Archiveの特殊文字によるエラー解消

diff --git a/app/controllers/character_profile_archives_controller.php b/app/controllers/character_profile_archives_controller.php
index de15c36..c2f5562 100644 (file)
--- a/app/controllers/character_profile_archives_controller.php
+++ b/app/controllers/character_profile_archives_controller.php
@@ -394,15 +394,17 @@ class CharacterProfileArchivesController extends AppController {
                }
 
                // unserialise
+               // byte処理
+               $characterProfileArchive['CharacterProfileArchive']['value'] = preg_replace('!s:(\d+):"(.*?)";!e', "'s:'.strlen('$2').':\"$2\";'", $characterProfileArchive['CharacterProfileArchive']['value']);
+               // unserialise&stripslashes
                $characterProfileArchive['CharacterProfileArchive']['value'] = unserialize($this->CharacterProfileArchive->restore_escape($characterProfileArchive['CharacterProfileArchive']['value']));
 
+
                if (empty($characterProfileArchive['CharacterProfileArchive']['value'])) {
                        $this->Session->setFlash(__('This archive could not be viewable.', true));
                        $characterProfileArchive['CharacterProfileArchive']['value'] = array();
                }
 
-               $this->set('characterProfileArchive', $characterProfileArchive);
-
                // Systemチェック
                $this->set('systemValid', 'public');
                if (!isset($characterProfileArchive['CharacterProfileArchive']['value']['System']) || !$characterProfileArchive['CharacterProfileArchive']['value']['System']) {
@@ -419,10 +421,26 @@ class CharacterProfileArchivesController extends AppController {
                        );
                }
 
+
+               foreach ($characterProfileArchive['CharacterProfileArchive']['value']['System']['Profile'] as $k => $v) {
+                       if (!empty($v['CharactersHasProfile'])) {
+                               // サニタイズ
+                               foreach ($v['CharactersHasProfile'] as $k2 => $v2) {
+                                       $characterProfileArchive['CharacterProfileArchive']['value']['System']['Profile'][$k]['CharactersHasProfile'][$k2]['value'] = $this->{$this->modelClass}->restore_html($v2['value'], false, false, false);
+                                        if ($v['profile_type'] == 'textarea') {
+                                               $characterProfileArchive['CharacterProfileArchive']['value']['System']['Profile'][$k]['CharactersHasProfile'][$k2]['value'] = str_replace('<br />', "\n", $characterProfileArchive['CharacterProfileArchive']['value']['System']['Profile'][$k]['CharactersHasProfile'][$k2]['value']);
+                                       }
+                               }
+                       }
+               }
+               $this->set('characterProfileArchive', $characterProfileArchive);
+
                $this->set('title_for_layout', " - ". 
                                $characterProfileArchive['Character']['name'].
                                " - ". 
-                               date('Y/m/d', strtotime($characterProfileArchive['CharacterProfileArchive']['disp_date']))
+                               date('Y/m/d', strtotime($characterProfileArchive['CharacterProfileArchive']['disp_date'])).
+                               ' '.
+                               $characterProfileArchive['CharacterProfileArchive']['title']
                        );
        }
 

diff --git a/app/controllers/characters_controller.php b/app/controllers/characters_controller.php
index dbcd84f..9267fa0 100644 (file)
--- a/app/controllers/characters_controller.php
+++ b/app/controllers/characters_controller.php
@@ -1071,6 +1071,7 @@ class CharactersController extends AppController {
                        $this->isNpc = true;
                }*/
                $character = $this->_restore_html_system($character);
+               $character['System']['Profile'] = $this->_restore_html_characters_has_profiles($character['System']['Profile'], false);
 
                $this->set('title_for_layout', " - ". $character['Character']['name']);
 
@@ -1284,15 +1285,13 @@ class CharactersController extends AppController {
                        }
 
                        // サニタイズ
-                       $characters_has_profiles[$k]['value'] = Sanitize::html($characters_has_profiles[$k]['value']);
                        $characters_has_profiles[$k]['value'] = preg_replace('/[\\\n]/', '', $characters_has_profiles[$k]['value']);
                        $characters_has_profiles[$k]['value'] = preg_replace('/[\\\r]/', '', $characters_has_profiles[$k]['value']);
                        // textarea改行処理
                        if (isset($v['is_textarea']) && $v['is_textarea'] == 1) {
-                               $characters_has_profiles[$k]['value'] = str_replace(array("\n\r", '\n', "\r"), '<br />', $characters_has_profiles[$k]['value']);
+//                             $characters_has_profiles[$k]['value'] = str_replace(array("\n\r", '\n', "\r"), '<br />', $characters_has_profiles[$k]['value']);
                                $characters_has_profiles[$k]['value'] = str_replace("\\", '', $characters_has_profiles[$k]['value']);
                        }
-                       $characters_has_profiles[$k]['value'] = Sanitize::stripAll($characters_has_profiles[$k]['value']);
 
                        // 空の値処理, public_flag
                        // table: 一時保管して全項目空の場合行削除
@@ -1443,7 +1442,6 @@ class CharactersController extends AppController {
                                }
                        }
                }
-
                return $data;
        }
 

diff --git a/app/models/app_model.php b/app/models/app_model.php
index ae83959..1ea1e19 100644 (file)
--- a/app/models/app_model.php
+++ b/app/models/app_model.php
@@ -119,21 +119,45 @@ class AppModel extends Model {
        {
                // $fieldsの設定でSanitize
                if (isset($this->data[$this->name])) {
-                       foreach($this->data[$this->name] as $field => $value) {
-                               $this->data[$this->name][$field]  = $this->escapeByFields($field, $value);
-                       }
-                       // Sanitize(不正コード、SQL Injection)
-                       $this->data = Sanitize::clean(
-                               $this->data,
-                               array(
-                                       'encode' => false,
-                               )
-                       );
+                       $this->data[$this->name] = $this->_sanitizeByFields($this->data[$this->name]);
+               }
+
+               // Sanitize(不正コード、SQL Injection)
+               if (isset($this->data)) {
+                       $this->data = $this->_sanitizeBasic($this->data);
                }
 
                return parent::beforeSave($options);
        }
 
+       function _sanitizeByFields($data)
+       {
+               if (empty($data) || !is_array($data)) {
+                       return $data;
+               }
+
+               foreach($data as $field => $value) {
+                       $data[$field]  = $this->escapeByFields($field, $value);
+               }
+
+               return $data;
+       }
+       function _sanitizeBasic($data)
+       {
+               if (empty($data) || !is_array($data)) {
+                       return $data;
+               }
+
+               $data = Sanitize::clean(
+                       $data,
+                       array(
+                               'encode' => false,
+                       )
+               );
+
+               return $data;
+       }
+
        /* Validation */
        /* alphaNumeric() */
        /** It Overwrites the original alphaNumeric() **/

diff --git a/app/models/character.php b/app/models/character.php
index 5d800b6..6f72f35 100644 (file)
--- a/app/models/character.php
+++ b/app/models/character.php
@@ -502,7 +502,8 @@ class Character extends AppModel {
 
 function beforeSerialize(&$item)
 {
-       $item = str_replace('\"', '', $item);
+       $item = preg_replace('/\\\n/', "<br />", $item);
+       $item = addslashes($item);
 
        return $item;
 }

diff --git a/app/models/characters_has_profile.php b/app/models/characters_has_profile.php
index c3fae93..f57b99b 100644 (file)
--- a/app/models/characters_has_profile.php
+++ b/app/models/characters_has_profile.php
@@ -18,6 +18,17 @@ class CharactersHasProfile extends AppModel {
        var $fields = array(
                'add' => array('character_id', 'profile_id', 'profile_select_id', 'profile_table_id', 'profile_table_static_id', 'value', 'public_flag', 'link_value'),
                'escape' => array(
+                       'value' => array(
+                               'html' => true,
+                               'tags' => true,
+                               'images' => true,
+                               'sctipts' => true,
+                       ),
+                       'link_value' => array(
+                               'html' => true,
+                               'tags' => true,
+                               'all' => true,
+                       ),
                ),
        );
 
@@ -71,6 +82,21 @@ class CharactersHasProfile extends AppModel {
                )
        );
 
+       function beforeSave($options = array())
+       {
+               // $fieldsの設定でSanitize
+               if (isset($this->data[$this->name])) {
+                       $this->data[$this->name] = $this->_sanitizeByFields($this->data[$this->name]);
+               }
+
+               // Sanitize(不正コード、SQL Injection)
+               if (isset($this->data)) {
+                       $this->data = $this->_sanitizeBasic($this->data);
+               }
+
+               return $this->data;
+       }
+
        /* Validation */
        function validProfileId($data, $system_id)
        {

diff --git a/app/views/elements/sidenav_admin_system.ctp b/app/views/elements/sidenav_admin_system.ctp
index 4839f05..a944b2f 100644 (file)
--- a/app/views/elements/sidenav_admin_system.ctp
+++ b/app/views/elements/sidenav_admin_system.ctp
@@ -11,6 +11,9 @@ if (isset($system['System']['name'])) {
 } elseif(isset($characterSheets['System']['name'])) {
        $system_name = $characterSheets['System']['name'];
        $system_id = $characterSheets['System']['id'];
+} elseif(isset($profile['System']['name'])) {
+       $system_name = $profile['System']['name'];
+       $system_id = $profile['System']['id'];
 } else {
        $system_name = null;
        $system_id = null;

diff --git a/app/views/elements/sidenav_system.ctp b/app/views/elements/sidenav_system.ctp
index 9d21033..fab6b85 100644 (file)
--- a/app/views/elements/sidenav_system.ctp
+++ b/app/views/elements/sidenav_system.ctp
@@ -11,6 +11,9 @@ if (isset($system['System']['name'])) {
 } elseif(isset($characterSheets['System']['name'])) {
        $system_name = $characterSheets['System']['name'];
        $system_id = $characterSheets['System']['id'];
+} elseif(isset($profile['System']['name'])) {
+       $system_name = $profile['System']['name'];
+       $system_id = $profile['System']['id'];
 } else {
        $system_name = null;
        $system_id = null;