EuskadiTech/Axia4
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix security issues in ¿Quién soy? flow

Browse Source 
Co-authored-by: naielv <109038805+naielv@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-14 13:19:56 +00:00
parent 302992c10b
commit a3eeda2dc5
2 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
public_html/entreaulas/_filefetch.php
View File

@@ -7,9 +7,14 @@ header("Access-Control-Allow-Origin: *");
switch ($_GET["type"]) {
case "alumno_photo":
$centro = str_replace('..', '_', $_GET["centro"] ?? '');
$aulario = str_replace('..', '_', $_GET["aulario"] ?? '');
$alumno = str_replace('..', '_', $_GET["alumno"] ?? '');
$centro = basename($_GET["centro"] ?? '');
$aulario = basename($_GET["aulario"] ?? '');
$alumno = basename($_GET["alumno"] ?? '');
// Additional validation to prevent empty names
if (empty($centro) || empty($aulario) || empty($alumno)) {
header("HTTP/1.1 400 Bad Request");
die("Invalid parameters");
}
$relpath = "entreaulas/Centros/$centro/Aularios/$aulario/Alumnos/$alumno/photo.jpg";
break;
case "panel_actividades":

14
public_html/entreaulas/paneldiario.php
View File

@@ -152,8 +152,14 @@ switch ($_GET["action"]) {
break;
case "quien_soy":
// ¿Quién soy? - Identificación del alumno
$aulario_id = $_GET["aulario"] ?? "";
$centro_id = $_SESSION["auth_data"]["entreaulas"]["centro"] ?? "";
$aulario_id = basename($_GET["aulario"] ?? '');
$centro_id = basename($_SESSION["auth_data"]["entreaulas"]["centro"] ?? '');
// Validate parameters
if (empty($aulario_id) || empty($centro_id)) {
echo '<div class="card pad"><p>Error: Parámetros inválidos.</p></div>';
break;
}
$alumnos_path = "/DATA/entreaulas/Centros/$centro_id/Aularios/$aulario_id/Alumnos";
$alumnos = [];
@@ -166,7 +172,7 @@ switch ($_GET["action"]) {
function seleccionarAlumno(element, nombre) {
element.style.backgroundColor = "#9cff9f"; // Verde
announceAndMaybeRedirect(
nombre + ", ¡Hola " + nombre + "!",
"¡Hola " + nombre + "!",
"/entreaulas/paneldiario.php?aulario=<?php echo urlencode($_GET['aulario'] ?? ''); ?>",
true
);
@@ -193,7 +199,7 @@ switch ($_GET["action"]) {
$photo_path = $alumno_path . "/photo.jpg";
$photo_exists = file_exists($photo_path);
?>
<a class="card grid-item" style="color: black;" onclick="seleccionarAlumno(this, '<?php echo htmlspecialchars($alumno_name); ?>');">
<a class="card grid-item" style="color: black;" onclick="seleccionarAlumno(this, <?php echo json_encode($alumno_name, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT); ?>);">
<?php if ($photo_exists): ?>
<img src="_filefetch.php?type=alumno_photo&alumno=<?php echo urlencode($alumno_name); ?>&centro=<?php echo urlencode($centro_id); ?>&aulario=<?php echo urlencode($aulario_id); ?>" height="150" class="bg-white">
<?php else: ?>