UTF-8'); + + $actionURL = htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); + + echo '', + 'This maintenance action must be triggered via POST.
', + 'This starts the attachment migration to the three-directory layout.
', + '', + ''; + die(); +} + include_once('./config.php'); include_once(LEGACY_ROOT . '/lib/DatabaseConnection.php'); diff --git a/modules/install/ajax/maint.php b/modules/install/ajax/maint.php index 020d99e6b..3a3fba924 100755 --- a/modules/install/ajax/maint.php +++ b/modules/install/ajax/maint.php @@ -27,6 +27,24 @@ * $Id: maint.php 3346 2007-10-29 22:40:53Z brian $ */ +if ($_SERVER['REQUEST_METHOD'] !== 'POST') +{ + header('Content-Type: text/html; charset=UTF-8'); + + $actionURL = htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); + + echo '', + 'This maintenance action must be triggered via POST.
', + 'This page starts maintenance mode and related installer tasks.
', + '', + ''; + die(); +} + if (file_exists('./modules.cache')) { @unlink('./modules.cache'); diff --git a/modules/install/ajax/ui.php b/modules/install/ajax/ui.php index 53db04e79..957fbdae6 100755 --- a/modules/install/ajax/ui.php +++ b/modules/install/ajax/ui.php @@ -42,6 +42,13 @@ } @ini_set('memory_limit', '192M'); +if ($_SERVER['REQUEST_METHOD'] !== 'POST') +{ + die('Invalid request.'); +} + +$_REQUEST = $_POST; + if (file_exists('modules.cache')) @unlink('modules.cache'); if (!isset($_REQUEST['a']) || empty($_REQUEST['a'])) diff --git a/modules/joborders/ConsiderSearchModal.tpl b/modules/joborders/ConsiderSearchModal.tpl index 160bb7329..c5cad4193 100755 --- a/modules/joborders/ConsiderSearchModal.tpl +++ b/modules/joborders/ConsiderSearchModal.tpl @@ -70,15 +70,25 @@