CVE-2015-2972: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-07-19T15:59Z
Repository: https://github.com/sysphonic/thetis
Language: Ruby
Files changed: app/controllers/items_controller.rb, app/controllers/locations_controller.rb, app/controllers/templates_controller.rb, app/controllers/zeptair_post_controller.rb, app/helpers/items_helper.rb, app/helpers/sql_helper.rb, app/helpers/templates_helper.rb, app/helpers/tree_element.rb, app/helpers/zeptair_dist_helper.rb, app/models/email.rb, app/models/folder.rb, app/models/group.rb, app/models/location.rb, app/models/mail_account.rb, app/models/mail_filter.rb, app/models/mail_folder.rb, app/models/office_map.rb, app/models/official_title.rb, app/models/paid_holiday.rb, app/models/research.rb, app/models/setting.rb, app/models/team.rb, app/models/timecard.rb, app/models/toy.rb, app/models/user.rb, app/views/folders/show_tree.html.erb, app/views/frames/_footer.html.erb, app/views/groups/show_tree.html.erb, app/views/mail_filters/list.html.erb, app/views/mail_folders/show_tree.html.erb, config/locales/de.yml, config/locales/en.yml, config/locales/ja.yml
Commit date: 2015-07-12 22:32:50 +0900
Commit message: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>

Diff: diff --git a/app/controllers/items_controller.rb b/app/controllers/items_controller.rb
index 7991f799..3168347a 100644
--- a/app/controllers/items_controller.rb
+++ b/app/controllers/items_controller.rb
@@ -352,16 +352,12 @@ class ItemsController < ApplicationController
     end
 
     if params[:from_action].nil?
       render(:text => params[:id])
     else
-      params.delete(:controller)
-      params.delete(:action)
-      params.delete(:id)
       flash[:notice] = t('msg.delete_success')
-      params[:action] = params[:from_action]
-      redirect_to(params)
+      self.send(params[:from_action])
     end
   end
 
   #=== destroy_multi
   #
diff --git a/app/controllers/locations_controller.rb b/app/controllers/locations_controller.rb
index 7342b80d..74ecc3e8 100644
--- a/app/controllers/locations_controller.rb
+++ b/app/controllers/locations_controller.rb
@@ -43,11 +43,11 @@ class LocationsController < ApplicationController
     unless params[:keyword].blank?
       con_prim = []
       con_second = []
       key_array = params[:keyword].split(nil)
       key_array.each do |key|
-        key_quot = ActiveRecord::Base.connection.quote(key)
+        key_quot = SqlHelper.quote(key)
         con_prim << "(name=#{key_quot} or fullname=#{key_quot} or email=#{key_quot})"
         con_second << SqlHelper.get_sql_like([:name, :fullname, :email], key)
       end
       [con_prim, con_second].each do |con|
         next if con.empty?
diff --git a/app/controllers/templates_controller.rb b/app/controllers/templates_controller.rb
index eb226c46..9235c32a 100644
--- a/app/controllers/templates_controller.rb
+++ b/app/controllers/templates_controller.rb
@@ -168,12 +168,10 @@ class TemplatesController < ApplicationController
   #Copies Template.
   #
   def copy
     Log.add_info(request, params.inspect)
 
-    return unless request.post?
-
     tmpl_id = params[:thetisBoxSelKeeper].split(':').last
     tmpl_item = Item.find(tmpl_id)
 
     item = tmpl_item.copy(@login_user.id, @login_user.get_my_folder.id)
     if item.public != false
diff --git a/app/controllers/zeptair_post_controller.rb b/app/controllers/zeptair_post_controller.rb
index e1611432..5bf0c165 100644
--- a/app/controllers/zeptair_post_controller.rb
+++ b/app/controllers/zeptair_post_controller.rb
@@ -91,11 +91,11 @@ class ZeptairPostController < ApplicationController
     unless user_id.blank?
       target_user = User.find(user_id)
     end
 
     unless zeptair_id.blank?
-      target_user = User.where("zeptair_id=#{zeptair_id}").first
+      target_user = User.where("zeptair_id=#{zeptair_id.to_i}").first
     end
 
     if target_user.nil?
 
       if group_id.blank?
@@ -151,11 +151,11 @@ class ZeptairPostController < ApplicationController
       end
     end
 
     unless zeptair_id.blank?
 
-      target_user = User.where("zeptair_id=#{zeptair_id}").first
+      target_user = User.where("zeptair_id=#{zeptair_id.to_i}").first
 
       unless @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id == target_user.id
         target_user = nil
       end
     end
diff --git a/app/helpers/items_helper.rb b/app/helpers/items_helper.rb
index 64d3318d..691d233f 100644
--- a/app/helpers/items_helper.rb
+++ b/app/helpers/items_helper.rb
@@ -25,11 +25,11 @@ module ItemsHelper
   #
   def self.get_next_revision(user_id, source_id)
 
     SqlHelper.validate_token([user_id, source_id])
 
-    copied_items = Item.where("user_id=#{user_id} and source_id=#{source_id}").order('created_at DESC').to_a
+    copied_items = Item.where("user_id=#{user_id.to_i} and source_id=#{source_id.to_i}").order('created_at DESC').to_a
 
     rev = 0
     copied_items.each do |item|
       rev_ary = item.title.scan(/[#](\d\d\d)$/)
       next if rev_ary.nil?
@@ -52,11 +52,12 @@ module ItemsHelper
   def self.get_copies_folder(user_id)
 
     my_folder = User.get_my_folder(user_id)
 
     unless my_folder.nil?
-      con = "(parent_id=#{my_folder.id}) and (name='#{Item.copies_folder}')"
+      folder_name_quot = SqlHelper.quote(Item.copies_folder)
+      con = "(parent_id=#{my_folder.id}) and (name=#{folder_name_quot})"
 
       begin
         copies_folder = Folder.where(con).first
       rescue
       end
@@ -87,11 +88,12 @@ module ItemsHelper
   def self.exists_copies_folder?(user_id)
 
     my_folder = User.get_my_folder(user_id)
 
     unless my_folder.nil?
-      con = "(parent_id=#{my_folder.id}) and (name='#{Item.copies_folder}')"
+      folder_name_quot = SqlHelper.quote(Item.copies_folder)
+      con = "(parent_id=#{my_folder.id}) and (name=#{folder_name_quot})"
 
       begin
         copies_folder = Folder.where(con).first
       rescue
       end
diff --git a/app/helpers/sql_helper.rb b/app/helpers/sql_helper.rb
index e6186fb1..fa6ba824 100644
--- a/app/helpers/sql_helper.rb
+++ b/app/helpers/sql_helper.rb
@@ -49,11 +49,11 @@ module SqlHelper
   #_keyword_:: Target keyword.
   #return:: Query condition.
   #
   def self.get_sql_like(attr_names, keyword)
 
-    key = ActiveRecord::Base.connection.quote("%#{SqlHelper.escape_for_like(keyword)}%")
+    key = SqlHelper.quote("%#{SqlHelper.escape_for_like(keyword)}%")
 
     con = []
     attr_names.each do |attr_name|
       con << "(#{attr_name} like #{key})"
     end
@@ -72,6 +72,18 @@ module SqlHelper
   def self.escape_for_like(str)
 
     return nil if str.nil?
     return str.to_s.gsub(/([%_])/){"\\" + $1}
   end
+
+  #=== self.quote
+  #
+  #Quotes string.
+  #
+  #_str_:: Target string.
+  #return:: Quoted string.
+  #
+  def self.quote(str)
+
+    return ActiveRecord::Base.connection.quote(str)
+  end
 end
diff --git a/app/helpers/templates_helper.rb b/app/helpers/templates_helper.rb
index f76c7363..82728d59 100644
--- a/app/helpers/templates_helper.rb
+++ b/app/helpers/templates_helper.rb
@@ -29,11 +29,11 @@ module TemplatesHelper
   #return:: Array of Folders. [$Templates, System, Workflows, Local, Research].
   #
   def self.setup_tmpl_folder
 
     begin
-      tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
+      tmpl_folder = Folder.where(name: TMPL_ROOT).first
     rescue
     end
     if tmpl_folder.nil?
       # Setup initial template-folders
       folder = Folder.new
@@ -115,11 +115,11 @@ module TemplatesHelper
   #
   #return:: Array of Folders. [$Templates, System, Workflows, Local, Research].
   #
   def self.get_tmpl_folder
 
-    tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
+    tmpl_folder = Folder.where(name: TMPL_ROOT).first
 
     if tmpl_folder.nil?
 
       ary = self.setup_tmpl_folder
 
@@ -166,14 +166,15 @@ module TemplatesHelper
   #
   def self.get_tmpl_subfolder(name)
 
     SqlHelper.validate_token([name])
 
-    tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
+    tmpl_folder = Folder.where(name: TMPL_ROOT).first
 
     unless tmpl_folder.nil?
-      con = "(parent_id=#{tmpl_folder.id}) and (name='#{name}')"
+      name_quot = SqlHelper.quote(name)
+      con = "(parent_id=#{tmpl_folder.id}) and (name=#{name_quot})"
       begin
         child = Folder.where(con).first
       rescue => evar
         Log.add_error(nil, evar)
       end
diff --git a/app/helpers/tree_element.rb b/app/helpers/tree_element.rb
index 8dce9d4c..45ace7ed 100644
--- a/app/helpers/tree_element.rb
+++ b/app/helpers/tree_element.rb
@@ -98,11 +98,11 @@ module TreeElement
         end
       end
 
     else
 
-      nodes = klass.where("parent_id=#{node_id}").order('xorder ASC, id ASC').to_a
+      nodes = klass.where("parent_id=#{node_id.to_i}").order('xorder ASC, id ASC').to_a
       if ret_obj
         array = nodes
       else
         nodes.each do |node|
           array << node.id.to_s
@@ -137,11 +137,11 @@ module TreeElement
     if conditions.nil?
       con = ''
     else
       con = Marshal.load(Marshal.dump(conditions)) + ' and '
     end
-    con << "(parent_id=#{node_id})"
+    con << "(parent_id=#{node_id.to_i})"
 
     tree[node_id] = klass.where(con).order(order_by).to_a
 
     tree[node_id].each do |node|
       tree = klass.get_tree(tree, conditions, node.id.to_s)
diff --git a/app/helpers/zeptair_dist_helper.rb b/app/helpers/zeptair_dist_helper.rb
index 3f440577..a274187c 100644
--- a/app/helpers/zeptair_dist_helper.rb
+++ b/app/helpers/zeptair_dist_helper.rb
@@ -61,11 +61,11 @@ module ZeptairDistHelper
   #
   def self.get_comment_of(item_id, user_id)
 
     SqlHelper.validate_token([item_id, user_id])
     begin
-      comment = Comment.where("(user_id=#{user_id}) and (item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").first
+      comment = Comment.where("(user_id=#{user_id.to_i}) and (item_id=#{item_id.to_i}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").first
     rescue => evar
       Log.add_error(nil, evar)
     end
 
     return comment
@@ -143,11 +143,11 @@ module ZeptairDistHelper
   #_item_id_:: Target Item-ID.
   #return:: The number of ACK messages to the specified Distribution Item.
   #
   def self.count_ack_users(item_id)
     SqlHelper.validate_token([item_id])
-    return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").count
+    return Comment.where("(item_id=#{item_id.to_i}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").count
   end
 
   #=== self.count_completed_users
   #
   #Gets the number of completed users of the specified Distribution Item.
@@ -156,11 +156,11 @@ module ZeptairDistHelper
   #return:: The number of completed users of the specified Distribution Item.
   #
   def self.count_completed_users(item_id)
     SqlHelper.validate_token([item_id])
     ack_msg = ZeptairDistHelper.completed_ack_message(item_id)
-    return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}') and (message='#{ack_msg}')").count
+    return Comment.where("(item_id=#{item_id.to_i}) and (xtype='#{Comment::XTYPE_DIST_ACK}') and (message='#{ack_msg}')").count
   end
 
   #=== self.get_feeds
   #
   #Gets Web feeds of specified User.
diff --git a/app/models/email.rb b/app/models/email.rb
index 0c0c1f65..88c3a912 100644
--- a/app/models/email.rb
+++ b/app/models/email.rb
@@ -620,11 +620,11 @@ EOT
   def self.trim(user_id, mail_account_id, max)
 
     SqlHelper.validate_token([user_id, mail_account_id])
 
     begin
-      count = Email.where("mail_account_id=#{mail_account_id}").count
+      count = Email.where("mail_account_id=#{mail_account_id.to_i}").count
       if count > max
 #logger.fatal("[INFO] Email.trim(user_id:#{user_id}, mail_account_id:#{mail_account_id}, max:#{max})")
         over_num = count - max
         emails = []
 
@@ -637,11 +637,11 @@ EOT
         emails = Email.where(con).order('updated_at ASC').limit(over_num).to_a
 
         # Now, remove others
         if emails.length < over_num
           over_num -= emails.length
-          emails += Email.where("mail_account_id=#{mail_account_id}").order('updated_at ASC').limit(over_num).to_a
+          emails += Email.where("mail_account_id=#{mail_account_id.to_i}").order('updated_at ASC').limit(over_num).to_a
         end
 
         emails.each do |email|
           email.destroy
         end
@@ -684,11 +684,11 @@ EOT
 #        break if over_size <= 0
 #      end
 #
 #      # Now, remove others
 #      if over_size > 0
-#        emails = Email.where("mail_account_id=#{mail_account_id}").order('updated_at ASC').to_a
+#        emails = Email.where("mail_account_id=#{mail_account_id.to_i}").order('updated_at ASC').to_a
 #        emails.each do |email|
 #          next if email.size.nil?
 #
 #          email.destroy
 #          over_size -= email.size
@@ -760,11 +760,11 @@ EOT
   #
   def self.destroy_by_user(user_id, add_con=nil)
 
     SqlHelper.validate_token([user_id])
 
-    con = "user_id=#{user_id}"
+    con = "(user_id=#{user_id.to_i})"
     con << " and (#{add_con})" unless add_con.nil? or add_con.empty?
     emails = Email.where(con).to_a
 
     emails.each do |email|
       email.destroy
diff --git a/app/models/folder.rb b/app/models/folder.rb
index 84112904..5bcfee7a 100644
--- a/app/models/folder.rb
+++ b/app/models/folder.rb
@@ -238,22 +238,22 @@ class Folder < ActiveRecord::Base
     tree_id = '0'
 
     if group_id.to_s == '0'
       sql = 'select distinct * from folders'
 
-      where = " where (parent_id = #{tree_id})"
-      where << " and ((xtype is null) or not(xtype = '#{XTYPE_GROUP}' or xtype = '#{XTYPE_USER}'))"
+      where = " where (parent_id=#{tree_id.to_i})"
+      where << " and ((xtype is null) or not((xtype='#{XTYPE_GROUP}') or (xtype='#{XTYPE_USER}')))"
 
       order_by = ' order by xorder ASC, id ASC'
     else
       sql = 'select distinct Folder.* from folders Folder, users User'
 
-      where = " where (Folder.parent_id = #{tree_id})"
+      where = " where (Folder.parent_id=#{tree_id.to_i})"
       where << ' and ('
-      where <<      "(Folder.xtype = '#{XTYPE_GROUP}' and Folder.owner_id = #{group_id})"
+      where <<      "((Folder.xtype='#{XTYPE_GROUP}') and (Folder.owner_id=#{group_id.to_i}))"
       where <<      ' or '
-      where <<      "(Folder.xtype = '#{XTYPE_USER}' and  Folder.owner_id = User.id and #{SqlHelper.get_sql_like(['User.groups'], "|#{group_id}|")})"
+      where <<      "((Folder.xtype='#{XTYPE_USER}') and (Folder.owner_id=User.id) and #{SqlHelper.get_sql_like(['User.groups'], "|#{group_id}|")})"
       where <<     ' )'
 
       order_by = ' order by Folder.xorder ASC, Folder.id ASC'
     end
 
@@ -322,11 +322,11 @@ class Folder < ActiveRecord::Base
     if con.nil?
       con = ''
     else
       con << ' and '
     end
-    con << "parent_id=#{tree_id}"
+    con << "parent_id=#{tree_id.to_i}"
     folder_tree[tree_id] += Folder.where(con).order('xorder ASC, id ASC').to_a
 
     delete_ary = []
 
     folder_tree[tree_id].each do |folder|
@@ -666,11 +666,11 @@ class Folder < ActiveRecord::Base
       if con.nil?
         con = ''
       else
         con << ' and '
       end
-      con << "parent_id=#{folder_id}"
+      con << "parent_id=#{folder_id.to_i}"
 
       unless admin
         con << " and (xtype is null or not (xtype='#{Folder::XTYPE_SYSTEM}'))"
       end
 
diff --git a/app/models/group.rb b/app/models/group.rb
index 78b05815..0362389a 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -374,11 +374,11 @@ class Group < ActiveRecord::Base
   #
   def self.get_group_folder(group_id)
 
     SqlHelper.validate_token([group_id])
     begin
-      return Folder.where("(owner_id=#{group_id}) and (xtype='#{Folder::XTYPE_GROUP}')").first
+      return Folder.where("(owner_id=#{group_id.to_i}) and (xtype='#{Folder::XTYPE_GROUP}')").first
     rescue => evar
       Log.add_error(nil, evar)
       return nil
     end
   end
diff --git a/app/models/location.rb b/app/models/location.rb
index 9b34ea6b..90d42909 100644
--- a/app/models/location.rb
+++ b/app/models/location.rb
@@ -46,11 +46,11 @@ class Location < ActiveRecord::Base
 
     SqlHelper.validate_token([group_id])
     if group_id.nil?
       con = 'group_id is null'
     else
-      con = "group_id=#{group_id}"
+      con = "group_id=#{group_id.to_i}"
     end
 
     Location.do_expire(con)
 
     return Location.where(con).to_a
diff --git a/app/models/mail_account.rb b/app/models/mail_account.rb
index 7158d7d6..529980b0 100644
--- a/app/models/mail_account.rb
+++ b/app/models/mail_account.rb
@@ -70,11 +70,11 @@ class MailAccount < ActiveRecord::Base
   def self.get_using_size(mail_account_id, add_con=nil)
 
     SqlHelper.validate_token([mail_account_id])
 
     con = []
-    con << "(mail_account_id=#{mail_account_id})"
+    con << "(mail_account_id=#{mail_account_id.to_i})"
     con << "(#{add_con})" unless add_con.nil? or add_con.empty?
 
     return (Email.count_by_sql("select SUM(size) from emails where #{con.join(' and ')}") || 0)
   end
 
@@ -154,11 +154,11 @@ class MailAccount < ActiveRecord::Base
   #
   def self.destroy_by_user(user_id, add_con=nil)
 
     SqlHelper.validate_token([user_id])
 
-    con = "user_id=#{user_id}"
+    con = "(user_id=#{user_id.to_i})"
     con << " and (#{add_con})" unless add_con.nil? or add_con.empty?
     mail_accounts = MailAccount.where(con).to_a
 
     mail_accounts.each do |mail_account|
       mail_account.destroy
@@ -256,11 +256,11 @@ class MailAccount < ActiveRecord::Base
   def self.get_default_for(user_id, xtype=nil)
 
     SqlHelper.validate_token([user_id, xtype])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << '(is_default=1)'
     con << "(xtype='#{xtype}')" unless xtype.blank?
 
     where = ''
     unless con.nil? or con.empty?
diff --git a/app/models/mail_filter.rb b/app/models/mail_filter.rb
index 8eb561ea..3e8fbf71 100644
--- a/app/models/mail_filter.rb
+++ b/app/models/mail_filter.rb
@@ -65,11 +65,11 @@ class MailFilter < ActiveRecord::Base
     return [] if mail_account_id.nil?
 
     SqlHelper.validate_token([mail_account_id, trigger])
 
     con = []
-    con << "(mail_account_id=#{mail_account_id})"
+    con << "(mail_account_id=#{mail_account_id.to_i})"
     con << "(enabled=#{(enabled)?(1):(0)})" unless enabled.nil?
     con << SqlHelper.get_sql_like([:triggers], "|#{trigger}|") unless trigger.nil?
 
     return MailFilter.where(con.join(' and ')).order('(xorder is null) ASC, xorder ASC, id ASC').to_a
   end
diff --git a/app/models/mail_folder.rb b/app/models/mail_folder.rb
index 9ee5d260..7916ca07 100644
--- a/app/models/mail_folder.rb
+++ b/app/models/mail_folder.rb
@@ -120,10 +120,12 @@ class MailFolder < ActiveRecord::Base
   #_mail_account_ids_:: Array of the target MailAccount-IDs.
   #return:: Conditions.
   #
   def self.get_condtions_for(user, mail_account_ids)
 
+    SqlHelper.validate_token([mail_account_ids])
+
     if mail_account_ids.nil? or mail_account_ids.empty?
       return "(user_id=#{user.id} and (mail_account_id is null))"
     else
       return "(user_id=#{user.id} and (mail_account_id is null or mail_account_id in (#{mail_account_ids.join(',')})))"
     end
@@ -149,12 +151,12 @@ class MailFolder < ActiveRecord::Base
     end
 
     SqlHelper.validate_token([user_id, mail_account_id, xtype])
 
     con = []
-    con << "(user_id=#{user_id})"
-    con << "(mail_account_id=#{mail_account_id})"
+    con << "(user_id=#{user_id.to_i})"
+    con << "(mail_account_id=#{mail_account_id.to_i})"
     con << "(xtype='#{xtype}')"
 
     return MailFolder.where(con.join(' and ')).first
   end
 
@@ -176,11 +178,11 @@ class MailFolder < ActiveRecord::Base
     end
 
     SqlHelper.validate_token([user_id])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << "(xtype='#{MailFolder::XTYPE_ACCOUNT_ROOT}')"
 
     order_by = 'xorder ASC, id ASC'
 
     return MailFolder.where(con.join(' and ')).order(order_by).to_a
diff --git a/app/models/office_map.rb b/app/models/office_map.rb
index fb3a35b6..0ecb357a 100644
--- a/app/models/office_map.rb
+++ b/app/models/office_map.rb
@@ -35,14 +35,14 @@ class OfficeMap < ActiveRecord::Base
 
     if group_id.nil?
       office_map = nil
     else
       if incl_img_content
-        office_map = OfficeMap.where("group_id=#{group_id}").first
+        office_map = OfficeMap.where("group_id=#{group_id.to_i}").first
       else
         sql = 'select id, group_id, img_enabled, img_name, img_size, img_content_type, created_at, updated_at from office_maps'
-        sql << " where group_id=#{group_id}"
+        sql << " where group_id=#{group_id.to_i}"
         begin
           office_map = OfficeMap.find_by_sql(sql).first
         rescue
         end
       end
diff --git a/app/models/official_title.rb b/app/models/official_title.rb
index 685011c9..275c1947 100644
--- a/app/models/official_title.rb
+++ b/app/models/official_title.rb
@@ -68,11 +68,11 @@ class OfficialTitle < ActiveRecord::Base
         group_con << " or (group_id in (#{group_ids.join(',')}))"
       end
 
       con << '(' + group_con + ')'
     else
-      con << "(group_id=#{group_id})"
+      con << "(group_id=#{group_id.to_i})"
     end
 
     order_by = 'order by xorder ASC, id ASC'
     #order_by = 'order by disabled ASC, xorder ASC, id ASC'
 
diff --git a/app/models/paid_holiday.rb b/app/models/paid_holiday.rb
index 7a2a8ffd..bfda8d67 100644
--- a/app/models/paid_holiday.rb
+++ b/app/models/paid_holiday.rb
@@ -32,15 +32,15 @@ class PaidHoliday < ActiveRecord::Base
 
     SqlHelper.validate_token([user_id, fiscal_year])
 
     begin
       con = []
-      con << "(user_id=#{user_id})"
+      con << "(user_id=#{user_id.to_i})"
       if fiscal_year.nil?
         return PaidHoliday.where(con).order('year ASC').to_a
       else
-        con << "(year=#{fiscal_year})"
+        con << "(year=#{fiscal_year.to_i})"
         return PaidHoliday.where(con.join(' and ')).first
       end
     rescue
     end
     return nil
@@ -59,12 +59,12 @@ class PaidHoliday < ActiveRecord::Base
 
     SqlHelper.validate_token([user_id, fiscal_year])
 
     if num <= 0
       con = []
-      con << "(user_id=#{user_id})"
-      con << "(year=#{fiscal_year})"
+      con << "(user_id=#{user_id.to_i})"
+      con << "(year=#{fiscal_year.to_i})"
       PaidHoliday.destroy_all(con.join(' and '))
       return
     end
 
     paid_holiday = PaidHoliday.get_for(user_id, fiscal_year)
@@ -98,11 +98,11 @@ class PaidHoliday < ActiveRecord::Base
     end
 
     return 0 if paidhld_carry_over.nil? or paidhld_carry_over.empty? or paidhld_carry_over == PaidHoliday::CARRY_OVER_NONE
 
     begin
-      con = "(user_id=#{user_id}) and (year < #{year})"
+      con = "(user_id=#{user_id.to_i}) and (year < #{year.to_i})"
       paidhlds = PaidHoliday.where(con).order('year ASC').to_a
     rescue
     end
     return 0 if paidhlds.nil? or paidhlds.empty?
 
diff --git a/app/models/research.rb b/app/models/research.rb
index 240d1892..f9a525ca 100644
--- a/app/models/research.rb
+++ b/app/models/research.rb
@@ -356,11 +356,11 @@ class Research < ActiveRecord::Base
   #
   def self.get_for(user_id)
 
     SqlHelper.validate_token([user_id])
 
-    return Research.where("user_id=#{user_id}").first
+    return Research.where("user_id=#{user_id.to_i}").first
   end
 
   #=== self.get_q_codes
   #
   #Gets String array of all question-codes.
diff --git a/app/models/setting.rb b/app/models/setting.rb
index 6c99ea8a..508f3149 100644
--- a/app/models/setting.rb
+++ b/app/models/setting.rb
@@ -1,11 +1,11 @@
 #
 #= Setting
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #Setting represents a setting of User.
 #
@@ -31,11 +31,11 @@ class Setting < ActiveRecord::Base
   def self.get_for(user_id, category=nil)
 
     SqlHelper.validate_token([user_id, category])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << "(category='#{category}')" unless category.nil?
 
     settings = Setting.where(con.join(' and ')).to_a
 
     return nil if settings.nil? or settings.empty?
@@ -61,11 +61,11 @@ class Setting < ActiveRecord::Base
   def self.get_value(user_id, category, key)
 
     SqlHelper.validate_token([user_id, category, key])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
     setting = Setting.where(con.join(' and ')).first
 
@@ -86,11 +86,11 @@ class Setting < ActiveRecord::Base
   def self.save_value(user_id, category, key, value)
 
     SqlHelper.validate_token([user_id, category, key])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
     setting = Setting.where(con.join(' and ')).first
 
@@ -125,11 +125,11 @@ class Setting < ActiveRecord::Base
   def self.get_for_group(group_id, category=nil)
 
     SqlHelper.validate_token([group_id, category])
 
     con = []
-    con << "(group_id=#{group_id})"
+    con << "(group_id=#{group_id.to_i})"
     con << "(category='#{category}')" unless category.nil?
 
     settings = Setting.where(con.join(' and ')).to_a
 
     return nil if settings.nil? or settings.empty?
@@ -155,11 +155,11 @@ class Setting < ActiveRecord::Base
   def self.get_group_value(group_id, category, key)
 
     SqlHelper.validate_token([group_id, category, key])
 
     con = []
-    con << "(group_id=#{group_id})"
+    con << "(group_id=#{group_id.to_i})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
     setting = Setting.where(con.join(' and ')).first
 
@@ -180,11 +180,11 @@ class Setting < ActiveRecord::Base
   def self.save_group_value(group_id, category, key, value)
 
     SqlHelper.validate_token([group_id, category, key])
 
     con = []
-    con << "(group_id=#{group_id})"
+    con << "(group_id=#{group_id.to_i})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
     setting = Setting.where(con.join(' and ')).first
 
diff --git a/app/models/team.rb b/app/models/team.rb
index 56ab9b39..ecf09892 100644
--- a/app/models/team.rb
+++ b/app/models/team.rb
@@ -365,11 +365,11 @@ class Team < ActiveRecord::Base
   #
   def self.get_team_folder(team_id)
 
     SqlHelper.validate_token([team_id])
     begin
-      return Folder.where("(owner_id=#{team_id}) and (xtype='#{Folder::XTYPE_TEAM}')").first
+      return Folder.where("(owner_id=#{team_id.to_i}) and (xtype='#{Folder::XTYPE_TEAM}')").first
     rescue => evar
       Log.add_error(nil, evar)
       return nil
     end
   end
@@ -409,11 +409,11 @@ class Team < ActiveRecord::Base
     con = ["(xtype='#{Comment::XTYPE_APPLY}')"]
     con << "(item_id=#{self.item_id})"
 
     user_con_a = []
     user_ids.each do |user_id|
-      user_con_a << "(user_id=#{user_id})"
+      user_con_a << "(user_id=#{user_id.to_i})"
     end
 
     con << '(' + user_con_a.join(' or ') + ')'
 
     Comment.destroy_all(con.join(' and '))
diff --git a/app/models/timecard.rb b/app/models/timecard.rb
index 5c439be0..6be1ac5a 100644
--- a/app/models/timecard.rb
+++ b/app/models/timecard.rb
@@ -427,11 +427,11 @@ class Timecard < ActiveRecord::Base
   #
   def self.get_for(user_id, date_s)
 
     SqlHelper.validate_token([user_id, date_s])
     begin
-      con = "(user_id=#{user_id}) and (date='#{date_s}')"
+      con = "(user_id=#{user_id.to_i}) and (date='#{date_s}')"
       return Timecard.where(con).first
     rescue
     end
     return nil
   end
@@ -450,11 +450,11 @@ class Timecard < ActiveRecord::Base
     SqlHelper.validate_token([user_id])
 
     start_s = start_date.strftime(Schedule::SYS_DATE_FORM)
     end_s = end_date.strftime(Schedule::SYS_DATE_FORM)
 
-    con = "(user_id=#{user_id}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
+    con = "(user_id=#{user_id.to_i}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
     ary = Timecard.where(con).order('date ASC').to_a
     timecards_h = Hash.new
     unless ary.nil?
       ary.each do |timecard|
         timecards_h[timecard.date.strftime(Schedule::SYS_DATE_FORM)] = timecard
diff --git a/app/models/toy.rb b/app/models/toy.rb
index dcc5c548..aff57c1d 100644
--- a/app/models/toy.rb
+++ b/app/models/toy.rb
@@ -194,11 +194,11 @@ class Toy < ActiveRecord::Base
 
     return false if user.nil? or xtype.nil? or target_id.nil?
 
     SqlHelper.validate_token([xtype, target_id])
 
-    con = "(user_id=#{user.id}) and (xtype='#{xtype}') and (target_id=#{target_id})"
+    con = "(user_id=#{user.id}) and (xtype='#{xtype}') and (target_id=#{target_id.to_i})"
 
     begin
       toy = Toy.where(con).first
     rescue => evar
       Log.add_error(nil, evar)
diff --git a/app/models/user.rb b/app/models/user.rb
index f620221c..a7b67976 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -778,11 +778,11 @@ class User < ActiveRecord::Base
   #return:: Folder object of 'My Folder'.
   #
   def self.get_my_folder(user_id)
 
    SqlHelper.validate_token([user_id])
-   return Folder.where("(owner_id=#{user_id}) and (xtype='#{Folder::XTYPE_USER}')").first
+   return Folder.where("(owner_id=#{user_id.to_i}) and (xtype='#{Folder::XTYPE_USER}')").first
   end
 
   #=== create_my_folder
   #
   #Creates 'My Folder' of this User.
@@ -1164,11 +1164,11 @@ class User < ActiveRecord::Base
     else
       con = ['title=?', title]
     end
 
     SqlHelper.validate_token([order])
-    User.update_all("xorder=#{order}", con)
+    User.update_all("xorder=#{order.to_i}", con)
   end
 
   #=== rename_title
   #
   #Updates title attributes of corresponding Users.
diff --git a/app/views/folders/show_tree.html.erb b/app/views/folders/show_tree.html.erb
index 5c46ee5c..d3472c56 100644
--- a/app/views/folders/show_tree.html.erb
+++ b/app/views/folders/show_tree.html.erb
@@ -43,11 +43,11 @@ var modified_teams = 0;
         <% if !@login_user.nil? %>
           <td nowrap style="padding:5px 20px; text-align:left;">
             <input type="button" value="<%= t('btn.new') %>" onclick="onCreateClicked(getPos(this));" style="width:80px;" />
             <input type="button" value="<%= t('btn.rename') %>" onclick="onRenameFolderClicked(getPos(this));" style="width:80px;" />
             <input type="button" value="<%= t('btn.delete') %>" onclick="doDelete();" style="width:80px;" />
-            <input type="button" value="<%= t('btn.move') %>" onclick="doMove();" style="width:80px;" />
+            <input type="button" value="<%= t('btn.move') %>" onclick="onMoveFolderClicked();" style="width:80px;" />
           </td>
         <% else %>
           <td style="padding:5px 20px; text-align:left;">
             <%= t('folder.login_to_edit_tree') %>
           </td>
@@ -490,11 +490,11 @@ function _doDelete(folder_id)
                 parameters:Form.serialize(document.form_folder_tree)+"&authenticity_token=<%= form_authenticity_token %>"
               }
             );
 }
 
-function doMove()
+function onMoveFolderClicked()
 {
   if (document.form_folder_tree.selKeeper.value == "") {
     msg("<%= t('folder.select') %>");
     return;
   }
@@ -512,17 +512,30 @@ function doMove()
     return;
   }
 
   ThetisBox.openTree("folderTree:"+folder_id, true);
 
+  var addParams = new Array();
+  addParams.push("id="+folder_id);
+  addParams.push("authenticity_token=<%= form_authenticity_token %>");
+
   var thetisBox = new ThetisBox;
-  thetisBox.progress = true;
-  thetisBox.setAdditionalParams(new Array("id="+folder_id, "authenticity_token=<%= form_authenticity_token %>"));
-  thetisBox.show("CENTER", "", "TREE", "<%= url_for(:controller => 'folders', :action => 'move') %>", "<%= t('folder.select_dest')%>", "");
+  thetisBox.setAdditionalParams(addParams);
+  thetisBox.setFormTag("<form action=\"\" method=\"post\" onsubmit=\"doMoveFolder(this); return false;\">");
+  thetisBox.show("CENTER", "", "TREE", "", "<%= t('folder.select_dest')%>", "");
   thetisBox.setTree("<%= url_for(:controller => 'folders', :action => 'ajax_get_tree') %>?id="+folder_id, "0");
 }
 
+function doMoveFolder(frmTree)
+{
+  prog("TOP-RIGHT");
+
+  frmTree.method = "post";
+  frmTree.action = "<%= url_for(:controller => 'folders', :action => 'move') %>";
+  frmTree.submit();
+}
+
 function selectFolder(folder_id)
 {
   var select_opt = _z("select_opt");
 
   if (select_opt == null) {
@@ -638,11 +651,11 @@ function doApplyAuthUsers(folder_id)
 
   var addParams = new Array();
   addParams.push("id=" + folder_id);
   addParams.push(Form.serialize(document.form_folder_auth));
 
-  doUpdateView("get", "<%= url_for(:controller => 'folders', :action => 'set_auth_users') %>", addParams);
+  doUpdateView("post", "<%= url_for(:controller => 'folders', :action => 'set_auth_users') %>", addParams);
 }
 
 function selectTabGroups(folder_id)
 {
   var applyFunc = getApplyFunc(folder_id);
@@ -667,11 +680,11 @@ function doApplyAuthGroups(folder_id)
 
   var addParams = new Array();
   addParams.push("id=" + folder_id);
   addParams.push(Form.serialize(document.form_folder_auth));
 
-  doUpdateView("get", "<%= url_for(:controller => 'folders', :action => 'set_auth_groups') %>", addParams);
+  doUpdateView("post", "<%= url_for(:controller => 'folders', :action => 'set_auth_groups') %>", addParams);
 }
 
 function selectTabTeams(folder_id)
 {
   var applyFunc = getApplyFunc(folder_id);
@@ -696,11 +709,11 @@ function doApplyAuthTeams(folder_id)
 
   var addParams = new Array();
   addParams.push("id=" + folder_id);
   addParams.push(Form.serialize(document.form_folder_auth));
 
-  doUpdateView("get", "<%= url_for(:controller => 'folders', :action => 'set_auth_teams') %>", addParams);
+  doUpdateView("post", "<%= url_for(:controller => 'folders', :action => 'set_auth_teams') %>", addParams);
 }
 
 function showGroupTreeToSelect(group_id)
 {
   var thetisBox = new ThetisBox;
diff --git a/app/views/frames/_footer.html.erb b/app/views/frames/_footer.html.erb
index cc4e814b..98ab727e 100644
--- a/app/views/frames/_footer.html.erb
+++ b/app/views/frames/_footer.html.erb
@@ -1,9 +1,9 @@
 
 <table style="width:100%; height:8px; padding:0px; border-spacing:0px;" background="<%= THETIS_RELATIVE_URL_ROOT %>/images/woody.png">
   <tr>
-    <td style="text-align:center; color:white; font-size:8px; line-height:1.0;">
+    <td style="text-align:center; color:white; font-size:8px; line-height:1.0; padding:0px;">
       <a href="javascript:this.onclick()" style="color:white; text-decoration:none; cursor:pointer;" onclick="openWindow('<%= url_for(:controller => 'frames', :action => 'about') %>',600, 360, 'about'); return false;">&copy;2007-2015 Thetis Developers</a>
     </td>
   </tr>
 </table>
 
diff --git a/app/views/groups/show_tree.html.erb b/app/views/groups/show_tree.html.erb
index f14c4b4a..4d3bff50 100644
--- a/app/views/groups/show_tree.html.erb
+++ b/app/views/groups/show_tree.html.erb
@@ -9,11 +9,11 @@
           <td nowrap style="padding:5px 20px; text-align:left;">
           <% if @login_user.admin?(User::AUTH_GROUP) %>
             <input type="button" value="<%= t('btn.new') %>" onclick="onCreateGroupClicked(getPos(this));" style="width:80px;" />
             <input type="button" value="<%= t('btn.rename') %>" onclick="onRenameGroupClicked(getPos(this));" style="width:80px;" />
             <input type="button" value="<%= t('btn.delete') %>" onclick="doDelete();" style="width:80px;" />
-            <input type="button" value="<%= t('btn.move') %>" onclick="doMove();" style="width:80px;"/>
+            <input type="button" value="<%= t('btn.move') %>" onclick="onMoveGroupClicked();" style="width:80px;"/>
           <% else %>
             <%= t('group.only_admin_can_edit_tree') %>
           <% end %>
           </td>
           <td style="padding:5px 20px; text-align:right;">
@@ -277,11 +277,11 @@ function _doDelete(group_id)
             parameters:Form.serialize(document.form_group_tree)+"&authenticity_token=<%= form_authenticity_token %>"
           }
         );
 }
 
-function doMove()
+function onMoveGroupClicked()
 {
   if (document.form_group_tree.selKeeper.value == "") {
     msg("<%= t('group.select') %>");
     return;
   }
@@ -292,17 +292,30 @@ function doMove()
     return;
   }
 
   ThetisBox.openTree("groupTree:"+group_id, true);
 
+  var addParams = new Array();
+  addParams.push("id="+group_id);
+  addParams.push("authenticity_token=<%= form_authenticity_token %>");
+
   var thetisBox = new ThetisBox;
-  thetisBox.progress = true;
-  thetisBox.setAdditionalParams(new Array("id="+group_id, "authenticity_token=<%= form_authenticity_token %>"));
-  thetisBox.show("CENTER", "", "TREE", "<%= url_for(:controller => 'groups', :action => 'move') %>", "<%= t('group.select_dest')%>", "");
+  thetisBox.setAdditionalParams(addParams);
+  thetisBox.setFormTag("<form action=\"\" method=\"post\" onsubmit=\"doMoveGroup(this); return false;\">");
+  thetisBox.show("CENTER", "", "TREE", "", "<%= t('group.select_dest')%>", "");
   thetisBox.setTree("<%= url_for(:controller => 'groups', :action => 'ajax_get_tree') %>?id="+group_id, "0");
 }
 
+function doMoveGroup(frmTree)
+{
+  prog("TOP-RIGHT");
+
+  frmTree.method = "post";
+  frmTree.action = "<%= url_for(:controller => 'groups', :action => 'move') %>";
+  frmTree.submit();
+}
+
 function doGetUsers(group_id)
 {
   var addParams = new Array();
   addParams.push("id="+group_id);
   addParams.push(Form.serialize(document.form_group_tree));
diff --git a/app/views/mail_filters/list.html.erb b/app/views/mail_filters/list.html.erb
index e43f1259..07d06bf3 100644
--- a/app/views/mail_filters/list.html.erb
+++ b/app/views/mail_filters/list.html.erb
@@ -226,16 +226,17 @@ onExecNowFiltersClicked = function(elem)
 doExecNowFilters = function(mail_account_id, folder_id)
 {
   var addParams = new Array();
   addParams.push("mail_account_id="+mail_account_id);
   addParams.push("mail_folder_id="+folder_id);
+  addParams.push("authenticity_token=<%= form_authenticity_token %>");
 
   var thetisBoxProgress = prog("TOP-RIGHT");
   new Ajax.Request(
               "<%= url_for(:controller => 'mail_filters', :action => 'do_execute') %>",
               {
-                method:"get",
+                method:"post",
                 asynchronous:true,
                 evalScripts:true,
                 parameters:addParams.join("&"),
                 onComplete:function(request){
                   thetisBoxProgress.remove();
diff --git a/app/views/mail_folders/show_tree.html.erb b/app/views/mail_folders/show_tree.html.erb
index e138eae3..5c65ac8f 100644
--- a/app/views/mail_folders/show_tree.html.erb
+++ b/app/views/mail_folders/show_tree.html.erb
@@ -86,11 +86,11 @@
                           <%= t('btn.new') %>
                         </a>
                         <a class="context_menu_item" href="javascript:this.onclick()" onclick="onRenameFolderClicked(); return false;">
                           <%= t('btn.rename') %>
                         </a>
-                        <a class="context_menu_item" href="javascript:this.onclick()" onclick="doMove(); return false;">
+                        <a class="context_menu_item" href="javascript:this.onclick()" onclick="onMoveFolderClicked(); return false;">
                           <%= t('btn.move') %>
                         </a>
                         <a class="context_menu_item" href="javascript:this.onclick()" onclick="doDelete(); return false;">
                           <%= t('btn.delete') %>
                         </a>
@@ -648,11 +648,11 @@ function _doDelete(folder_id)
         }
       }
     );
 }
 
-function doMove()
+function onMoveFolderClicked()
 {
   if (document.form_folder_tree.selKeeper.value == "") {
     msg("<%= t('folder.select') %>");
     return;
   }
@@ -669,23 +669,33 @@ function doMove()
     return;
   }
 
   ThetisBox.openTree("mailTree:"+folder_id, true);
 
-  var thetisBox = new ThetisBox;
-  thetisBox.progress = true;
   var addParams = new Array();
 <% unless params[:mail_account_xtype].nil? %>
   addParams.push("mail_account_xtype=<%= params[:mail_account_xtype] %>");
 <% end %>
   addParams.push("id="+folder_id);
   addParams.push("authenticity_token=<%= form_authenticity_token %>");
+
+  var thetisBox = new ThetisBox;
   thetisBox.setAdditionalParams(addParams);
-  thetisBox.show("CENTER", "", "TREE", "<%= url_for(:controller => 'mail_folders', :action => 'move') %>", "<%= t('folder.select_dest') %>", "");
+  thetisBox.setFormTag("<form action=\"\" method=\"post\" onsubmit=\"doMoveFolder(this); return false;\">");
+  thetisBox.show("CENTER", "", "TREE", "", "<%= t('folder.select_dest') %>", "");
   thetisBox.setTree("<%= url_for(:controller => 'mail_folders', :action => 'ajax_get_tree') %>?id="+folder_id, "0");
 }
 
+function doMoveFolder(frmTree)
+{
+  prog("TOP-RIGHT");
+
+  frmTree.method = "post";
+  frmTree.action = "<%= url_for(:controller => 'mail_folders', :action => 'move') %>";
+  frmTree.submit();
+}
+
 function doSelectTree(folder_id)
 {
   var menuId = "a_mailTree:" + folder_id;
   ThetisBox.selectTree("selKeeper", menuId, null, true);
   if (ThetisBox.isSelectedTree("selKeeper", menuId)) {
@@ -1006,11 +1016,11 @@ function _doEmpty(folder_id)
   if (mail_account_id) {
     addParams.push("mail_account_id="+mail_account_id);
   }
 
   invalidateAccountSummary();
-  doUpdateViewMails("get", "<%= url_for(:controller => 'mail_folders', :action => 'empty') %>", addParams, folder_id);
+  doUpdateViewMails("post", "<%= url_for(:controller => 'mail_folders', :action => 'empty') %>", addParams, folder_id);
 }
 
 
 var thetisBoxFoldersOrder = null;
 
diff --git a/config/locales/de.yml b/config/locales/de.yml
index 1e8e7edc..00098656 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -429,11 +429,11 @@ de:
     select: "Bitte wählen Sie die Gruppe aus."
     root_group_restricted: "Wurzelgruppe kann nicht umbenennt, verschiebt oder gelöscht werden."
     select_dest: "Bitte wählen Sie das Ziel zu verschieben aus."
     delete_info1: "] wird gelöscht."
     delete_info2: "(Falls Gruppenordner ist nicht leer, wird das mit R/W (Lesen u. Schreiben) Befugnisse der Mitgliedern weiterbleiben. Wenn keine Mitgliedern in Gruppe geben und keine andere Befugnisse zu Gruppenordner angegeben werden, wird das Veröffentlicht.)"
-    select_to_show: "(Bitte wählen Sie Gruppe zu zeigen aus.)"
+    select_to_show: "Bitte wählen Sie Gruppe zu zeigen aus."
     select_to_change_to: "Bitte wählen Sie Gruppe zu ersetzen durch aus."
     select_to_add: "Bitte wählen Sie Gruppe hinzuzufügen."
     other_group: "Andere Gruppe"
     opt:
       subgroups_order: "Order of sub-groups"
diff --git a/config/locales/en.yml b/config/locales/en.yml
index a7c7dde4..46512324 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -429,11 +429,11 @@ en:
     select: "Please select group."
     root_group_restricted: "Root group cannot be renamed, moved or deleted."
     select_dest: "Please select destination group."
     delete_info1: "] will be deleted."
     delete_info2: "(If Group Folder is not empty, it will remain with members' R/W authorities. When no members in the Group and no other authorities specified to Group Folder, it will be PUBLIC.)"
-    select_to_show: "(Please select a group to show.)"
+    select_to_show: "Please select a group to show."
     select_to_change_to: "Please select group to change to."
     select_to_add: "Please select group to add."
     other_group: "Other Group"
     opt:
       subgroups_order: "Order of sub-groups"
diff --git a/config/locales/ja.yml b/config/locales/ja.yml
index 74c7860f..e9ef5b69 100644
--- a/config/locales/ja.yml
+++ b/config/locales/ja.yml
@@ -433,11 +433,11 @@ ja:
     select: "グループを選択してください。"
     root_group_restricted: "ルートグループは変更・移動・削除はできません。"
     select_dest: "移動先を選択してください。"
     delete_info1: "」を削除します。"
     delete_info2: "（グループフォルダが空でなければメンバーの読み書き権限付きで残されます。グループにメンバーがおらず他に権限が設定されていない時は、グループフォルダは全ユーザーからアクセス可能になります。）"
-    select_to_show: "（表示するグループを選択してください）"
+    select_to_show: "表示するグループを選択してください。"
     select_to_change_to: "変更先のグループを選択してください。"
     select_to_add: "追加するグループを選択してください。"
     other_group: "他のグループ"
     opt:
       subgroups_order: "サブグループの並び順"

Vulnerable code:       params.delete(:controller)
      params.delete(:action)
      params.delete(:id)
      params[:action] = params[:from_action]
      redirect_to(params)
        key_quot = ActiveRecord::Base.connection.quote(key)
    return unless request.post?

      target_user = User.where("zeptair_id=#{zeptair_id}").first
      target_user = User.where("zeptair_id=#{zeptair_id}").first
    copied_items = Item.where("user_id=#{user_id} and source_id=#{source_id}").order('created_at DESC').to_a
      con = "(parent_id=#{my_folder.id}) and (name='#{Item.copies_folder}')"
      con = "(parent_id=#{my_folder.id}) and (name='#{Item.copies_folder}')"
    key = ActiveRecord::Base.connection.quote("%#{SqlHelper.escape_for_like(keyword)}%")
      tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
    tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
    tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
      con = "(parent_id=#{tmpl_folder.id}) and (name='#{name}')"
      nodes = klass.where("parent_id=#{node_id}").order('xorder ASC, id ASC').to_a
    con << "(parent_id=#{node_id})"
      comment = Comment.where("(user_id=#{user_id}) and (item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").first
    return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").count
    return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}') and (message='#{ack_msg}')").count
      count = Email.where("mail_account_id=#{mail_account_id}").count
          emails += Email.where("mail_account_id=#{mail_account_id}").order('updated_at ASC').limit(over_num).to_a
#        emails = Email.where("mail_account_id=#{mail_account_id}").order('updated_at ASC').to_a
    con = "user_id=#{user_id}"
      where = " where (parent_id = #{tree_id})"
      where << " and ((xtype is null) or not(xtype = '#{XTYPE_GROUP}' or xtype = '#{XTYPE_USER}'))"
      where = " where (Folder.parent_id = #{tree_id})"
      where <<      "(Folder.xtype = '#{XTYPE_GROUP}' and Folder.owner_id = #{group_id})"
      where <<      "(Folder.xtype = '#{XTYPE_USER}' and  Folder.owner_id = User.id and #{SqlHelper.get_sql_like(['User.groups'], "|#{group_id}|")})"
    con << "parent_id=#{tree_id}"
      con << "parent_id=#{folder_id}"
      return Folder.where("(owner_id=#{group_id}) and (xtype='#{Folder::XTYPE_GROUP}')").first
      con = "group_id=#{group_id}"
    con << "(mail_account_id=#{mail_account_id})"
    con = "user_id=#{user_id}"
    con << "(user_id=#{user_id})"
    con << "(mail_account_id=#{mail_account_id})"
    con << "(user_id=#{user_id})"
    con << "(mail_account_id=#{mail_account_id})"
    con << "(user_id=#{user_id})"
        office_map = OfficeMap.where("group_id=#{group_id}").first
        sql << " where group_id=#{group_id}"
      con << "(group_id=#{group_id})"
      con << "(user_id=#{user_id})"
        con << "(year=#{fiscal_year})"
      con << "(user_id=#{user_id})"
      con << "(year=#{fiscal_year})"
      con = "(user_id=#{user_id}) and (year < #{year})"
    return Research.where("user_id=#{user_id}").first
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    con << "(user_id=#{user_id})"
    con << "(user_id=#{user_id})"
    con << "(user_id=#{user_id})"
    con << "(group_id=#{group_id})"
    con << "(group_id=#{group_id})"
    con << "(group_id=#{group_id})"
      return Folder.where("(owner_id=#{team_id}) and (xtype='#{Folder::XTYPE_TEAM}')").first
      user_con_a << "(user_id=#{user_id})"
      con = "(user_id=#{user_id}) and (date='#{date_s}')"
    con = "(user_id=#{user_id}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
    con = "(user_id=#{user.id}) and (xtype='#{xtype}') and (target_id=#{target_id})"
   return Folder.where("(owner_id=#{user_id}) and (xtype='#{Folder::XTYPE_USER}')").first
    User.update_all("xorder=#{order}", con)
            <input type="button" value="<%= t('btn.move') %>" onclick="doMove();" style="width:80px;" />
function doMove()
  thetisBox.progress = true;
  thetisBox.setAdditionalParams(new Array("id="+folder_id, "authenticity_token=<%= form_authenticity_token %>"));
  thetisBox.show("CENTER", "", "TREE", "<%= url_for(:controller => 'folders', :action => 'move') %>", "<%= t('folder.select_dest')%>", "");
  doUpdateView("get", "<%= url_for(:controller => 'folders', :action => 'set_auth_users') %>", addParams);
  doUpdateView("get", "<%= url_for(:controller => 'folders', :action => 'set_auth_groups') %>", addParams);
  doUpdateView("get", "<%= url_for(:controller => 'folders', :action => 'set_auth_teams') %>", addParams);
    <td style="text-align:center; color:white; font-size:8px; line-height:1.0;">
            <input type="button" value="<%= t('btn.move') %>" onclick="doMove();" style="width:80px;"/>
function doMove()
  thetisBox.progress = true;
  thetisBox.setAdditionalParams(new Array("id="+group_id, "authenticity_token=<%= form_authenticity_token %>"));
  thetisBox.show("CENTER", "", "TREE", "<%= url_for(:controller => 'groups', :action => 'move') %>", "<%= t('group.select_dest')%>", "");
                method:"get",
                        <a class="context_menu_item" href="javascript:this.onclick()" onclick="doMove(); return false;">
function doMove()
  var thetisBox = new ThetisBox;
  thetisBox.progress = true;
  thetisBox.show("CENTER", "", "TREE", "<%= url_for(:controller => 'mail_folders', :action => 'move') %>", "<%= t('folder.select_dest') %>", "");
  doUpdateViewMails("get", "<%= url_for(:controller => 'mail_folders', :action => 'empty') %>", addParams, folder_id);
    select_to_show: "(Bitte wählen Sie Gruppe zu zeigen aus.)"
    select_to_show: "(Please select a group to show.)"
    select_to_show: "（表示するグループを選択してください）"
Fixed code:       self.send(params[:from_action])
        key_quot = SqlHelper.quote(key)
      target_user = User.where("zeptair_id=#{zeptair_id.to_i}").first
      target_user = User.where("zeptair_id=#{zeptair_id.to_i}").first
    copied_items = Item.where("user_id=#{user_id.to_i} and source_id=#{source_id.to_i}").order('created_at DESC').to_a
      folder_name_quot = SqlHelper.quote(Item.copies_folder)
      con = "(parent_id=#{my_folder.id}) and (name=#{folder_name_quot})"
      folder_name_quot = SqlHelper.quote(Item.copies_folder)
      con = "(parent_id=#{my_folder.id}) and (name=#{folder_name_quot})"
    key = SqlHelper.quote("%#{SqlHelper.escape_for_like(keyword)}%")

  #=== self.quote
  #
  #Quotes string.
  #
  #_str_:: Target string.
  #return:: Quoted string.
  #
  def self.quote(str)

    return ActiveRecord::Base.connection.quote(str)
  end
      tmpl_folder = Folder.where(name: TMPL_ROOT).first
    tmpl_folder = Folder.where(name: TMPL_ROOT).first
    tmpl_folder = Folder.where(name: TMPL_ROOT).first
      name_quot = SqlHelper.quote(name)
      con = "(parent_id=#{tmpl_folder.id}) and (name=#{name_quot})"
      nodes = klass.where("parent_id=#{node_id.to_i}").order('xorder ASC, id ASC').to_a
    con << "(parent_id=#{node_id.to_i})"
      comment = Comment.where("(user_id=#{user_id.to_i}) and (item_id=#{item_id.to_i}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").first
    return Comment.where("(item_id=#{item_id.to_i}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").count
    return Comment.where("(item_id=#{item_id.to_i}) and (xtype='#{Comment::XTYPE_DIST_ACK}') and (message='#{ack_msg}')").count
      count = Email.where("mail_account_id=#{mail_account_id.to_i}").count
          emails += Email.where("mail_account_id=#{mail_account_id.to_i}").order('updated_at ASC').limit(over_num).to_a
#        emails = Email.where("mail_account_id=#{mail_account_id.to_i}").order('updated_at ASC').to_a
    con = "(user_id=#{user_id.to_i})"
      where = " where (parent_id=#{tree_id.to_i})"
      where << " and ((xtype is null) or not((xtype='#{XTYPE_GROUP}') or (xtype='#{XTYPE_USER}')))"
      where = " where (Folder.parent_id=#{tree_id.to_i})"
      where <<      "((Folder.xtype='#{XTYPE_GROUP}') and (Folder.owner_id=#{group_id.to_i}))"
      where <<      "((Folder.xtype='#{XTYPE_USER}') and (Folder.owner_id=User.id) and #{SqlHelper.get_sql_like(['User.groups'], "|#{group_id}|")})"
    con << "parent_id=#{tree_id.to_i}"
      con << "parent_id=#{folder_id.to_i}"
      return Folder.where("(owner_id=#{group_id.to_i}) and (xtype='#{Folder::XTYPE_GROUP}')").first
      con = "group_id=#{group_id.to_i}"
    con << "(mail_account_id=#{mail_account_id.to_i})"
    con = "(user_id=#{user_id.to_i})"
    con << "(user_id=#{user_id.to_i})"
    con << "(mail_account_id=#{mail_account_id.to_i})"
    SqlHelper.validate_token([mail_account_ids])

    con << "(user_id=#{user_id.to_i})"
    con << "(mail_account_id=#{mail_account_id.to_i})"
    con << "(user_id=#{user_id.to_i})"
        office_map = OfficeMap.where("group_id=#{group_id.to_i}").first
        sql << " where group_id=#{group_id.to_i}"
      con << "(group_id=#{group_id.to_i})"
      con << "(user_id=#{user_id.to_i})"
        con << "(year=#{fiscal_year.to_i})"
      con << "(user_id=#{user_id.to_i})"
      con << "(year=#{fiscal_year.to_i})"
      con = "(user_id=#{user_id.to_i}) and (year < #{year.to_i})"
    return Research.where("user_id=#{user_id.to_i}").first
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    con << "(user_id=#{user_id.to_i})"
    con << "(user_id=#{user_id.to_i})"
    con << "(user_id=#{user_id.to_i})"
    con << "(group_id=#{group_id.to_i})"
    con << "(group_id=#{group_id.to_i})"
    con << "(group_id=#{group_id.to_i})"
      return Folder.where("(owner_id=#{team_id.to_i}) and (xtype='#{Folder::XTYPE_TEAM}')").first
      user_con_a << "(user_id=#{user_id.to_i})"
      con = "(user_id=#{user_id.to_i}) and (date='#{date_s}')"
    con = "(user_id=#{user_id.to_i}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
    con = "(user_id=#{user.id}) and (xtype='#{xtype}') and (target_id=#{target_id.to_i})"
   return Folder.where("(owner_id=#{user_id.to_i}) and (xtype='#{Folder::XTYPE_USER}')").first
    User.update_all("xorder=#{order.to_i}", con)
            <input type="button" value="<%= t('btn.move') %>" onclick="onMoveFolderClicked();" style="width:80px;" />
function onMoveFolderClicked()
  var addParams = new Array();
  addParams.push("id="+folder_id);
  addParams.push("authenticity_token=<%= form_authenticity_token %>");

  thetisBox.setAdditionalParams(addParams);
  thetisBox.setFormTag("<form action=\"\" method=\"post\" onsubmit=\"doMoveFolder(this); return false;\">");
  thetisBox.show("CENTER", "", "TREE", "", "<%= t('folder.select_dest')%>", "");
function doMoveFolder(frmTree)
{
  prog("TOP-RIGHT");

  frmTree.method = "post";
  frmTree.action = "<%= url_for(:controller => 'folders', :action => 'move') %>";
  frmTree.submit();
}

  doUpdateView("post", "<%= url_for(:controller => 'folders', :action => 'set_auth_users') %>", addParams);
  doUpdateView("post", "<%= url_for(:controller => 'folders', :action => 'set_auth_groups') %>", addParams);
  doUpdateView("post", "<%= url_for(:controller => 'folders', :action => 'set_auth_teams') %>", addParams);
    <td style="text-align:center; color:white; font-size:8px; line-height:1.0; padding:0px;">
            <input type="button" value="<%= t('btn.move') %>" onclick="onMoveGroupClicked();" style="width:80px;"/>
function onMoveGroupClicked()
  var addParams = new Array();
  addParams.push("id="+group_id);
  addParams.push("authenticity_token=<%= form_authenticity_token %>");

  thetisBox.setAdditionalParams(addParams);
  thetisBox.setFormTag("<form action=\"\" method=\"post\" onsubmit=\"doMoveGroup(this); return false;\">");
  thetisBox.show("CENTER", "", "TREE", "", "<%= t('group.select_dest')%>", "");
function doMoveGroup(frmTree)
{
  prog("TOP-RIGHT");

  frmTree.method = "post";
  frmTree.action = "<%= url_for(:controller => 'groups', :action => 'move') %>";
  frmTree.submit();
}

  addParams.push("authenticity_token=<%= form_authenticity_token %>");
                method:"post",
                        <a class="context_menu_item" href="javascript:this.onclick()" onclick="onMoveFolderClicked(); return false;">
function onMoveFolderClicked()

  var thetisBox = new ThetisBox;
  thetisBox.setFormTag("<form action=\"\" method=\"post\" onsubmit=\"doMoveFolder(this); return false;\">");
  thetisBox.show("CENTER", "", "TREE", "", "<%= t('folder.select_dest') %>", "");
function doMoveFolder(frmTree)
{
  prog("TOP-RIGHT");

  frmTree.method = "post";
  frmTree.action = "<%= url_for(:controller => 'mail_folders', :action => 'move') %>";
  frmTree.submit();
}

  doUpdateViewMails("post", "<%= url_for(:controller => 'mail_folders', :action => 'empty') %>", addParams, folder_id);
    select_to_show: "Bitte wählen Sie Gruppe zu zeigen aus."
    select_to_show: "Please select a group to show."
    select_to_show: "表示するグループを選択してください。"