view=export: Remove inline event handlers and fix arbitrary URL/XSS usage. Fixes #2443

web/ajax/event.php

@@ -71,7 +71,7 @@ if ( canView( 'Events' ) ) {
 
         $exportIds = !empty($_REQUEST['eids'])?$_REQUEST['eids']:$_REQUEST['id'];
         if ( $exportFile = exportEvents( $exportIds, $exportDetail, $exportFrames, $exportImages, $exportVideo, $exportMisc, $exportFormat ) )
-          ajaxResponse( array( 'exportFile'=>$exportFile ) );
+          ajaxResponse( array( 'exportFormat'=>$exportFormat ) );
         else
           ajaxError( 'Export Failed' );
         break;

web/includes/functions.php

@@ -55,6 +55,7 @@ function CSPHeaders($view, $nonce) {
     case 'donate':
     case 'download':
     case 'error':
+    case 'export':
     case 'function':
     case 'log':
     case 'logout':

web/skins/classic/views/export.php

@@ -38,6 +38,13 @@ if ( isset($_SESSION['export']) ) {
     $_REQUEST['exportFormat'] = $_SESSION['export']['format'];
 }
 
+if (isset($_REQUEST['exportFormat'])) {
+  if (!in_array($_REQUEST['exportFormat'], array('zip', 'tar'))) {
+    Error('Invalid exportFormat');
+    return;
+  }
+}
+
 $focusWindow = true;
 
 xhtmlHeaders(__FILE__, translate('Export') );
@@ -97,7 +104,7 @@ if ( !empty($_REQUEST['eid']) ) {
             </tr>
           </tbody>
         </table>
-        <button type="button" id="exportButton" name="exportButton" value="Export" onclick="exportEvent(this.form);" disabled="disabled"><?php echo translate('Export') ?></button>
+        <button type="button" id="exportButton" name="exportButton" value="Export" disabled="disabled"><?php echo translate('Export') ?></button>
       </form>
     </div>
 <?php
@@ -112,7 +119,7 @@ if ( !empty($_REQUEST['eid']) ) {
     }
     if ( !empty($_REQUEST['generated']) ) {
 ?>
-      <h3 id="downloadLink"><a href="<?php echo validHtmlStr($_REQUEST['exportFile']) ?>"><?php echo translate('Download') ?></a></h3>
+      <h3 id="downloadLink"><a href="?view=archive&amp;type=<?php echo $_REQUEST['exportFormat']; ?>"><?php echo translate('Download') ?></a></h3>
 <?php
     }
 ?>

web/skins/classic/views/js/export.js

@@ -29,7 +29,7 @@ function exportProgress() {
 }
 
 function exportResponse( respObj, respText ) {
-  window.location.replace( thisUrl+'?view='+currentView+'&'+eidParm+'&exportFile='+respObj.exportFile+'&generated='+((respObj.result=='Ok')?1:0) );
+  window.location.replace( thisUrl+'?view='+currentView+'&'+eidParm+'&exportFormat='+respObj.exportFormat+'&generated='+((respObj.result=='Ok')?1:0) );
 }
 
 function exportEvent( form ) {
@@ -49,6 +49,9 @@ function initPage() {
   if ( exportReady ) {
     startDownload.pass( exportFile ).delay( 1500 );
   }
+  document.getElementById('exportButton').addEventListener('click', function onClick() {
+    exportEvent(this.form);
+  });
 }
 
 window.addEventListener( 'DOMContentLoaded', initPage );

web/skins/classic/views/js/export.js.php

@@ -14,6 +14,6 @@ var eidParm = 'eid=<?php echo validInt($_REQUEST['eid']) ?>';
 ?>
 
 var exportReady = <?php echo !empty($_REQUEST['generated'])?'true':'false' ?>;
-var exportFile = '<?php echo !empty($_REQUEST['exportFile'])?validJsStr($_REQUEST['exportFile']):'' ?>';
+var exportFile = '?view=archive&type=<?php echo $_REQUEST['exportFormat']; ?>';
 
 var exportProgressString = '<?php echo addslashes(translate('Exporting')) ?>';