CVE-2015-2972 (published 2015-07-19T15:59Z)

Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/sysphonic/thetis
commit_details: repo_url: https://github.com/sysphonic/thetis
author: MORITA Shintaro
author_date: 2015-07-07 09:10:26+09:00
msg: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>
repository: repo_url: https://github.com/sysphonic/thetis
repo_name: sysphonic/thetis
description: Free Open-Source Goupware / Web Collaboration Suite
repo_language: HTML
owner: sysphonic
file_changes: filename: desktop_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -91,7 +91,7 @@ class DesktopController < ApplicationController
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
       date_s = @date.strftime(Schedule::SYS_DATE_FORM)
     else

programming_language: Ruby
filename: items_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -1272,9 +1272,10 @@ class ItemsController < ApplicationController
       end
 
       users = @team.get_users_a
-    end 
+    end
 
     team_members = params[:team_members]
+    SqlHelper.validate_token([team_members])
 
     created = false
     modified = false
@@ -1305,9 +1306,9 @@ class ItemsController < ApplicationController
           @team.clear_users
         end
 
-        @team.add_users team_members
+        @team.add_users(team_members)
         @team.save
-        @team.remove_application team_members
+        @team.remove_application(team_members)
 
         modified = true 
       end

programming_language: Ruby
filename: login_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -97,7 +97,7 @@ class LoginController < ApplicationController
     Log.add_info(request, params.inspect)
 
     mail_addr = params[:thetisBoxEdit]
-    SqlHelper.validate_token([mail_addr], ['@-'])
+    SqlHelper.validate_token([mail_addr])
     begin
       users = User.where("email='#{mail_addr}'").to_a
     rescue => evar

programming_language: Ruby
filename: mail_folders_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -32,9 +32,9 @@ class MailFoldersController < ApplicationController
     con << "(user_id=#{@login_user.id})"
 
     account_xtype = params[:mail_account_xtype]
+    SqlHelper.validate_token([account_xtype])
 
     unless account_xtype.blank?
-      SqlHelper.validate_token([account_xtype])
       con << "(xtype='#{account_xtype}')"
     end
     @mail_accounts = MailAccount.find_all(con.join(' and '))

programming_language: Ruby
filename: timecards_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -120,7 +120,7 @@ class TimecardsController < ApplicationController
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
       date_s = @date.strftime(Schedule::SYS_DATE_FORM)
     else

programming_language: Ruby
filename: zeptair_post_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -81,33 +81,35 @@ class ZeptairPostController < ApplicationController
 
     target_user = nil
 
-    SqlHelper.validate_token([params[:user_id], params[:zeptair_id], params[:group_id]])
+    user_id = params[:user_id]
+    zeptair_id = params[:zeptair_id]
+    group_id = params[:group_id]
+    SqlHelper.validate_token([user_id, zeptair_id, group_id])
 
-    unless params[:user_id].blank?
-      target_user = User.find(params[:user_id])
+    unless user_id.blank?
+      target_user = User.find(user_id)
     end
 
-    unless params[:zeptair_id].blank?
-      zeptair_id = params[:zeptair_id]
+    unless zeptair_id.blank?
       target_user = User.where("zeptair_id=#{zeptair_id}").first
     end
 
     if target_user.nil?
 
-      if params[:group_id].blank?
+      if group_id.blank?
         sql = 'select distinct Item.* from items Item, attachments Attachment'
         sql << " where Item.xtype='#{Item::XTYPE_ZEPTAIR_POST}' and Item.id=Attachment.item_id"
         sql << ' order by Item.user_id ASC'
       else
-        group_ids = [params[:group_id]]
+        group_ids = [group_id]
 
         if params[:recursive] == 'true'
-          group_ids += Group.get_childs(params[:group_id], true, false)
+          group_ids += Group.get_childs(group_id, true, false)
         end
 
         groups_con = []
-        group_ids.each do |group_id|
-          groups_con << SqlHelper.get_sql_like(['User.groups'], "|#{@group_id}|")
+        group_ids.each do |grp_id|
+          groups_con << SqlHelper.get_sql_like(['User.groups'], "|#{grp_id}|")
         end
         sql = 'select distinct Item.* from items Item, attachments Attachment, users User'
         sql << " where Item.xtype='#{Item::XTYPE_ZEPTAIR_POST}' and Item.id=Attachment.item_id"
@@ -134,15 +136,20 @@ class ZeptairPostController < ApplicationController
 
     target_user = nil
 
-    unless params[:user_id].blank?
-      if @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id.to_s == params[:user_id].to_s
-        target_user = User.find(params[:user_id])
+    user_id = params[:user_id]
+    zeptair_id = params[:zeptair_id]
+    attachment_id = params[:attachment_id]
+    SqlHelper.validate_token([user_id, zeptair_id, attachment_id])
+
+    unless user_id.blank?
+      if @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id.to_s == user_id.to_s
+        target_user = User.find(user_id)
       end
     end
 
-    unless params[:zeptair_id].blank?
+    unless zeptair_id.blank?
 
-      target_user = User.where("zeptair_id=#{params[:zeptair_id]}").first
+      target_user = User.where("zeptair_id=#{zeptair_id}").first
 
       unless @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id == target_user.id
         target_user = nil
@@ -150,7 +157,7 @@ class ZeptairPostController < ApplicationController
     end
 
     if target_user.nil?
-      if params[:attachment_id].blank?
+      if attachment_id.blank?
 
         query
         unless @post_items.nil?
@@ -163,7 +170,7 @@ class ZeptairPostController < ApplicationController
         end
 
       else
-        attach = Attachment.find(params[:attachment_id])
+        attach = Attachment.find(attachment_id)
 
         item = Item.find(attach.item_id)
 

programming_language: Ruby
filename: items_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -24,6 +24,9 @@ module ItemsHelper
   #return:: Next revision number.
   #
   def self.get_next_revision(user_id, source_id)
+
+    SqlHelper.validate_token([user_id, source_id])
+
     copied_items = Item.where("user_id=#{user_id} and source_id=#{source_id}").order('created_at DESC').to_a
 
     rev = 0
@@ -35,7 +38,7 @@ module ItemsHelper
       break
     end
 
-    return '#' + sprintf('%03d', rev+1)
+    return ('#' + sprintf('%03d', rev+1))
   end
 
   #=== self.get_copies_folder

programming_language: Ruby
filename: sql_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -25,8 +25,12 @@ module SqlHelper
   #
   def self.validate_token(tokens, extra_chars=nil)
 
-    extra_chars = Regexp.escape((extra_chars || []).join())
-    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_.#{extra_chars}]+[ ]*$")
+    if extra_chars.nil?
+      extra_chars = ''
+    else
+      extra_chars = Regexp.escape(extra_chars.join())
+    end
+    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_.@\\-#{extra_chars}]+[ ]*$")
 
     [tokens].flatten.each do |token|
       next if token.blank?

programming_language: Ruby
filename: templates_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -166,6 +166,8 @@ module TemplatesHelper
   #
   def self.get_tmpl_subfolder(name)
 
+    SqlHelper.validate_token([name])
+
     tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
 
     unless tmpl_folder.nil?
@@ -179,5 +181,4 @@ module TemplatesHelper
 
     return [tmpl_folder, child]
   end
-
 end

programming_language: Ruby
filename: tree_element.rb
change_type: ModificationType.MODIFY
diff: @@ -78,6 +78,8 @@ module TreeElement
   #
   def self.get_childs(klass, node_id, recursive, ret_obj)
 
+    SqlHelper.validate_token([node_id])
+
     array = []
 
     if recursive
@@ -131,6 +133,7 @@ module TreeElement
   #
   def self.get_tree(klass, tree, conditions, node_id, order_by)
 
+    SqlHelper.validate_token([node_id])
     if conditions.nil?
       con = ''
     else

programming_language: Ruby
filename: zeptair_dist_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -61,6 +61,7 @@ module ZeptairDistHelper
   #
   def self.get_comment_of(item_id, user_id)
 
+    SqlHelper.validate_token([item_id, user_id])
     begin
       comment = Comment.where("(user_id=#{user_id}) and (item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").first
     rescue => evar
@@ -143,6 +144,7 @@ module ZeptairDistHelper
   #return:: The number of ACK messages to the specified Distribution Item.
   #
   def self.count_ack_users(item_id)
+    SqlHelper.validate_token([item_id])
     return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").count
   end
 
@@ -154,6 +156,7 @@ module ZeptairDistHelper
   #return:: The number of completed users of the specified Distribution Item.
   #
   def self.count_completed_users(item_id)
+    SqlHelper.validate_token([item_id])
     ack_msg = ZeptairDistHelper.completed_ack_message(item_id)
     return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}') and (message='#{ack_msg}')").count
   end

programming_language: Ruby
filename: address.rb
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,8 @@ class Address < ActiveRecord::Base
   #
   def self.get_by_email(mail_addr, user, book=Address::BOOK_BOTH)
 
+    SqlHelper.validate_token([mail_addr])
+
     email_con = []
     email_con.push("(email1='#{mail_addr}')")
     email_con.push("(email2='#{mail_addr}')")

programming_language: Ruby
filename: email.rb
change_type: ModificationType.MODIFY
diff: @@ -618,6 +618,9 @@ EOT
   #_max_:: Max number.
   #
   def self.trim(user_id, mail_account_id, max)
+
+    SqlHelper.validate_token([user_id, mail_account_id])
+
     begin
       count = Email.where("mail_account_id=#{mail_account_id}").count
       if count > max
@@ -757,6 +760,8 @@ EOT
   #
   def self.destroy_by_user(user_id, add_con=nil)
 
+    SqlHelper.validate_token([user_id])
+
     con = "user_id=#{user_id}"
     con << " and (#{add_con})" unless add_con.nil? or add_con.empty?
     emails = Email.where(con).to_a

programming_language: Ruby
filename: folder.rb
change_type: ModificationType.MODIFY
diff: @@ -641,6 +641,7 @@ class Folder < ActiveRecord::Base
   #
   def self.get_childs(folder_id, conditions, recursive, admin, ret_obj)
 
+    SqlHelper.validate_token([folder_id])
     arr = []
 
     if recursive

programming_language: Ruby
filename: group.rb
change_type: ModificationType.MODIFY
diff: @@ -374,6 +374,7 @@ class Group < ActiveRecord::Base
   #
   def self.get_group_folder(group_id)
 
+    SqlHelper.validate_token([group_id])
     begin
       return Folder.where("(owner_id=#{group_id}) and (xtype='#{Folder::XTYPE_GROUP}')").first
     rescue => evar

programming_language: Ruby
filename: location.rb
change_type: ModificationType.MODIFY
diff: @@ -44,6 +44,7 @@ class Location < ActiveRecord::Base
   #
   def self.get_for_group(group_id)
 
+    SqlHelper.validate_token([group_id])
     if group_id.nil?
       con = 'group_id is null'
     else

programming_language: Ruby
filename: mail_account.rb
change_type: ModificationType.MODIFY
diff: @@ -154,6 +154,8 @@ class MailAccount < ActiveRecord::Base
   #
   def self.destroy_by_user(user_id, add_con=nil)
 
+    SqlHelper.validate_token([user_id])
+
     con = "user_id=#{user_id}"
     con << " and (#{add_con})" unless add_con.nil? or add_con.empty?
     mail_accounts = MailAccount.where(con).to_a
@@ -265,12 +267,12 @@ class MailAccount < ActiveRecord::Base
       where = 'where ' + con.join(' and ')
     end
 
-    account_ary = MailAccount.find_by_sql('select * from mail_accounts ' + where + ' order by xorder ASC, title ASC')
+    mail_accounts = MailAccount.find_by_sql('select * from mail_accounts ' + where + ' order by xorder ASC, title ASC')
 
-    if account_ary.nil? or account_ary.empty?
+    if mail_accounts.nil? or mail_accounts.empty?
       return nil
     else
-      return account_ary.first
+      return mail_accounts.first
     end
   end
 end

programming_language: Ruby
filename: mail_folder.rb
change_type: ModificationType.MODIFY
diff: @@ -148,6 +148,8 @@ class MailFolder < ActiveRecord::Base
       user_id = user.to_s
     end
 
+    SqlHelper.validate_token([user_id, mail_account_id, xtype])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(mail_account_id=#{mail_account_id})"
@@ -173,6 +175,8 @@ class MailFolder < ActiveRecord::Base
       user_id = user.to_s
     end
 
+    SqlHelper.validate_token([user_id])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(xtype='#{MailFolder::XTYPE_ACCOUNT_ROOT}')"

programming_language: Ruby
filename: paid_holiday.rb
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,9 @@ class PaidHoliday < ActiveRecord::Base
   #return:: PaidHoliday(s) for the specified User.
   #
   def self.get_for(user_id, fiscal_year=nil)
+
+    SqlHelper.validate_token([user_id, fiscal_year])
+
     begin
       con = []
       con << "(user_id=#{user_id})"
@@ -54,8 +57,13 @@ class PaidHoliday < ActiveRecord::Base
   #
   def self.update_for(user_id, fiscal_year, num)
 
+    SqlHelper.validate_token([user_id, fiscal_year])
+
     if num <= 0
-      PaidHoliday.destroy_all(['user_id=? and year=?', user_id, fiscal_year])
+      con = []
+      con << "(user_id=#{user_id})"
+      con << "(year=#{fiscal_year})"
+      PaidHoliday.destroy_all(con.join(' and '))
       return
     end
 
@@ -82,6 +90,8 @@ class PaidHoliday < ActiveRecord::Base
   #
   def self.get_carried_over(user_id, year)
 
+    SqlHelper.validate_token([user_id, year])
+
     yaml = ApplicationHelper.get_config_yaml
     unless yaml[:timecard].nil?
       paidhld_carry_over = yaml[:timecard]['paidhld_carry_over']
@@ -134,5 +144,4 @@ class PaidHoliday < ActiveRecord::Base
       return 0
     end
   end
-
 end

programming_language: Ruby
filename: research.rb
change_type: ModificationType.MODIFY
diff: @@ -356,6 +356,8 @@ class Research < ActiveRecord::Base
   #
   def self.get_for(user_id)
 
+    SqlHelper.validate_token([user_id])
+
     return Research.where("user_id=#{user_id}").first
   end
 

programming_language: Ruby
filename: setting.rb
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,8 @@ class Setting < ActiveRecord::Base
   #
   def self.get_for(user_id, category=nil)
 
+    SqlHelper.validate_token([user_id, category])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(category='#{category}')" unless category.nil?
@@ -58,6 +60,8 @@ class Setting < ActiveRecord::Base
   #
   def self.get_value(user_id, category, key)
 
+    SqlHelper.validate_token([user_id, category, key])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(category='#{category}')"
@@ -81,6 +85,8 @@ class Setting < ActiveRecord::Base
   #
   def self.save_value(user_id, category, key, value)
 
+    SqlHelper.validate_token([user_id, category, key])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(category='#{category}')"
@@ -118,6 +124,8 @@ class Setting < ActiveRecord::Base
   #
   def self.get_for_group(group_id, category=nil)
 
+    SqlHelper.validate_token([group_id, category])
+
     con = []
     con << "(group_id=#{group_id})"
     con << "(category='#{category}')" unless category.nil?
@@ -146,6 +154,8 @@ class Setting < ActiveRecord::Base
   #
   def self.get_group_value(group_id, category, key)
 
+    SqlHelper.validate_token([group_id, category, key])
+
     con = []
     con << "(group_id=#{group_id})"
     con << "(category='#{category}')"
@@ -169,6 +179,8 @@ class Setting < ActiveRecord::Base
   #
   def self.save_group_value(group_id, category, key, value)
 
+    SqlHelper.validate_token([group_id, category, key])
+
     con = []
     con << "(group_id=#{group_id})"
     con << "(category='#{category}')"

programming_language: Ruby
filename: team.rb
change_type: ModificationType.MODIFY
diff: @@ -365,6 +365,7 @@ class Team < ActiveRecord::Base
   #
   def self.get_team_folder(team_id)
 
+    SqlHelper.validate_token([team_id])
     begin
       return Folder.where("(owner_id=#{team_id}) and (xtype='#{Folder::XTYPE_TEAM}')").first
     rescue => evar
@@ -397,23 +398,24 @@ class Team < ActiveRecord::Base
   #
   #Removes applications of the specified Users.
   #
-  #_users_:: Array of User-IDs.
+  #_user_ids_:: Array of User-IDs.
   #
-  def remove_application(users)
+  def remove_application(user_ids)
 
-    return if users.nil? or users.empty?
+    return if user_ids.nil? or user_ids.empty?
 
-    array = ["(xtype='#{Comment::XTYPE_APPLY}')"]
-    array << "(item_id=#{self.item_id})"
+    SqlHelper.validate_token([user_ids])
+
+    con = ["(xtype='#{Comment::XTYPE_APPLY}')"]
+    con << "(item_id=#{self.item_id})"
 
     user_con_a = []
-    users.each do |user_id|
+    user_ids.each do |user_id|
       user_con_a << "(user_id=#{user_id})"
     end
 
-    array << '(' + user_con_a.join(' or ') + ')'
+    con << '(' + user_con_a.join(' or ') + ')'
 
-    Comment.destroy_all(array.join(' and '))
+    Comment.destroy_all(con.join(' and '))
  end
-
 end

programming_language: Ruby
filename: timecard.rb
change_type: ModificationType.MODIFY
diff: @@ -422,12 +422,14 @@ class Timecard < ActiveRecord::Base
   #Gets Timecard of the specified User and Date.
   #
   #_user_id_:: Target User-ID.
-  #_date_:: Target Date.
+  #_date_s_:: Target Date string.
   #return:: Timecard for the specified User and Date.
   #
-  def self.get_for(user_id, date)
+  def self.get_for(user_id, date_s)
+
+    SqlHelper.validate_token([user_id, date_s])
     begin
-      con = "(user_id=#{user_id}) and (date='#{date}')"
+      con = "(user_id=#{user_id}) and (date='#{date_s}')"
       return Timecard.where(con).first
     rescue
     end
@@ -444,7 +446,13 @@ class Timecard < ActiveRecord::Base
   #return:: Timecard for the specified User and span.
   #
   def self.find_term(user_id, start_date, end_date)
-    con = "(user_id=#{user_id}) and (date >= '#{start_date}') and (date <= '#{end_date}')"
+
+    SqlHelper.validate_token([user_id])
+
+    start_s = start_date.strftime(Schedule::SYS_DATE_FORM)
+    end_s = end_date.strftime(Schedule::SYS_DATE_FORM)
+
+    con = "(user_id=#{user_id}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
     ary = Timecard.where(con).order('date ASC').to_a
     timecards_h = Hash.new
     unless ary.nil?
@@ -466,9 +474,12 @@ class Timecard < ActiveRecord::Base
   #
   def self.applied_paid_hlds(user_id, start_date, end_date)
 
-    SqlHelper.validate_token([user_id, start_date, end_date])
+    SqlHelper.validate_token([user_id])
+
+    start_s = start_date.strftime(Schedule::SYS_DATE_FORM)
+    end_s = end_date.strftime(Schedule::SYS_DATE_FORM)
 
-    sql = "SELECT COUNT(*) FROM timecards WHERE user_id = #{user_id} AND date >= '#{start_date}' AND date <= '#{end_date}'"
+    sql = "SELECT COUNT(*) FROM timecards WHERE user_id = #{user_id} AND date >= '#{start_s}' AND date <= '#{end_s}'"
 
     sum = 0.0
     self.workcodes.each do |key, params|

programming_language: Ruby
filename: toy.rb
change_type: ModificationType.MODIFY
diff: @@ -194,6 +194,8 @@ class Toy < ActiveRecord::Base
 
     return false if user.nil? or xtype.nil? or target_id.nil?
 
+    SqlHelper.validate_token([xtype, target_id])
+
     con = "(user_id=#{user.id}) and (xtype='#{xtype}') and (target_id=#{target_id})"
 
     begin

programming_language: Ruby
filename: user.rb
change_type: ModificationType.MODIFY
diff: @@ -275,6 +275,8 @@ class User < ActiveRecord::Base
     name = attrs[:name]
     password = attrs[:password]
 
+    SqlHelper.validate_token([name])
+
     pass_md5 = UsersHelper.generate_digest_pass(name, password)
 
     return User.where("(name='#{name}') and (pass_md5='#{pass_md5}')").first
@@ -529,6 +531,8 @@ class User < ActiveRecord::Base
   #
   def self.get_from_name(user_name)
 
+    SqlHelper.validate_token([user_name])
+
     begin
       user = User.where("name='#{user_name}'").first
     rescue => evar
@@ -775,7 +779,8 @@ class User < ActiveRecord::Base
   #
   def self.get_my_folder(user_id)
 
-    return Folder.where("(owner_id=#{user_id}) and (xtype='#{Folder::XTYPE_USER}')").first
+   SqlHelper.validate_token([user_id])
+   return Folder.where("(owner_id=#{user_id}) and (xtype='#{Folder::XTYPE_USER}')").first
   end
 
   #=== create_my_folder
@@ -1156,6 +1161,7 @@ class User < ActiveRecord::Base
       con = ['title=?', title]
     end
 
+    SqlHelper.validate_token([order])
     User.update_all("xorder=#{order}", con)
   end
 
@@ -1182,6 +1188,8 @@ class User < ActiveRecord::Base
   #
   def get_project_application(item_id)
 
+    SqlHelper.validate_token([item_id])
+
     con = "(item_id=#{item_id}) and (user_id=#{self.id}) and (xtype='#{Comment::XTYPE_APPLY}')"
     begin
       comment = Comment.where(con).first

programming_language: Ruby
filename: _edit_scope.html.erb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 scope_tabs = new Array("groups", "teams");
 </script>
 
-<table cellspacing="0" cellpadding="0" style="width:100%;">
+<table style="width:100%; border-spacing:0px;">
   <tr>
     <td style="vertical-align:top;">
       <table cellspacing="2" cellpadding="0" style="width:100%;">
@@ -23,7 +23,7 @@ scope_tabs = new Array("groups", "teams");
     <td style="border:solid 1px gray; background-color:#FFFAFD;">
 
       <div id="tab_div_groups" style="display:none;">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <%
@@ -45,7 +45,7 @@ scope_tabs = new Array("groups", "teams");
           <tr style="height:5px;"><td></td></tr>
           <tr>
             <td>
-              <table cellspacing="0" cellpadding="0" style="width:100%;">
+              <table style="width:100%; border-spacing:0px;">
                 <tr>
                   <td style="text-align:left; vertical-align:bottom; width:33%;"  >
                     <%= t('group.plural') %><%= t('cap.suffix') %>
@@ -72,7 +72,7 @@ scope_tabs = new Array("groups", "teams");
         </table>
       </div>
       <div id="tab_div_teams" style="display:none;">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <%
@@ -94,7 +94,7 @@ scope_tabs = new Array("groups", "teams");
           <tr style="height:5px;"><td></td></tr>
           <tr>
             <td>
-              <table cellspacing="0" cellpadding="0" style="width:100%;">
+              <table style="width:100%; border-spacing:0px;">
                 <tr>
                   <td style="text-align:left; vertical-align:bottom; width:33%;" >
                     <%= t('team.plural') %><%= t('cap.suffix') %>

programming_language: PHP
filename: _edit_members.html.erb
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@ tabs = new Array("users", "groups", "teams");
     <td style="border:solid 1px gray; background-color:#FFFAFD;">
 
       <div id="tab_div_users">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <select id="users_selected" name="users[]" class="select_multi" size="5" multiple="multiple">
@@ -52,7 +52,7 @@ tabs = new Array("users", "groups", "teams");
         </table>
       </div>
       <div id="tab_div_groups" style="display:none;">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <%
@@ -74,7 +74,7 @@ tabs = new Array("users", "groups", "teams");
           <tr style="height:5px;"><td></td></tr>
           <tr>
             <td>
-              <table cellspacing="0" cellpadding="0" style="width:100%;">
+              <table style="width:100%; border-spacing:0px;">
                 <tr>
                   <td style="text-align:left; vertical-align:bottom; width:33%;"  >
                     <%= t('group.plural') %><%= t('cap.suffix') %>
@@ -101,7 +101,7 @@ tabs = new Array("users", "groups", "teams");
         </table>
       </div>
       <div id="tab_div_teams" style="display:none;">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <%
@@ -123,7 +123,7 @@ tabs = new Array("users", "groups", "teams");
           <tr style="height:5px;"><td></td></tr>
           <tr>
             <td>
-              <table cellspacing="0" cellpadding="0" style="width:100%;">
+              <table style="width:100%; border-spacing:0px;">
                 <tr>
                   <td style="text-align:left; vertical-align:bottom; width:33%;" >
                     <%= t('team.plural') %><%= t('cap.suffix') %>

programming_language: PHP
filename: edit_send_to.html.erb
change_type: ModificationType.MODIFY
diff: @@ -89,7 +89,7 @@ tabs_send_mail_address.push("users");
                   end
                   disp << "<#{mail_addr}>"
 
-                  user = User.where("email='#{mail_addr}'").first
+                  user = User.where(email: mail_addr).first
                   if user.nil?
                     entry_val = disp
                   else

programming_language: Ruby
filename: group.html.erb
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 <% HistoryHelper.set_back(request) %>
-
-<% date_s = @date.strftime(Schedule::SYS_DATE_FORM) unless @date.nil? %>
+<%
+date_s = @date.strftime(Schedule::SYS_DATE_FORM) unless @date.nil?
+%>
 
 <%= render(:partial => 'common/jkl_calendar_init') %>
 
@@ -76,7 +77,7 @@ else
   @selected_users.each_with_index do |user, idx|
     bgcolor = (idx % 2 == 1) ? 'gainsboro' : 'white'
 
-    timecard = Timecard.get_for(user.id, @date)
+    timecard = Timecard.get_for(user.id, date_s)
     timecard = Timecard.new if timecard.nil?
 %>
   <tr style="background-color:<%= bgcolor %>;">

programming_language: Ruby
repo_url: https://github.com/sysphonic/thetis
commit_details: repo_url: https://github.com/sysphonic/thetis
author: MORITA Shintaro
author_date: 2015-07-09 22:49:16+09:00
msg: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>
repository: repo_url: https://github.com/sysphonic/thetis
repo_name: sysphonic/thetis
description: Free Open-Source Goupware / Web Collaboration Suite
repo_language: HTML
owner: sysphonic
file_changes: filename: addressbook_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -58,6 +58,8 @@ class AddressbookController < ApplicationController
       Log.add_info(request, params.inspect)
     end
 
+    return unless request.post?
+
     render(:action => 'edit', :layout => (!request.xhr?))
   end
 
@@ -68,6 +70,8 @@ class AddressbookController < ApplicationController
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @address = Address.new(params.require(:address).permit(Address::PERMIT_BASE))
 
     @address = AddressbookHelper.arrange_per_scope(@address, @login_user, params[:scope], params[:groups], params[:teams])
@@ -106,6 +110,7 @@ class AddressbookController < ApplicationController
     begin
       @address = Address.find(address_id)
     rescue => evar
+      @address = nil
       Log.add_error(request, evar)
       redirect_to(:controller => 'login', :action => 'logout')
       return
@@ -142,6 +147,8 @@ class AddressbookController < ApplicationController
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @address = Address.find(params[:id])
     @address.attributes = params[:address]
 
@@ -242,6 +249,8 @@ class AddressbookController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_address].nil?
       list
       render(:action => 'list')
@@ -296,6 +305,8 @@ class AddressbookController < ApplicationController
   def import_csv
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     file = params[:imp_file]
     mode = params[:mode]
     enc = params[:enc]
@@ -436,7 +447,7 @@ class AddressbookController < ApplicationController
   #
   def check_owner
 
-    return if (params[:id].nil? or params[:id].empty? or @login_user.nil?)
+    return if (params[:id].blank? or @login_user.nil?)
 
     address = Address.find(params[:id])
 

programming_language: Ruby
filename: config_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -39,13 +39,15 @@ class ConfigController < ApplicationController
   def update_by_ajax
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     cat_h = {:desktop => User::AUTH_DESKTOP, :user => User::AUTH_USER, :log => User::AUTH_LOG}
 
     yaml = ApplicationHelper.get_config_yaml
 
     cat_h.keys.each do |cat|
 
-      next if params[cat].nil? or params[cat].empty?
+      next if params[cat].blank?
 
       unless @login_user.admin?(cat_h[cat])
         render(:text => t('msg.need_to_be_admin'))
@@ -71,6 +73,8 @@ class ConfigController < ApplicationController
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     categories = [:general, :menu, :topic, :note, :smtp, :feed, :user, :log]
 
     yaml = ApplicationHelper.get_config_yaml
@@ -149,6 +153,8 @@ class ConfigController < ApplicationController
   def destroy_header_menu
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @yaml = ApplicationHelper.get_config_yaml
 
     unless params[:org_name].nil? or @yaml[:general]['header_menus'].nil?
@@ -172,6 +178,8 @@ class ConfigController < ApplicationController
   def update_header_menu
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @yaml = ApplicationHelper.get_config_yaml
 
     @yaml[:general]['header_menus'] = [] if @yaml[:general]['header_menus'].nil?
@@ -221,6 +229,8 @@ class ConfigController < ApplicationController
   def update_header_menus_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     header_menus = params[:header_menus_order]
 
     yaml = ApplicationHelper.get_config_yaml

programming_language: Ruby
filename: desktop_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -36,6 +36,8 @@ class DesktopController < ApplicationController
   def drop_file
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     if params[:file].nil? or params[:file].size <= 0
       render(:text => '')
       return
@@ -126,6 +128,8 @@ class DesktopController < ApplicationController
   def update_pref
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     desktop = Desktop.get_for(@login_user, true)
 
     params[:desktop].delete(:user_id)
@@ -145,9 +149,11 @@ class DesktopController < ApplicationController
   def update_config
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @yaml = ApplicationHelper.get_config_yaml
 
-    unless params[:desktop].nil? or params[:desktop].empty?
+    unless params[:desktop].blank?
       @yaml[:desktop] = Hash.new if @yaml[:desktop].nil?
 
       params[:desktop].each do |key, val|
@@ -294,6 +300,8 @@ class DesktopController < ApplicationController
   def drop_on_desktop
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if @login_user.nil?
       t = Time.now
       render(:text => (t.hour.to_s + t.min.to_s + t.sec.to_s))
@@ -319,6 +327,8 @@ class DesktopController < ApplicationController
   def add_toy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if @login_user.nil?
       render(:text => '0')
       return
@@ -343,6 +353,9 @@ class DesktopController < ApplicationController
   def drop_on_recyclebox
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:id]])
     unless @login_user.nil?
       Toy.destroy(params[:id])
     end
@@ -358,10 +371,13 @@ class DesktopController < ApplicationController
   def on_toys_moved
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless @login_user.nil?
       begin
         toy = Toy.find(params[:id])
       rescue
+        toy = nil
       end
 
       unless toy.nil?
@@ -381,6 +397,8 @@ class DesktopController < ApplicationController
   def create_label
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:thetisBoxEdit].empty?
       render(:partial => 'ajax_label', :layout => false)
       return
@@ -411,6 +429,8 @@ class DesktopController < ApplicationController
   def update_label
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     msg = params[:thetisBoxEdit]
 
     if params[:thetisBoxEdit].empty?
@@ -455,6 +475,8 @@ class DesktopController < ApplicationController
   def post_label
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:txaPostLabel].empty? or params[:post_to].empty?
       render(:text => '')
       return

programming_language: Ruby
filename: equipment_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -42,6 +42,10 @@ class EquipmentController < ApplicationController
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:groups], params[:teams]])
+
     if params[:groups].blank?
       params[:equipment][:groups] = nil
     else
@@ -101,15 +105,19 @@ class EquipmentController < ApplicationController
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:groups], params[:teams]])
+
     @equipment = Equipment.find(params[:id])
 
-    if (params[:groups].nil? or params[:groups].empty?)
+    if params[:groups].blank?
       params[:equipment][:groups] = nil
     else
       params[:equipment][:groups] = '|' + params[:groups].join('|') + '|'
     end
 
-    if (params[:teams].nil? or params[:teams].empty?)
+    if params[:teams].blank?
       params[:equipment][:teams] = nil
     else
       params[:equipment][:teams] = '|' + params[:teams].join('|') + '|'
@@ -178,6 +186,8 @@ class EquipmentController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_equipment].nil?
       list
       render(:action => 'list')
@@ -186,6 +196,7 @@ class EquipmentController < ApplicationController
 
     count = 0
     params[:check_equipment].each do |equipment_id, value|
+      SqlHelper.validate_token([equipment_id])
       if value == '1'
         Equipment.delete(equipment_id)
 
@@ -205,7 +216,7 @@ class EquipmentController < ApplicationController
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)

programming_language: Ruby
filename: folders_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -70,6 +70,8 @@ class FoldersController < ApplicationController
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     parent_id = params[:selectedFolderId]
 
     unless Folder.check_user_auth(parent_id, @login_user, 'w', true)
@@ -78,7 +80,7 @@ class FoldersController < ApplicationController
       return
     end
 
-    if params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    if params[:thetisBoxEdit].blank?
       @folder = nil
     else
       @folder = Folder.new
@@ -100,6 +102,8 @@ class FoldersController < ApplicationController
   def rename
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     unless Folder.check_user_auth(@folder.id, @login_user, 'w', true)
@@ -108,7 +112,7 @@ class FoldersController < ApplicationController
       return
     end
 
-    unless params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    unless params[:thetisBoxEdit].blank?
       @folder.name = params[:thetisBoxEdit]
       @folder.save
     end
@@ -123,6 +127,8 @@ class FoldersController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     unless Folder.check_user_auth(@folder.id, @login_user, 'w', true)
@@ -151,6 +157,8 @@ class FoldersController < ApplicationController
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     if params[:thetisBoxSelKeeper].blank?
@@ -198,13 +206,14 @@ class FoldersController < ApplicationController
   def get_path
     Log.add_info(request, params.inspect)
 
-    if params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
+    if params[:thetisBoxSelKeeper].blank?
       @folder_path = '/' + t('paren.unknown')
       render(:partial => 'ajax_folder_path', :layout => false)
       return
     end
 
     @selected_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([@selected_id])
 
     @folder_path = Folder.get_path(@selected_id)
 
@@ -222,6 +231,7 @@ class FoldersController < ApplicationController
     end
 
     @folder_id = params[:id]
+    SqlHelper.validate_token([@folder_id])
 
     if Folder.check_user_auth(@folder_id, @login_user, 'r', true)
 =begin
@@ -239,6 +249,7 @@ class FoldersController < ApplicationController
       if @sort_col.blank? or @sort_type.blank?
         @sort_col, @sort_type = FoldersHelper.get_sort_params(@folder_id)
       end
+      SqlHelper.validate_token([@sort_col, @sort_type])
 
       folder_ids = nil
       add_con = nil
@@ -292,11 +303,13 @@ class FoldersController < ApplicationController
     Log.add_info(request, params.inspect)
 
     @folder_id = params[:id]
+    SqlHelper.validate_token([@folder_id])
 
     if @folder_id != '0'
       begin
         @folder = Folder.find(@folder_id)
       rescue => evar
+        @folder = nil
         Log.add_error(request, evar)
       end
     end
@@ -322,6 +335,8 @@ class FoldersController < ApplicationController
   def update_items_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     folder_id = params[:id]
 
     if Folder.check_user_auth(folder_id, @login_user, 'w', true)
@@ -353,6 +368,7 @@ class FoldersController < ApplicationController
 
     @folder_id = params[:id]
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@folder_id, @group_id])
 
     if @folder_id != '0'
       @folder = Folder.find(@folder_id)
@@ -382,6 +398,8 @@ class FoldersController < ApplicationController
   def update_folders_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:folders_order]
 
     folders = Folder.get_childs(params[:id], nil, false, true, false)
@@ -407,6 +425,7 @@ class FoldersController < ApplicationController
         folder.update_attribute(:xorder, idx)
         idx += 1
       rescue => evar
+        folder = nil
         Log.add_error(request, evar)
       end
     end
@@ -422,15 +441,18 @@ class FoldersController < ApplicationController
   def get_disp_ctrl
     Log.add_info(request, params.inspect)
 
-    if params[:id] != '0'
+    folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
+
+    if folder_id != '0'
       begin
-        @folder = Folder.find(params[:id])
+        @folder = Folder.find(folder_id)
       rescue => evar
         @folder = nil
       end
     end
 
-    session[:folder_id] = params[:id]
+    session[:folder_id] = folder_id
 
     render(:partial => 'ajax_disp_ctrl', :layout => false)
   end
@@ -443,7 +465,10 @@ class FoldersController < ApplicationController
   def set_disp_ctrl
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
 
     if Folder.check_user_auth(folder_id, @login_user, 'w', true)
 
@@ -482,15 +507,18 @@ class FoldersController < ApplicationController
   def get_auth_users
     Log.add_info(request, params.inspect)
 
+    folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
+
     begin
-      @folder = Folder.find(params[:id])
+      @folder = Folder.find(folder_id)
     rescue
       @folder = nil
     end
 
     @users = []
 
-    session[:folder_id] = params[:id]
+    session[:folder_id] = folder_id
 
     if !@login_user.nil? and (@login_user.admin?(User::AUTH_FOLDER) or (!@folder.nil? and @folder.in_my_folder_of?(@login_user.id)))
       render(:partial => 'ajax_auth_users', :layout => false)
@@ -511,6 +539,7 @@ class FoldersController < ApplicationController
     begin
       @folder = Folder.find(params[:id])
     rescue => evar
+      @folder = nil
       Log.add_error(request, evar)
     end
 
@@ -535,6 +564,8 @@ class FoldersController < ApplicationController
   def set_auth_users
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     if Folder.check_user_auth(@folder.id, @login_user, 'w', true)
@@ -559,8 +590,8 @@ class FoldersController < ApplicationController
       if !user_id.nil? and (!read_users.include?(user_id.to_s) or !write_users.include?(user_id.to_s))
         flash[:notice] = 'ERROR:' + t('folder.my_folder_without_auth_owner')
       else
-        @folder.set_read_users read_users
-        @folder.set_write_users write_users
+        @folder.set_read_users(read_users)
+        @folder.set_write_users(write_users)
 
         @folder.save
 
@@ -571,7 +602,9 @@ class FoldersController < ApplicationController
     end
 
     @group_id = params[:group_id]
-    if @group_id.nil? or @group_id.empty?
+    SqlHelper.validate_token([@group_id])
+
+    if @group_id.blank?
       @users = []
     else
       @users = Group.get_users(@group_id)
@@ -591,15 +624,18 @@ class FoldersController < ApplicationController
   def get_auth_groups
     Log.add_info(request, params.inspect)
 
+    folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
+
     begin
-      @folder = Folder.find(params[:id])
+      @folder = Folder.find(folder_id)
     rescue
       @folder = nil
     end
 
     @groups = Group.where(nil).to_a
 
-    session[:folder_id] = params[:id]
+    session[:folder_id] = folder_id
 
     render(:partial => 'ajax_auth_groups', :layout => false)
   end
@@ -612,6 +648,8 @@ class FoldersController < ApplicationController
   def set_auth_groups
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     if Folder.check_user_auth(@folder.id, @login_user, 'w', true)
@@ -631,8 +669,8 @@ class FoldersController < ApplicationController
         end
       end
 
-      @folder.set_read_groups read_groups
-      @folder.set_write_groups write_groups
+      @folder.set_read_groups(read_groups)
+      @folder.set_write_groups(write_groups)
 
       @folder.save
 
@@ -657,8 +695,11 @@ class FoldersController < ApplicationController
   def get_auth_teams
     Log.add_info(request, params.inspect)
 
+    folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
+
     begin
-      @folder = Folder.find(params[:id])
+      @folder = Folder.find(folder_id)
     rescue
       @folder = nil
     end
@@ -666,7 +707,7 @@ class FoldersController < ApplicationController
     target_user_id = (@login_user.admin?(User::AUTH_TEAM))?(nil):(@login_user.id)
     @teams = Team.get_for(target_user_id, true)
 
-    session[:folder_id] = params[:id]
+    session[:folder_id] = folder_id
 
     render(:partial => 'ajax_auth_teams', :layout => false)
   end
@@ -679,6 +720,8 @@ class FoldersController < ApplicationController
   def set_auth_teams
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     if Folder.check_user_auth(@folder.id, @login_user, 'w', true)
@@ -698,8 +741,8 @@ class FoldersController < ApplicationController
         end
       end
 
-      @folder.set_read_teams read_teams
-      @folder.set_write_teams write_teams
+      @folder.set_read_teams(read_teams)
+      @folder.set_write_teams(write_teams)
 
       @folder.save
 
@@ -725,8 +768,6 @@ class FoldersController < ApplicationController
   def ajax_delete_items
     Log.add_info(request, params.inspect)
 
-    folder_id = params[:id]
-
     unless params[:check_item].blank?
       is_admin = @login_user.admin?(User::AUTH_ITEM)
 
@@ -741,6 +782,7 @@ class FoldersController < ApplicationController
             item.destroy
 
           rescue => evar
+            item = nil
             Log.add_error(request, evar)
           end
 
@@ -762,6 +804,7 @@ class FoldersController < ApplicationController
     Log.add_info(request, params.inspect)
 
     folder_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([folder_id])
 
     unless Folder.check_user_auth(folder_id, @login_user, 'w', true)
       flash[:notice] = 'ERROR:' + t('folder.need_auth_to_write_in')
@@ -783,6 +826,7 @@ class FoldersController < ApplicationController
             item.update_attribute(:folder_id, folder_id)
 
           rescue => evar
+            item = nil
             Log.add_error(request, evar)
           end
 

programming_language: Ruby
filename: groups_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -68,9 +68,11 @@ class GroupsController < ApplicationController
   #Receives Group name from ThetisBox.
   #
   def create
-     Log.add_info(request, params.inspect)
+    Log.add_info(request, params.inspect)
+
+    return unless request.post?
 
-    if params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    if params[:thetisBoxEdit].blank?
       @group = nil
     else
       @group = Group.new
@@ -92,9 +94,11 @@ class GroupsController < ApplicationController
   def rename
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @group = Group.find(params[:id])
-    unless params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
-      @group.rename params[:thetisBoxEdit]
+    unless params[:thetisBoxEdit].blank?
+      @group.rename(params[:thetisBoxEdit])
     end
     render(:partial => 'ajax_group_name', :layout => false)
 
@@ -111,6 +115,9 @@ class GroupsController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:id]])
     begin
       Group.destroy(params[:id])
     rescue => evar
@@ -128,6 +135,8 @@ class GroupsController < ApplicationController
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @group = Group.find(params[:id])
 
     unless params[:thetisBoxSelKeeper].blank?
@@ -160,13 +169,14 @@ class GroupsController < ApplicationController
   def get_path
     Log.add_info(request, params.inspect)
 
-    if params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
+    if params[:thetisBoxSelKeeper].blank?
       @group_path = '/' + t('paren.unknown')
       render(:partial => 'ajax_group_path', :layout => false)
       return
     end
 
     @selected_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([@selected_id])
 
     @group_path = Group.get_path(@selected_id)
 
@@ -181,7 +191,10 @@ class GroupsController < ApplicationController
   def ajax_exclude_users
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     group_id = params[:id]
+    SqlHelper.validate_token([group_id])
 
     unless params[:check_user].blank?
       count = 0
@@ -193,6 +206,7 @@ class GroupsController < ApplicationController
             user.exclude_from(group_id)
             user.save!
           rescue => evar
+            user = nil
             Log.add_error(request, evar)
           end
 
@@ -213,8 +227,11 @@ class GroupsController < ApplicationController
   def ajax_move_users
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     org_group_id = params[:id]
     group_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([org_group_id, group_id])
 
     unless params[:check_user].blank?
 
@@ -228,6 +245,7 @@ class GroupsController < ApplicationController
             user.add_to(group_id)
             user.save!
           rescue => evar
+            user = nil
             Log.add_error(request, evar)
           end
 
@@ -251,6 +269,7 @@ class GroupsController < ApplicationController
     end
 
     @group_id = params[:id]
+    SqlHelper.validate_token([@group_id])
 
 =begin
 #    @users = Group.get_users(params[:id])
@@ -323,6 +342,7 @@ class GroupsController < ApplicationController
     Log.add_info(request, params.inspect)
 
     @group_id = params[:id]
+    SqlHelper.validate_token([@group_id])
 
     if @group_id != '0'
       @group = Group.find(@group_id)
@@ -348,6 +368,8 @@ class GroupsController < ApplicationController
   def update_groups_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:groups_order]
 
     groups = Group.get_childs(params[:id], false, false)
@@ -373,6 +395,7 @@ class GroupsController < ApplicationController
         group.update_attribute(:xorder, idx)
         idx += 1
       rescue => evar
+        group = nil
         Log.add_error(request, evar)
       end
     end
@@ -389,6 +412,7 @@ class GroupsController < ApplicationController
     Log.add_info(request, params.inspect)
 
     @group_id = (params[:id] || '0')  # '0' for ROOT
+    SqlHelper.validate_token([@group_id])
 
     session[:group_id] = params[:id]
     session[:group_option] = 'official_title'
@@ -405,6 +429,7 @@ class GroupsController < ApplicationController
     Log.add_info(request, params.inspect)
 
     @group_id = (params[:id] || '0')  # '0' for ROOT
+    SqlHelper.validate_token([@group_id])
 
     ary = TemplatesHelper.get_tmpl_folder
 
@@ -427,6 +452,7 @@ class GroupsController < ApplicationController
     Log.add_info(request, params.inspect)
 
     @group_id = (params[:id] || '0')  # '0' for ROOT
+    SqlHelper.validate_token([@group_id])
 
     @office_map = OfficeMap.get_for_group(@group_id)
 

programming_language: Ruby
filename: items_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -83,6 +83,7 @@ class ItemsController < ApplicationController
     else
       @folder_id = params[:folder_id]
     end
+    SqlHelper.validate_token([@folder_id])
 
     unless @folder_id.nil?
       session[:folder_id] = @folder_id
@@ -141,7 +142,7 @@ class ItemsController < ApplicationController
   def search
     Log.add_info(request, params.inspect)
 
-    unless params[:select_sorting].nil? or params[:select_sorting].empty?
+    unless params[:select_sorting].blank?
       sort_a = params[:select_sorting].split(' ')
       params[:sort_col] = sort_a.first
       params[:sort_type] = sort_a.last
@@ -149,7 +150,7 @@ class ItemsController < ApplicationController
 
     list
 
-    if params[:keyword].nil? or params[:keyword].empty?
+    if params[:keyword].blank?
       if params[:from_action].nil? or params[:from_action] == 'bbs'
         render(:action => 'bbs')
       else
@@ -166,7 +167,7 @@ class ItemsController < ApplicationController
   def bbs
     Log.add_info(request, params.inspect)
 
-    if !params[:select_sorting].nil?
+    unless params[:select_sorting].nil?
       sort_a = params[:select_sorting].split(' ')
       params[:sort_col] = sort_a.first
       params[:sort_type] = sort_a.last
@@ -218,7 +219,7 @@ class ItemsController < ApplicationController
   def new
 
     @item = Item.new
-    if params[:folder_id].nil? or params[:folder_id].empty?
+    if params[:folder_id].blank?
       my_folder = @login_user.get_my_folder
       if my_folder.nil?
         @item.folder_id = 0
@@ -244,6 +245,7 @@ class ItemsController < ApplicationController
     begin
       @item = Item.find(params[:id])
     rescue => evar
+      @item = nil
       Log.add_error(request, evar)
     end
   end
@@ -256,6 +258,8 @@ class ItemsController < ApplicationController
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @item = Item.find(params[:id])
 
     unless params[:thetisBoxSelKeeper].nil?
@@ -287,6 +291,8 @@ class ItemsController < ApplicationController
   def move_multi
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_item].nil? or params[:thetisBoxSelKeeper].nil?
       list
       render(:action => 'list')
@@ -296,6 +302,7 @@ class ItemsController < ApplicationController
     is_admin = @login_user.admin?(User::AUTH_ITEM)
 
     folder_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([folder_id])
 
     unless Folder.check_user_auth(folder_id, @login_user, 'w', true)
       flash[:notice] = 'ERROR:' + t('folder.need_auth_to_write_in')
@@ -316,6 +323,7 @@ class ItemsController < ApplicationController
           item.update_attribute(:folder_id, folder_id)
 
         rescue => evar
+          item = nil
           Log.add_error(request, evar)
         end
 
@@ -335,6 +343,8 @@ class ItemsController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       Item.destroy(params[:id])
     rescue => evar
@@ -360,6 +370,8 @@ class ItemsController < ApplicationController
   def destroy_multi
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_item].nil?
       list
       render(:action => 'list')
@@ -400,6 +412,8 @@ class ItemsController < ApplicationController
   def duplicate
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     copies_folder = ItemsHelper.get_copies_folder(@login_user.id)
 
     item = Item.find(params[:id])
@@ -429,6 +443,8 @@ class ItemsController < ApplicationController
   def set_workflow
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @item = Item.find(params[:id])
 
     orders_hash = params.dup
@@ -441,8 +457,10 @@ class ItemsController < ApplicationController
 
     orders = []
     orders_hash.each do |key, value|
+      user_ids = value.split(',')
+      SqlHelper.validate_token([user_ids])
 
-      orders << '|' + value.split(',').join('|') + '|'
+      orders << '|' + user_ids.join('|') + '|'
     end
     @item.workflow.update_attribute(:users, orders.join(','))
 
@@ -466,6 +484,8 @@ class ItemsController < ApplicationController
   def set_basic
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:item][:xtype] == Item::XTYPE_ZEPTAIR_DIST \
         and !@login_user.admin?(User::AUTH_ZEPTAIR)
       render(:text => t('msg.need_to_be_admin'))
@@ -580,7 +600,9 @@ class ItemsController < ApplicationController
   def set_description
     Log.add_info(request, params.inspect)
 
-    if params[:id].nil? or params[:id].empty?
+    return unless request.post?
+
+    if params[:id].blank?
       @item = Item.new_info(0)
       @item.attributes = params.require(:item).permit(Item::PERMIT_BASE)
       @item.user_id = @login_user.id
@@ -625,11 +647,13 @@ class ItemsController < ApplicationController
   def set_image
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     created = false
 
-    if params[:id].nil? or params[:id].empty?
+    if params[:id].blank?
       @item = Item.new_info(0)
-      @item.attributes = params[:item]
+      @item.attributes = params.require(:item).permit(Item::PERMIT_BASE)
       @item.user_id = @login_user.id
       @item.title = t('paren.no_title')
 
@@ -709,6 +733,8 @@ class ItemsController < ApplicationController
   def delete_image
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       image = Image.find(params[:image_id])
 
@@ -759,6 +785,8 @@ class ItemsController < ApplicationController
   def update_image_info
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     image = Image.find(params[:image_id])
 
     # Getting Item at first for the case of resetting the db connection by an error.
@@ -799,6 +827,8 @@ class ItemsController < ApplicationController
   def update_images_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:images_order]
 
     item = Item.find(params[:id])
@@ -811,7 +841,7 @@ class ItemsController < ApplicationController
       img.update_attribute(:xorder, order_ary.index(img.id.to_s) + 1)
 
       class << img
-        remove_method :record_timestamps
+        remove_method(:record_timestamps)
       end
     end
 
@@ -834,11 +864,13 @@ class ItemsController < ApplicationController
   def set_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     created = false
 
-    if params[:id].nil? or params[:id].empty?
+    if params[:id].blank?
       @item = Item.new_info(0)
-      @item.attributes = params[:item]
+      @item.attributes = params.require(:item).permit(Item::PERMIT_BASE)
       @item.user_id = @login_user.id
       @item.title = t('paren.no_title')
 
@@ -894,7 +926,7 @@ class ItemsController < ApplicationController
       return
     end
 
-    parent_item = attach.item || ((attach.comment.nil?) ? nil : attach.comment.item)
+    parent_item = (attach.item || ((attach.comment.nil?) ? nil : attach.comment.item))
     if parent_item.nil? or !parent_item.check_user_auth(@login_user, 'r', true)
       Log.add_check(request, '[Item.check_user_auth]'+request.to_s)
       redirect_to(:controller => 'frames', :action => 'http_error', :id => '401')
@@ -936,6 +968,8 @@ class ItemsController < ApplicationController
   def delete_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       attach = Attachment.find(params[:attachment_id])
 
@@ -986,6 +1020,8 @@ class ItemsController < ApplicationController
   def update_attachment_info
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     attachment = Attachment.find(params[:attachment_id])
 
     # Getting Item at first for the case of resetting the db connection by an error.
@@ -1026,6 +1062,8 @@ class ItemsController < ApplicationController
   def update_attachments_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:attachments_order]
 
     item = Item.find(params[:id])
@@ -1038,7 +1076,7 @@ class ItemsController < ApplicationController
       attach.update_attribute(:xorder, order_ary.index(attach.id.to_s) + 1)
 
       class << attach
-        remove_method :record_timestamps
+        remove_method(:record_timestamps)
       end
     end
 
@@ -1061,6 +1099,8 @@ class ItemsController < ApplicationController
   def add_comment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:comment][:file].nil?
       attach_params = { :file => params[:comment][:file] }
       params[:comment].delete(:file)
@@ -1110,6 +1150,8 @@ class ItemsController < ApplicationController
   def update_comment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:thetisBoxEdit].empty?
       @comment = Comment.find(params[:comment_id])
       if @comment.nil?
@@ -1132,6 +1174,8 @@ class ItemsController < ApplicationController
   def destroy_comment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     comment = Comment.find(params[:comment_id])
     @item = comment.item
 
@@ -1168,6 +1212,8 @@ class ItemsController < ApplicationController
   def add_comment_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:comment_file].nil?
       attach_params = { :file => params[:comment_file] }
       params.delete(:comment_file)
@@ -1191,6 +1237,8 @@ class ItemsController < ApplicationController
   def delete_comment_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       attachment = Attachment.find(params[:attachment_id])
       @comment = Comment.find(params[:comment_id])
@@ -1235,7 +1283,9 @@ class ItemsController < ApplicationController
   def wf_issue
     Log.add_info(request, params.inspect)
 
-   begin
+    return unless request.post?
+
+    begin
       @item = Item.find(params[:id])
       @workflow = @item.workflow
     rescue => evar
@@ -1258,17 +1308,18 @@ class ItemsController < ApplicationController
   def team_organize
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     team_id = params[:team_id]
     unless team_id.blank?
       begin
         @team = Team.find(team_id)
       rescue
         @team = nil
-      ensure
-        if @team.nil?
-          flash[:notice] = t('msg.already_deleted', :name => Team.model_name.human)
-          return
-        end
+      end
+      if @team.nil?
+        flash[:notice] = t('msg.already_deleted', :name => Team.model_name.human)
+        return
       end
 
       users = @team.get_users_a
@@ -1284,7 +1335,8 @@ class ItemsController < ApplicationController
 
       unless team_id.blank?
         # @team must not be nil.
-        @team.save if modified = @team.clear_users
+        modified = @team.clear_users
+        @team.save if modified
       end
 
     else
@@ -1300,9 +1352,7 @@ class ItemsController < ApplicationController
           @team.name = item.title
           @team.item_id = params[:id]
           @team.status = Team::STATUS_STANDBY
-
         else
-
           @team.clear_users
         end
 
@@ -1338,6 +1388,8 @@ class ItemsController < ApplicationController
   def move_in_team_folder
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @item = Item.find(params[:id])
 
     team_folder = @item.team.get_team_folder
@@ -1361,6 +1413,8 @@ class ItemsController < ApplicationController
   def change_team_status
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     SqlHelper.validate_token([params[:status]])
 
     team_id = params[:team_id]

programming_language: Ruby
filename: locations_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -142,6 +142,8 @@ class LocationsController < ApplicationController
   def update_map
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     group_id = params[:group_id]
     SqlHelper.validate_token([group_id])
 
@@ -164,6 +166,8 @@ class LocationsController < ApplicationController
   def delete_map
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     group_id = params[:group_id]
     SqlHelper.validate_token([group_id])
 
@@ -189,6 +193,10 @@ class LocationsController < ApplicationController
   def drop_on_exit
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:id]])
+
     unless @login_user.nil?
       Location.destroy(params[:id])
     end
@@ -204,9 +212,12 @@ class LocationsController < ApplicationController
   def on_moved
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     location_id = params[:id]
+    SqlHelper.validate_token([location_id])
 
-    if location_id.nil? or location_id.empty?
+    if location_id.blank?
       location = Location.get_for(@login_user)
       if location.nil?
         location = Location.new
@@ -216,12 +227,14 @@ class LocationsController < ApplicationController
       begin
         location = Location.find(location_id)
       rescue
+        location = nil
       end
     end
 
     unless location.nil?
       group_id = params[:group_id]
       group_id = nil if group_id.empty?
+      SqlHelper.validate_token([group_id])
       attrs = ActionController::Parameters.new({group_id: group_id, x: params[:x], y: params[:y]})
       location.update_attributes(attrs.permit(Location::PERMIT_BASE))
     end
@@ -235,7 +248,7 @@ class LocationsController < ApplicationController
   #Filter method to check if current User is owner of the specified Location.
   #
   def check_owner
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     begin
       owner_id = Location.find(params[:id]).user_id

programming_language: Ruby
filename: login_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -37,7 +37,7 @@ class LoginController < ApplicationController
 
       flash[:notice] = '<span class=\'font_msg_bold\'>'+t('user.u_name')+'</span>'+t('msg.or')+'<span class=\'font_msg_bold\'>'+t('password.name')+'</span>'+t('msg.is_invalid')
 
-      if params[:fwd_controller].nil? or params[:fwd_controller].empty?
+      if params[:fwd_controller].blank?
 
         redirect_to(:controller => 'login', :action => 'index')
       else
@@ -57,7 +57,7 @@ class LoginController < ApplicationController
 
       @login_user = LoginHelper.on_login(user, session)
 
-      if params[:fwd_controller].nil? or params[:fwd_controller].empty?
+      if params[:fwd_controller].blank?
         prms = ApplicationHelper.get_fwd_params(params)
         prms.delete('user')
         prms[:controller] = 'desktop'

programming_language: Ruby
filename: logs_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -112,6 +112,9 @@ class LogsController < ApplicationController
   #Deletes Logs.
   #
   def destroy
+
+    return unless request.post?
+
     if params[:check_log].nil?
       list
       render(:action => 'list')
@@ -137,6 +140,8 @@ class LogsController < ApplicationController
   #
   def destroy_all
 
+    return unless request.post?
+
     Log.delete_all
 
     flash[:notice] = t('msg.delete_success')

programming_language: Ruby
filename: mail_accounts_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -34,6 +34,8 @@ class MailAccountsController < ApplicationController
   def create
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     if params[:mail_account][:smtp_auth].nil? or params[:mail_account][:smtp_auth] != '1'
       params[:mail_account].delete(:smtp_username)
       params[:mail_account].delete(:smtp_password)
@@ -90,6 +92,8 @@ class MailAccountsController < ApplicationController
   def update
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     @mail_account = MailAccount.find(params[:id])
 
     if params[:mail_account][:smtp_auth].nil? or params[:mail_account][:smtp_auth] != '1'
@@ -129,6 +133,7 @@ class MailAccountsController < ApplicationController
     Log.add_info(request, params.inspect)
 
     mail_account_id = params[:id]
+    SqlHelper.validate_token([mail_account_id])
 
     begin
       @mail_account = MailAccount.find(mail_account_id)
@@ -182,7 +187,7 @@ class MailAccountsController < ApplicationController
   #
   def check_owner
 
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     mail_account = MailAccount.find(params[:id])
 

programming_language: Ruby
filename: mail_filters_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2012 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -131,6 +131,8 @@ class MailFiltersController < ApplicationController
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     attrs = params[:mail_filter]
     if attrs['and_or'] == 'none'
       attrs['and_or'] = nil
@@ -194,6 +196,8 @@ class MailFiltersController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_filter].nil?
       list
       render(:action => 'list', :layout => !request.xhr?)
@@ -208,6 +212,7 @@ class MailFiltersController < ApplicationController
           filter = MailFilter.find(filter_id)
           filter.destroy if filter.editable?(@login_user)
         rescue => evar
+          filter = nil
           Log.add_error(request, evar)
         end
 
@@ -228,6 +233,8 @@ class MailFiltersController < ApplicationController
   def do_execute
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     mail_account = MailAccount.find(params[:mail_account_id])
     mail_folder = MailFolder.find(params[:mail_folder_id])
 
@@ -288,6 +295,8 @@ class MailFiltersController < ApplicationController
   def update_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     mail_account_id = params[:mail_account_id]
     order_arr = params[:mail_filters_order]
 
@@ -358,7 +367,7 @@ class MailFiltersController < ApplicationController
   #
   def check_owner
 
-    return if (params[:id].nil? or params[:id].empty? or @login_user.nil?)
+    return if (params[:id].blank? or @login_user.nil?)
 
     mail_filter = MailFilter.find(params[:id])
 

programming_language: Ruby
filename: mail_folders_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -76,9 +76,11 @@ class MailFoldersController < ApplicationController
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     parent_id = params[:selectedFolderId]
 
-    if params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    if params[:thetisBoxEdit].blank?
       @mail_folder = nil
     else
       @mail_folder = MailFolder.new
@@ -100,9 +102,11 @@ class MailFoldersController < ApplicationController
   def rename
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @mail_folder = MailFolder.find(params[:id])
 
-    unless params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    unless params[:thetisBoxEdit].blank?
       @mail_folder.name = params[:thetisBoxEdit]
       @mail_folder.save
     end
@@ -117,7 +121,10 @@ class MailFoldersController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     mail_account_id = params[:mail_account_id]
+    SqlHelper.validate_token([mail_account_id])
 
     mail_folder = MailFolder.find(params[:id])
     trash_folder = MailFolder.get_for(@login_user, mail_account_id, MailFolder::XTYPE_TRASH)
@@ -151,6 +158,8 @@ class MailFoldersController < ApplicationController
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @mail_folder = MailFolder.find(params[:id])
 
     if params[:thetisBoxSelKeeper].blank?
@@ -161,6 +170,7 @@ class MailFoldersController < ApplicationController
     end
 
     parent_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([parent_id])
 
     if parent_id == '0'   # '0' for ROOT
       flash[:notice] = 'ERROR:' + t('mail_folder.root_cannot_have_folders')
@@ -198,10 +208,13 @@ class MailFoldersController < ApplicationController
     end
 
     if !params[:pop].nil? and params[:pop] == 'true'
+
+      mail_account_id = params[:mail_account_id]
+      SqlHelper.validate_token([mail_account_id])
+
       begin
         new_arrivals_h = {}
 
-        mail_account_id = params[:mail_account_id]
         if mail_account_id.blank?
           mail_accounts = MailAccount.find_all("user_id=#{@login_user.id}")
           mail_accounts.each do |mail_account|
@@ -249,6 +262,8 @@ class MailFoldersController < ApplicationController
     end
 
     @folder_id = params[:id]
+    SqlHelper.validate_token([@folder_id])
+
     if @folder_id == TreeElement::ROOT_ID.to_s
       @emails = nil
     else
@@ -258,13 +273,9 @@ class MailFoldersController < ApplicationController
 # FEATURE_PAGING_IN_TREE >>>
       @sort_col = (params[:sort_col] || 'sent_at')
       @sort_type = (params[:sort_type] || 'DESC')
+      SqlHelper.validate_token([@sort_col, @sort_type])
 
-      folder_ids = nil
-      add_con = nil
-
-      folder_ids = [@folder_id]
-
-      sql = EmailsHelper.get_list_sql(@login_user, params[:keyword], folder_ids, @sort_col, @sort_type, 0, add_con)
+      sql = EmailsHelper.get_list_sql(@login_user, params[:keyword], [@folder_id], @sort_col, @sort_type, 0, nil)
       @email_pages, @emails, @total_num = paginate_by_sql(Email, sql, 10)
 # FEATURE_PAGING_IN_TREE <<<
     end
@@ -282,10 +293,10 @@ class MailFoldersController < ApplicationController
   def get_mail_content
     Log.add_info(request, params.inspect)
 
-    mail_id = params[:id]
+    email_id = params[:id]
 
     begin
-      @email = Email.find(mail_id)
+      @email = Email.find(email_id)
       render(:partial => 'ajax_mail_content', :layout => false)
     rescue => evar
       Log.add_error(nil, evar)
@@ -400,14 +411,16 @@ class MailFoldersController < ApplicationController
   def empty
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder_id = params[:id]
     mail_account_id = params[:mail_account_id]
-    SqlHelper.validate_token([mail_account_id])
+    SqlHelper.validate_token([@folder_id, mail_account_id])
 
     trash_folder = MailFolder.get_for(@login_user, mail_account_id, MailFolder::XTYPE_TRASH)
 
     mail_folder = MailFolder.find(@folder_id)
-    emails = MailFolder.get_mails(mail_folder.id, @login_user) || []
+    emails = (MailFolder.get_mails(mail_folder.id, @login_user) || [])
 
     if mail_folder.id == trash_folder.id \
         or mail_folder.get_parents(false).include?(trash_folder.id.to_s)
@@ -433,8 +446,11 @@ class MailFoldersController < ApplicationController
   def ajax_delete_mails
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     folder_id = params[:id]
     mail_account_id = params[:mail_account_id]
+    SqlHelper.validate_token([folder_id, mail_account_id])
 
     unless params[:check_mail].blank?
       mail_folder = MailFolder.find(folder_id)
@@ -481,6 +497,8 @@ class MailFoldersController < ApplicationController
   def ajax_move_mails
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     folder_id = params[:thetisBoxSelKeeper].split(':').last
     SqlHelper.validate_token([folder_id])
     begin
@@ -529,6 +547,7 @@ class MailFoldersController < ApplicationController
     Log.add_info(request, params.inspect)
 
     @folder_id = params[:id]
+    SqlHelper.validate_token([@folder_id])
 
     if @folder_id == '0'
       @folders = MailFolder.get_account_roots_for(@login_user)
@@ -540,10 +559,6 @@ class MailFoldersController < ApplicationController
     end
 
     render(:partial => 'ajax_folders_order', :layout => false)
-
-  rescue => evar
-    Log.add_error(request, evar)
-    render(:partial => 'ajax_folders_order', :layout => false)
   end
 
   #=== update_folders_order
@@ -554,6 +569,8 @@ class MailFoldersController < ApplicationController
   def update_folders_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_arr = params[:folders_order]
 
     SqlHelper.validate_token([params[:id]])
@@ -605,6 +622,8 @@ class MailFoldersController < ApplicationController
   def update_mail_unread
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     email_id = params[:email_id]
     unread = (params[:unread] == "1")
 
@@ -653,7 +672,7 @@ class MailFoldersController < ApplicationController
   #Filter method to check if current User is owner of the specified Email.
   #
   def check_mail_owner
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     begin
       owner_id = Email.find(params[:id]).user_id

programming_language: Ruby
filename: official_titles_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2013 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -27,8 +27,9 @@ class OfficialTitlesController < ApplicationController
 
     @group_id = params[:group_id]
     official_title_id = params[:id]
+    SqlHelper.validate_token([@group_id, official_title_id])
 
-    unless official_title_id.nil? or official_title_id.empty?
+    unless official_title_id.blank?
       @official_title = OfficialTitle.find(official_title_id)
     end
 
@@ -44,8 +45,9 @@ class OfficialTitlesController < ApplicationController
 
     @group_id = params[:group_id]
     official_title_id = params[:id]
+    SqlHelper.validate_token([@group_id, official_title_id])
 
-    unless official_title_id.nil? or official_title_id.empty?
+    unless official_title_id.blank?
       @official_title = OfficialTitle.find(official_title_id)
     end
 
@@ -59,8 +61,11 @@ class OfficialTitlesController < ApplicationController
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @group_id = params[:group_id]
     official_title_id = params[:id]
+    SqlHelper.validate_token([@group_id, official_title_id])
 
     if official_title_id.blank?
       @official_title = OfficialTitle.new(params.require(:official_title).permit(OfficialTitle::PERMIT_BASE))
@@ -85,6 +90,8 @@ class OfficialTitlesController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       OfficialTitle.destroy(params[:id])
     rescue => evar
@@ -92,8 +99,9 @@ class OfficialTitlesController < ApplicationController
     end
 
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@group_id])
 
-    if @group_id.nil? or @group_id.empty?
+    if @group_id.blank?
       @group_id = '0'   # '0' for ROOT
     end
 
@@ -108,9 +116,13 @@ class OfficialTitlesController < ApplicationController
   def update_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:official_titles_order]
 
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@group_id])
+
     parent_titles = OfficialTitle.get_for(Group.find(@group_id).parent_id, true, true)
     order_offset = parent_titles.length
 

programming_language: Ruby
filename: paintmail_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -33,6 +33,8 @@ class PaintmailController < ApplicationController
   def save_conf
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     unless @login_user.nil?
 
       if @login_user.paintmail.nil?

programming_language: Ruby
filename: researches_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -96,6 +96,8 @@ class ResearchesController < ApplicationController
   def create_q_page
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @tmpl_folder, @tmpl_q_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_RESEARCH)
 
     unless @tmpl_q_folder.nil?
@@ -130,6 +132,8 @@ class ResearchesController < ApplicationController
   def destroy_q_page
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       Item.find(params[:id]).destroy
     rescue
@@ -151,6 +155,8 @@ class ResearchesController < ApplicationController
   def update_q_ctrl
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     item_id = params[:item_id]
     q_code = params[:q_code]
     q_param = params[:q_param]
@@ -163,7 +169,7 @@ class ResearchesController < ApplicationController
 
     yaml[q_code] = {:item_id => item_id, :type => type, :values => vals, :caption => cap.to_s }
 
-    Research.save_config_yaml yaml
+    Research.save_config_yaml(yaml)
 
     render(:text => '')
 
@@ -180,6 +186,8 @@ class ResearchesController < ApplicationController
   def reset_q_ctrl
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     Research.trim_config_yaml nil
 
     settings
@@ -216,23 +224,26 @@ class ResearchesController < ApplicationController
   def add_statistics_group
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     current_id = params[:current_id]
 
-    if !params[:thetisBoxSelKeeper].nil?
+    unless params[:thetisBoxSelKeeper].nil?
       group_id = params[:thetisBoxSelKeeper].split(':').last
     end
+    SqlHelper.validate_token([current_id, group_id])
 
-    if group_id.nil? or group_id.empty?
-      @group_ids = Research.get_statistics_groups 
+    if group_id.blank?
+      @group_ids = Research.get_statistics_groups
       render(:partial => 'ajax_statistics_groups', :layout => false)
       return
     end
 
-    unless current_id.nil? or current_id.empty?
-      Research.delete_statistics_group current_id
+    unless current_id.blank?
+      Research.delete_statistics_group(current_id)
     end
 
-    @group_ids = Research.add_statistics_group group_id
+    @group_ids = Research.add_statistics_group(group_id)
 
     render(:partial => 'ajax_statistics_groups', :layout => false)
   end
@@ -245,15 +256,18 @@ class ResearchesController < ApplicationController
   def delete_statistics_group
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     group_id = params[:group_id]
+    SqlHelper.validate_token([group_id])
 
-    if group_id.nil? or group_id.empty?
+    if group_id.blank?
       @group_ids = Research.get_statistics_groups 
       render(:partial => 'ajax_statistics_groups', :layout => false)
       return
     end
 
-    @group_ids = Research.delete_statistics_group group_id
+    @group_ids = Research.delete_statistics_group(group_id)
 
     render(:partial => 'ajax_statistics_groups', :layout => false)
   end
@@ -266,9 +280,11 @@ class ResearchesController < ApplicationController
   def update_groups_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:groups_order]
 
-    Research.set_statistics_groups order_ary
+    Research.set_statistics_groups(order_ary)
 
     render(:text => '')
   end
@@ -281,6 +297,8 @@ class ResearchesController < ApplicationController
   def start
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     tmpl_folder, tmpl_q_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_RESEARCH)
 
     if tmpl_q_folder.nil?
@@ -345,6 +363,8 @@ class ResearchesController < ApplicationController
   def stop
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     ApplicationHelper.delete_file_safe(Research.get_pages)
     render(:text => '')
 
@@ -361,6 +381,8 @@ class ResearchesController < ApplicationController
   def reset
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     Research.delete_all
 
     render(:text => '')
@@ -377,14 +399,17 @@ class ResearchesController < ApplicationController
   def reset_users
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     count = 0
 
     unless params[:check_user].nil?
 
       params[:check_user].each do |user_id, value|
         if value == '1'
+          SqlHelper.validate_token([user_id])
           begin
-            Research.destroy_all('user_id=' + user_id.to_s)
+            Research.destroy_all("user_id=#{user_id.to_i}")
             count += 1
           rescue => evar
             Log.add_error(request, evar)
@@ -447,6 +472,8 @@ class ResearchesController < ApplicationController
   def save_page
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     # Next page
     pave_val = params[:page].to_i + 1
     @page = sprintf('%02d', pave_val)
@@ -523,6 +550,8 @@ class ResearchesController < ApplicationController
   def do_confirm
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @research = Research.find(params[:research_id])
     @research.update_attribute(:status, Research::U_STATUS_COMMITTED)
 
@@ -619,6 +648,8 @@ class ResearchesController < ApplicationController
   def notify
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     root_url = ApplicationHelper.root_url(request)
     count = UsersHelper.send_notification(params[:check_user], params[:thetisBoxEdit], root_url)
 

programming_language: Ruby
filename: schedules_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2013 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -45,6 +45,8 @@ class SchedulesController < ApplicationController
   def add_holidays
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     holidays = params[:thetisBoxEdit]
     unless holidays.nil?
       holidays.split("\n").each do |holiday|
@@ -83,8 +85,11 @@ class SchedulesController < ApplicationController
   def delete_holidays
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     holidays = params[:holidays]
     unless holidays.nil?
+      SqlHelper.validate_token([holidays])
       holidays.each do |schedule_id|
         Schedule.destroy(schedule_id)
       end
@@ -115,6 +120,8 @@ class SchedulesController < ApplicationController
   def save
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     date = Date.parse(params[:date])
 
     unless params[:id].blank?
@@ -149,6 +156,7 @@ class SchedulesController < ApplicationController
       schedule.destroy unless schedule.nil?
     else
       [:users, :groups, :teams, :items].each do |attr|
+        SqlHelper.validate_token([params[attr]])
         if params[attr].blank?
           params[:schedule][attr] = nil
         else
@@ -163,7 +171,11 @@ class SchedulesController < ApplicationController
         params[:schedule][:equipment] = nil
       else
         equipment_ids.each do |equipment_id|
-          equipment = Equipment.find(equipment_id)
+          begin
+            equipment = Equipment.find(equipment_id)
+          rescue => evar
+            equipment = nil
+          end
           if equipment.nil? or !equipment.is_accessible_by(@login_user)
             flash[:notice] = 'ERROR:' + t('msg.need_auth_to_access') + t('cap.suffix') + Equipment.get_name(equipment_id)
             redirect_to(:action => 'day', :date => params[:date])
@@ -203,7 +215,7 @@ class SchedulesController < ApplicationController
       if nearest_day.nil?
         check_schedule.id = params[:id].to_i unless params[:id].nil? or params[:id].empty?
         flash[:notice] = 'ERROR:' + t('schedule.no_day_in_rule')
-        if params[:fwd_controller].nil? or params[:fwd_controller].empty?
+        if params[:fwd_controller].blank?
           self.index
         else
           prms = ApplicationHelper.get_fwd_params(params)
@@ -325,6 +337,8 @@ class SchedulesController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @date = Date.parse(params[:date])
 
     begin
@@ -513,7 +527,7 @@ class SchedulesController < ApplicationController
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)
@@ -530,7 +544,7 @@ class SchedulesController < ApplicationController
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)
@@ -604,13 +618,14 @@ class SchedulesController < ApplicationController
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)
     end
 
     @group_id = params[:id]
+    SqlHelper.validate_token([@group_id, params[:id]])
     group_users = Group.get_users(params[:id])
 
     @user_schedule_hash = {}
@@ -632,7 +647,7 @@ class SchedulesController < ApplicationController
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)
@@ -737,7 +752,7 @@ class SchedulesController < ApplicationController
   def get_folder_items
     Log.add_info(request, params.inspect)
 
-    unless params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
+    unless params[:thetisBoxSelKeeper].blank?
       @folder_id = params[:thetisBoxSelKeeper].split(':').last
     end
 

programming_language: Ruby
filename: send_mails_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -29,8 +29,9 @@ class SendMailsController < ApplicationController
 
     mail_account_id = params[:mail_account_id]
 
-    if mail_account_id.nil? or mail_account_id.empty?
+    if mail_account_id.blank?
       account_xtype = params[:mail_account_xtype]
+      SqlHelper.validate_token([account_xtype])
       @mail_account = MailAccount.get_default_for(@login_user.id, account_xtype)
     else
       @mail_account = MailAccount.find(mail_account_id)
@@ -171,6 +172,8 @@ class SendMailsController < ApplicationController
   def do_send
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       email = Email.find(params[:id])
 
@@ -207,6 +210,8 @@ class SendMailsController < ApplicationController
   def save
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:attach_file].nil?
       attach_attrs = { :file => params[:attach_file] }
       params.delete(:attach_file)
@@ -258,6 +263,8 @@ class SendMailsController < ApplicationController
   def add_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:attach_file].nil?
       attach_attrs = ActionController::Parameters.new({file: params[:attach_file]})
       params.delete(:attach_file)
@@ -332,6 +339,8 @@ class SendMailsController < ApplicationController
   def delete_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       attachment = MailAttachment.find(params[:attachment_id])
       @email = Email.find(params[:id])

programming_language: Ruby
filename: teams_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -100,6 +100,8 @@ class TeamsController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       team = Team.find(params[:id])
       Item.destroy(team.item_id)
@@ -119,7 +121,7 @@ class TeamsController < ApplicationController
   #
   def check_member
 
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     if Item.find(params[:id]).user_id != @login_user.id
       Log.add_check(request, '[check_member]'+request.to_s)

programming_language: Ruby
filename: templates_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -48,11 +48,14 @@ class TemplatesController < ApplicationController
   def create_workflow
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @tmpl_folder, @tmpl_workflows_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_WORKFLOWS)
 
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@group_id])
 
-    if @group_id.nil? or @group_id.empty?
+    if @group_id.blank?
       @group_id = '0'   # '0' for ROOT
     elsif @group_id == '0'
       ;
@@ -99,13 +102,16 @@ class TemplatesController < ApplicationController
   def destroy_workflow
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     Item.find(params[:id]).destroy
 
     @tmpl_folder, @tmpl_workflows_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_WORKFLOWS)
 
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@group_id])
 
-    if @group_id.nil? or @group_id.empty?
+    if @group_id.blank?
       @group_id = '0'   # '0' for ROOT
     end
 
@@ -120,6 +126,8 @@ class TemplatesController < ApplicationController
   def create_local
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @tmpl_folder, @tmpl_local_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_LOCAL)
 
     unless @tmpl_local_folder.nil?
@@ -142,6 +150,8 @@ class TemplatesController < ApplicationController
   def destroy_local
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       Item.find(params[:id]).destroy
     rescue
@@ -160,6 +170,8 @@ class TemplatesController < ApplicationController
   def copy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     tmpl_id = params[:thetisBoxSelKeeper].split(':').last
     tmpl_item = Item.find(tmpl_id)
 

programming_language: Ruby
filename: timecards_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -55,7 +55,7 @@ class TimecardsController < ApplicationController
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       date = Date.today
     else
       date_params = date_s.split('-')
@@ -64,7 +64,7 @@ class TimecardsController < ApplicationController
         @month = date_params.last.to_i
         date = TimecardsHelper.get_first_day_in_fiscal_month(@year, @month, month_begins_at)
       else
-        date = Date.parse date_s
+        date = Date.parse(date_s)
       end
     end
 
@@ -152,7 +152,9 @@ class TimecardsController < ApplicationController
   def update
     Log.add_info(request, params.inspect)
 
-    if params[:id].nil? or params[:id].empty?
+    return unless request.post?
+
+    if params[:id].blank?
       @timecard = Timecard.new
     else
       @timecard = Timecard.find(params[:id])
@@ -165,9 +167,9 @@ class TimecardsController < ApplicationController
       params[:timecard]['options'] = '|' + options.join('|') + '|'
     end
 
-    if params[:user_id].nil? or params[:user_id].empty?
+    if params[:user_id].blank?
       @selected_user = @login_user
-    elsif @login_user.id.to_s == params[:user_id]
+    elsif (@login_user.id.to_s == params[:user_id])
       @selected_user = @login_user
     else
       unless @login_user.admin?(User::AUTH_TIMECARD)
@@ -189,12 +191,12 @@ class TimecardsController < ApplicationController
       unless breaks.empty?
         check_error = false
 
-        unless params[:timecard]['start'].nil? or params[:timecard]['start'].empty?
+        unless params[:timecard]['start'].blank?
           start_t = UtilDateTime.parse(params[:timecard]['start']).to_time
           check_error = true if breaks.first.first < start_t
         end
 
-        unless params[:timecard]['end'].nil? or params[:timecard]['end'].empty?
+        unless params[:timecard]['end'].blank?
           end_t = UtilDateTime.parse(params[:timecard]['end']).to_time
           check_error = true if end_t < breaks.last.last
         end
@@ -237,6 +239,8 @@ class TimecardsController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       timecard = Timecard.find(params[:id])
 
@@ -283,6 +287,8 @@ class TimecardsController < ApplicationController
   def update_break
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:user_id].nil?
       @selected_user = User.find(params[:user_id])
 
@@ -348,6 +354,8 @@ class TimecardsController < ApplicationController
   def delete_break
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @timecard = Timecard.find(params[:id])
 
     if params[:org_start].nil?
@@ -380,11 +388,11 @@ class TimecardsController < ApplicationController
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
       date_s = @date.strftime(Schedule::SYS_DATE_FORM)
     else
-      @date = Date.parse date_s
+      @date = Date.parse(date_s)
     end
 
     if params[:display] == 'mine'
@@ -392,6 +400,7 @@ class TimecardsController < ApplicationController
     else
       display_type = params[:display].split('_').first
       display_id = params[:display].split('_').last
+      SqlHelper.validate_token([display_id])
 
       @selected_users = Group.get_users(display_id)
       @group_id = display_id
@@ -510,6 +519,8 @@ class TimecardsController < ApplicationController
   def paidhld_update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     year = params[:year].to_i
     num = params[:num].to_f
 
@@ -536,11 +547,15 @@ class TimecardsController < ApplicationController
   def paidhld_update_multi
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     year = params[:year].to_i
     num = params[:num].to_f
 
     group_id = params[:group_id]
     users_hash = (params[:check_user] || {})
+    SqlHelper.validate_token([group_id, users_hash.keys])
+
     done = false
     users_hash.each do |user_id, value|
       if value == '1'
@@ -604,9 +619,11 @@ class TimecardsController < ApplicationController
   def update_config
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     yaml = ApplicationHelper.get_config_yaml
 
-    unless params[:timecard].nil? or params[:timecard].empty?
+    unless params[:timecard].blank?
       yaml[:timecard] = Hash.new if yaml[:timecard].nil?
       
       params[:timecard].each do |key, val|
@@ -630,6 +647,8 @@ class TimecardsController < ApplicationController
   def update_default_break
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     start_t = Time.local(2000, 1, 1, params[:start_hour].to_i, params[:start_min].to_i)
     end_t = Time.local(2000, 1, 1, params[:end_hour].to_i, params[:end_min].to_i)
 
@@ -690,6 +709,8 @@ class TimecardsController < ApplicationController
   def delete_default_break
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:org_start].nil?
       org_start = UtilDateTime.parse(params[:org_start]).to_time
 

programming_language: Ruby
filename: users_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -48,6 +48,8 @@ class UsersController < ApplicationController
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     attrs = _process_user_attrs(nil, params[:user])
     password = attrs[:password]
     attrs.delete(:password)
@@ -114,6 +116,8 @@ class UsersController < ApplicationController
   def update
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     @user = User.find(params[:id])
 
     attrs = _process_user_attrs(@user, params[:user])
@@ -235,6 +239,8 @@ class UsersController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_user].nil?
       list
       render(:action => 'list')
@@ -244,7 +250,7 @@ class UsersController < ApplicationController
     count = 0
     params[:check_user].each do |user_id, value|
       if value == '1'
-
+        SqlHelper.validate_token([user_id])
         begin
           User.destroy(user_id)
         rescue => evar
@@ -288,6 +294,8 @@ class UsersController < ApplicationController
   def add_official_titles
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @user = User.find(params[:user_id])
 
     unless params[:official_titles].nil?
@@ -313,6 +321,8 @@ class UsersController < ApplicationController
   def remove_official_titles
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @user = User.find(params[:user_id])
 
     unless params[:official_titles].nil?
@@ -335,6 +345,8 @@ class UsersController < ApplicationController
   def notify
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     root_url = ApplicationHelper.root_url(request)
     count = UsersHelper.send_notification(params[:check_user], params[:thetisBoxEdit], root_url)
 
@@ -370,21 +382,15 @@ class UsersController < ApplicationController
       end
 
       if auth_selected.nil? or !auth_selected.include?(User::AUTH_USER)
-
         user_admin_err = false
-
         user_admins = User.where("auth like '%|#{User::AUTH_USER}|%' or auth='#{User::AUTH_ALL}'").to_a
 
         if user_admins.nil? or user_admins.empty?
-
           user_admin_err = true
-
         elsif user_admins.length == 1
-
           if user_admins.first.id.to_s == params[:id]
             user_admin_err = true
           end
-
         end
 
         if user_admin_err
@@ -392,7 +398,6 @@ class UsersController < ApplicationController
           return
         end
       end
-
     end
 
     begin
@@ -402,16 +407,13 @@ class UsersController < ApplicationController
     end
 
     if user.nil?
-
       render(:text => t('msg.already_deleted', :name => User.model_name.human))
     else
-
       user.update_attribute(:auth, auth)
 
       if user.id == @login_user.id
         @login_user = user
       end
-
       render(:text => '')
     end
   end
@@ -426,7 +428,9 @@ class UsersController < ApplicationController
   def add_to_group
     Log.add_info(request, params.inspect)
 
-    if params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
+    return unless request.post?
+
+    if params[:thetisBoxSelKeeper].blank?
       render(:partial => 'ajax_groups', :layout => false)
       return
     end
@@ -456,7 +460,7 @@ class UsersController < ApplicationController
       is_modified = false
 
       # Change, not simply Add
-      unless params[:current_id] == nil or params[:current_id].empty?
+      unless params[:current_id].blank?
         if @user.exclude_from(params[:current_id])
           is_modified = true
         end
@@ -465,7 +469,6 @@ class UsersController < ApplicationController
       is_modified = true if @user.add_to(group_id)
 
       if is_modified == true
-#        @user.update_attribute(:groups, @user.groups)
         @user.save!
 
         if @user.id == @login_user.id
@@ -485,7 +488,9 @@ class UsersController < ApplicationController
   def exclude_from_group
     Log.add_info(request, params.inspect)
 
-    if params[:group_id].nil? or params[:group_id].empty?
+    return unless request.post?
+
+    if params[:group_id].blank?
       render(:partial => 'ajax_groups', :layout => false)
       return
     end
@@ -518,6 +523,8 @@ class UsersController < ApplicationController
   def create_profile_sheet
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     user_id = params[:id]
     @user = User.find(user_id)
 
@@ -536,6 +543,8 @@ class UsersController < ApplicationController
   def destroy_profile_sheet
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     user_id = params[:id]
     @user = User.find(user_id)
     item_id = @user.item_id
@@ -573,6 +582,8 @@ class UsersController < ApplicationController
   def import_csv
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     file = params[:imp_file]
     mode = params[:mode]
     enc = params[:enc]
@@ -634,14 +645,10 @@ class UsersController < ApplicationController
     end
 
     if users.empty?
-
       @imp_errs[0] = [t('user.nothing_to_import')]
     else
-
       if mode == 'update'
-
         if found_update
-
           user_admin = users.find do |user|
             user.admin?(User::AUTH_USER)
           end
@@ -734,10 +741,12 @@ class UsersController < ApplicationController
   #
   def create_title
 
+    return unless request.post?
+
     titles = User.get_config_titles
     titles = [] if titles.nil?
     titles << t('user.new_title')
-    User.save_config_titles titles
+    User.save_config_titles(titles)
 
     render(:partial => 'ajax_title', :layout => false)
   end
@@ -750,6 +759,8 @@ class UsersController < ApplicationController
   def destroy_title
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     title = params[:title]
 
     titles = User.get_config_titles
@@ -778,6 +789,8 @@ class UsersController < ApplicationController
   def rename_title
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     org_title = params[:org_title]
     new_title = params[:new_title]
 
@@ -789,15 +802,12 @@ class UsersController < ApplicationController
     titles = User.get_config_titles
     unless titles.nil?
       if titles.include?(new_title)
-
         flash[:notice] = 'ERROR:' + t('user.title_duplicated')
-
       else
-
         idx = titles.index(org_title)
         unless idx.nil?
           titles[idx] = new_title
-          User.save_config_titles titles
+          User.save_config_titles(titles)
 
           User.rename_title(org_title, new_title)
           User.update_xorder(new_title, idx)
@@ -816,6 +826,8 @@ class UsersController < ApplicationController
   def update_titles_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     titles = params[:titles_order]
 
     org_order = User.get_config_titles
@@ -841,6 +853,8 @@ class UsersController < ApplicationController
   def update_zept_allowed
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     user = User.find(params[:id])
     zept_allowed = params[:zept_allowed]
 
@@ -884,7 +898,7 @@ class UsersController < ApplicationController
       user_name = attrs[:name]
       user_name ||= user.name unless user.nil?
       password = attrs[:password]
-      if password.nil? or password.empty?
+      if password.blank?
         password = UsersHelper.generate_password
         attrs[:password] = password
       end

programming_language: Ruby
filename: workflows_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -48,6 +48,8 @@ class WorkflowsController < ApplicationController
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     my_wf_folder = WorkflowsHelper.get_my_wf_folder(@login_user.id)
 
     tmpl_item = Item.find(params[:select_workflow])
@@ -77,6 +79,8 @@ class WorkflowsController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     workflow = Workflow.find(params[:id])
 
     begin
@@ -101,6 +105,8 @@ class WorkflowsController < ApplicationController
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:thetisBoxSelKeeper].nil?
       folder_id = params[:thetisBoxSelKeeper].split(':').last
       SqlHelper.validate_token([folder_id])
@@ -132,7 +138,7 @@ class WorkflowsController < ApplicationController
   #Filter method to check if the current User is owner of the specified Workflow.
   #
   def check_owner
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     begin
       owner_id = Workflow.find(params[:id]).user_id

programming_language: Ruby
filename: zeptair_dist_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -129,10 +129,12 @@ class ZeptairDistController < ApplicationController
   def reply
     Log.add_info(request, '')   # Not to show passwords.
 
-    unless params[:attach_id].nil? or params[:attach_id].empty?
+    return unless request.post?
+
+    unless params[:attach_id].blank?
       target = Attachment.find(params[:attach_id])
     end
-    unless params[:cmd_id].nil? or params[:cmd_id].empty?
+    unless params[:cmd_id].blank?
       target = ZeptairCommand.find(params[:cmd_id])
     end
     if target.nil? or target.item.nil? \

programming_language: Ruby
filename: zeptair_post_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -27,6 +27,8 @@ class ZeptairPostController < ApplicationController
   def upload
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     if params[:file].nil? or params[:file].size <= 0
       render(:text => '')
       return
@@ -134,6 +136,8 @@ class ZeptairPostController < ApplicationController
   def delete_attachment
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     target_user = nil
 
     user_id = params[:user_id]
@@ -158,7 +162,6 @@ class ZeptairPostController < ApplicationController
 
     if target_user.nil?
       if attachment_id.blank?
-
         query
         unless @post_items.nil?
           @post_items.each do |post_item|

programming_language: Ruby
filename: zeptair_xlogs_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -101,6 +101,8 @@ class ZeptairXlogsController < ApplicationController
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_xlog].nil?
       list
       render(:action => 'list')
@@ -108,6 +110,7 @@ class ZeptairXlogsController < ApplicationController
     end
 
     count = 0
+    SqlHelper.validate_token([params[:check_xlog].keys])
     params[:check_xlog].each do |key, value|
       if value == '1'
         ZeptairXlog.delete(key)
@@ -127,6 +130,8 @@ class ZeptairXlogsController < ApplicationController
   def destroy_all
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     ZeptairXlog.delete_all
 
     flash[:notice] = t('msg.delete_success')

programming_language: Ruby
filename: addressbook_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -28,6 +28,8 @@ module AddressbookHelper
   #
   def self.arrange_per_scope(address, user, scope, group_ids, team_ids)
 
+    SqlHelper.validate_token([group_ids, team_ids])
+
     case scope
      when 'private'
       address.owner_id = user.id

programming_language: Ruby
filename: application_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -19,6 +19,24 @@ module ApplicationHelper
   require 'uri'     # for URI.extract()
 
 
+  #=== self.stacktrace
+  #
+  #Gets backtrace.
+  #
+  #return:: Backtrace.
+  #
+  def self.stacktrace
+    begin
+      raise('')
+    rescue => evar
+      paths = Rails.root.split('/')
+      paths.delete('')
+      stacktrace = evar.backtrace.select {|line| !(line.match(paths.last).nil?)}.join("\n")
+      stacktrace.pop  # Remove current stack.
+    end
+    return stacktrace
+  end
+
   #=== self.split_preserving_quot
   #
   #Splits string preserving quotations.

programming_language: Ruby
filename: research.rb
change_type: ModificationType.MODIFY
diff: @@ -241,7 +241,7 @@ class Research < ActiveRecord::Base
     if group_ids.nil?
 
       unless yaml[:statistics].nil?
-        yaml[:statistics].delete :groups
+        yaml[:statistics].delete(:groups)
       end
 
     else
@@ -253,7 +253,7 @@ class Research < ActiveRecord::Base
       yaml[:statistics][:groups] = group_ids.join('|')
     end
 
-    Research.save_config_yaml yaml
+    Research.save_config_yaml(yaml)
 
     return ary
   end
@@ -288,12 +288,12 @@ class Research < ActiveRecord::Base
       ary << group_id
 
       ary.compact!
-      ary.delete ''
+      ary.delete('')
 
       yaml[:statistics][:groups] = ary.join('|')
     end
 
-    Research.save_config_yaml yaml
+    Research.save_config_yaml(yaml)
 
     return ary
   end
@@ -321,11 +321,11 @@ class Research < ActiveRecord::Base
     ary.delete group_id.to_s
 
     ary.compact!
-    ary.delete ''
+    ary.delete('')
 
     yaml[:statistics][:groups] = ary.join('|')
 
-    Research.save_config_yaml yaml
+    Research.save_config_yaml(yaml)
 
     return ary
  end
@@ -406,13 +406,11 @@ class Research < ActiveRecord::Base
         q_code = q_code_a.first
 
         if all.include?(q_code)
-          
           if yaml[q_code].nil?
             q_hash[q_code] = nil
           else
             q_hash[q_code] = Marshal.load(Marshal.dump(yaml[q_code]))
           end
-
         end
       end
     end

programming_language: Ruby
repo_url: https://github.com/sysphonic/thetis
commit_details: repo_url: https://github.com/sysphonic/thetis
author: MORITA Shintaro
author_date: 2015-07-14 08:56:18+09:00
msg: Thetis ver.2.3.0: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>
repository: repo_url: https://github.com/sysphonic/thetis
repo_name: sysphonic/thetis
description: Free Open-Source Goupware / Web Collaboration Suite
repo_language: HTML
owner: sysphonic
file_changes: filename: login_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -97,9 +97,8 @@ class LoginController < ApplicationController
     Log.add_info(request, params.inspect)
 
     mail_addr = params[:thetisBoxEdit]
-    SqlHelper.validate_token([mail_addr])
     begin
-      users = User.where("email='#{mail_addr}'").to_a
+      users = User.where(email: mail_addr).to_a
     rescue => evar
     end
 

programming_language: Ruby
filename: sql_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -30,12 +30,13 @@ module SqlHelper
     else
       extra_chars = Regexp.escape(extra_chars.join())
     end
-    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_.@\\-#{extra_chars}]+[ ]*$")
+    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_#{extra_chars}]+[ ]*$")
 
     [tokens].flatten.each do |token|
       next if token.blank?
 
-      if token.to_s.match(regexp).nil?
+      if token.to_s.match(regexp).nil? \
+          and token.to_s.match(/^[ ]*\d+-\d+-\d+[ ]*$/).nil?
         raise("[ERROR] SqlHelper.validate_token failed: #{token}")
       end
     end

programming_language: Ruby
filename: address.rb
change_type: ModificationType.MODIFY
diff: @@ -36,12 +36,12 @@ class Address < ActiveRecord::Base
   #
   def self.get_by_email(mail_addr, user, book=Address::BOOK_BOTH)
 
-    SqlHelper.validate_token([mail_addr])
+    mail_quote = SqlHelper.quote(mail_addr)
 
     email_con = []
-    email_con.push("(email1='#{mail_addr}')")
-    email_con.push("(email2='#{mail_addr}')")
-    email_con.push("(email3='#{mail_addr}')")
+    email_con.push("(email1=#{mail_quote})")
+    email_con.push("(email2=#{mail_quote})")
+    email_con.push("(email3=#{mail_quote})")
     con = []
     con.push('('+email_con.join(' or ')+')')
     con.push(AddressbookHelper.get_scope_condition_for(user, book))
@@ -212,7 +212,11 @@ class Address < ActiveRecord::Base
     imp_id = (idxs[0].nil? or row[idxs[0]].nil?)?(nil):(row[idxs[0]].strip)
     SqlHelper.validate_token([imp_id])
     unless imp_id.blank?
-      org_address = Address.find_by_id(imp_id)
+      begin
+        org_address = Address.find(imp_id)
+      rescue => evar
+        org_address = nil
+      end
     end
 
     if org_address.nil?

programming_language: Ruby
filename: user.rb
change_type: ModificationType.MODIFY
diff: @@ -534,7 +534,7 @@ class User < ActiveRecord::Base
     SqlHelper.validate_token([user_name])
 
     begin
-      user = User.where("name='#{user_name}'").first
+      user = User.where(name: user_name).first
     rescue => evar
       Log.add_error(nil, evar)
     end

programming_language: Ruby
filename: about.html.erb
change_type: ModificationType.MODIFY
diff: @@ -38,7 +38,7 @@
             <table style="width:60%; margin:0px auto 0px 0px; border-spacing:0px;">
               <tr>
                 <td style="text-align:left;" nowrap>
-                  Sysphonic <B>Thetis</B><sup>&reg;</sup>  <small style="text-align:right;">ver.2.2.0</small>&nbsp;
+                  Sysphonic <B>Thetis</B><sup>&reg;</sup>  <small style="text-align:right;">ver.2.3.0</small>&nbsp;
                 </td>
               </tr>
             </table>

programming_language: HTML
filename: _ajax_item_basic.html.erb
change_type: ModificationType.MODIFY
diff: @@ -22,50 +22,54 @@
   <% when Item::XTYPE_RESEARCH %>
       <%= Research.model_name.human %>
   <% else   # XTYPE_INFO, XTYPE_PROJECT, XTYPE_ZEPTAIR_DIST, XTYPE_UNKNOWN %>
-      <%= radio_button('item', 'xtype', Item::XTYPE_INFO, :onClick => 'dispZeptCmdOpt(false); modifiedBasic++') %><label for="item_xtype_<%= Item::XTYPE_INFO %>"> <%= t('item.type.normal') %></label><br/>
-      <%= radio_button('item', 'xtype', Item::XTYPE_PROJECT, :onClick => 'dispZeptCmdOpt(false); modifiedBasic++') %><label for="item_xtype_<%= Item::XTYPE_PROJECT %>"> <img src="<%= THETIS_RELATIVE_URL_ROOT %>/images/folder/team_folder.gif" title="<%= t('item.project') %>" alt="<%= t('item.project') %>" /> <%= t('item.type.project') %></label><br/>
-    <% if @login_user.admin?(User::AUTH_ZEPTAIR) %>
-      <%= radio_button('item', 'xtype', Item::XTYPE_ZEPTAIR_DIST, :onClick => 'dispZeptCmdOpt(this.checked); modifiedBasic++') %><label for="item_xtype_<%= Item::XTYPE_ZEPTAIR_DIST %>"> <img src="<%= THETIS_RELATIVE_URL_ROOT %>/images/zeptair/zeptair_icon.png" title="<%= t('item.type.zeptair_dist') %>" alt="<%= t('item.type.zeptair_dist') %>" /> <%= t('item.type.zeptair_dist') %></label>
-      &nbsp;<img class="img_btn" src="<%= THETIS_RELATIVE_URL_ROOT %>/images/info.gif" onclick="msg('<%= t('item.zeptair_dist_info') %>');">
-
-      <div id="div_zept_cmd" style="padding-left:20px; display:<%= (@item.xtype == Item::XTYPE_ZEPTAIR_DIST)?'block':'none' %>;">
-        <div style="background-color:#FDFEFF; padding:2px 3px">
-          <%
-          zept_cmd = @item.zeptair_command
-          checked = (!zept_cmd.nil? and zept_cmd.enabled)?'checked':''
-          %>
-          <input name="zeptair_command[enabled]" type="hidden" value="0" />
-          <input type="checkbox" id="check_zept_cmd" name="zeptair_command[enabled]" value="1" onclick="dispZeptCmdEdit(this.checked); modifiedBasic++;" <%= checked %>><label for="check_zept_cmd"><%= t('item.zeptair_dist_cmd') %></label>
-          <div id="div_zept_cmd_edit" style="padding-left:20px; display:<%= (checked=='checked')?'block':'none' %>;">
-            <textarea id="zept_cmd" name="zeptair_command[commands]" rows="4" wrap="off" style="width:95%; background-color:black; color:white;" onChange="modifiedBasic++;"><%= (zept_cmd.nil?)?'':zept_cmd.commands %></textarea><br/>
-            <% checked = (!zept_cmd.nil? and zept_cmd.confirm_exec)?'checked':'' %>
-            <input name="zeptair_command[confirm_exec]" type="hidden" value="0" />
-            <input type="checkbox" id="check_zept_cmd_with_confirm" name="zeptair_command[confirm_exec]" value="1" onclick="modifiedBasic++;" <%= checked %>><label for="check_zept_cmd_with_confirm"><%= t('item.zeptair_dist_cmd_with_confirm') %></label>
-          </div>
-        </div>
-      </div>
-
-<script type="text/javascript">
-dispZeptCmdOpt = function(sw)
-{
-  if (sw) {
-    _z("div_zept_cmd").style.display = "block";
-  } else {
-    _z("div_zept_cmd").style.display = "none";
-  }
-}
-
-dispZeptCmdEdit = function(sw)
-{
-  if (sw) {
-    _z("div_zept_cmd_edit").style.display = "block";
-  } else {
-    _z("div_zept_cmd_edit").style.display = "none";
-  }
-}
-</script>
-
-    <% end %>
+      <%= radio_button('item', 'xtype', Item::XTYPE_INFO, :onClick => 'onItemXtypeClicked(this)') %><label for="item_xtype_<%= Item::XTYPE_INFO %>"> <%= t('item.type.normal') %></label><br/>
+      <%= radio_button('item', 'xtype', Item::XTYPE_PROJECT, :onClick => 'onItemXtypeClicked(this)') %><label for="item_xtype_<%= Item::XTYPE_PROJECT %>"> <img src="<%= THETIS_RELATIVE_URL_ROOT %>/images/folder/team_folder.gif" title="<%= t('item.project') %>" alt="<%= t('item.project') %>" /> <%= t('item.type.project') %></label><br/>
+    <%
+=begin
+#    if @login_user.admin?(User::AUTH_ZEPTAIR)
+    %>
+#      <%= radio_button('item', 'xtype', Item::XTYPE_ZEPTAIR_DIST, :onClick => 'onItemXtypeClicked(this)') %><label for="item_xtype_<%= Item::XTYPE_ZEPTAIR_DIST %>"> <img src="<%= THETIS_RELATIVE_URL_ROOT %>/images/zeptair/zeptair_icon.png" title="<%= t('item.type.zeptair_dist') %>" alt="<%= t('item.type.zeptair_dist') %>" /> <%= t('item.type.zeptair_dist') %></label>
+#      &nbsp;<img class="img_btn" src="<%= THETIS_RELATIVE_URL_ROOT %>/images/info.gif" onclick="msg('<%= t('item.zeptair_dist_info') %>');">
+#
+#      <div id="div_zept_cmd" style="padding-left:20px; display:<%= (@item.xtype == Item::XTYPE_ZEPTAIR_DIST)?'block':'none' %>;">
+#        <div style="background-color:#FDFEFF; padding:2px 3px">
+#          <%
+#          zept_cmd = @item.zeptair_command
+#          checked = (!zept_cmd.nil? and zept_cmd.enabled)?'checked':''
+#          %>
+#          <input name="zeptair_command[enabled]" type="hidden" value="0" />
+#          <input type="checkbox" id="check_zept_cmd" name="zeptair_command[enabled]" value="1" onclick="dispZeptCmdEdit(this.checked); modifiedBasic++;" <%= checked %>><label for="check_zept_cmd"><%= t('item.zeptair_dist_cmd') %></label>
+#          <div id="div_zept_cmd_edit" style="padding-left:20px; display:<%= (checked=='checked')?'block':'none' %>;">
+#            <textarea id="zept_cmd" name="zeptair_command[commands]" rows="4" wrap="off" style="width:95%; background-color:black; color:white;" onChange="modifiedBasic++;"><%= (zept_cmd.nil?)?'':zept_cmd.commands %></textarea><br/>
+#            <% checked = (!zept_cmd.nil? and zept_cmd.confirm_exec)?'checked':'' %>
+#            <input name="zeptair_command[confirm_exec]" type="hidden" value="0" />
+#            <input type="checkbox" id="check_zept_cmd_with_confirm" name="zeptair_command[confirm_exec]" value="1" onclick="modifiedBasic++;" <%= checked %>><label for="check_zept_cmd_with_confirm"><%= t('item.zeptair_dist_cmd_with_confirm') %></label>
+#          </div>
+#        </div>
+#      </div>
+#
+#<script type="text/javascript">
+#dispZeptCmdOpt = function(sw)
+#{
+#  var div_zept_cmd = _z("div_zept_cmd");
+#  if (div_zept_cmd) {
+#    div_zept_cmd.style.display = (sw)?"block":"none";
+#  }
+#}
+#
+#dispZeptCmdEdit = function(sw)
+#{
+#  var div_zept_cmd_edit = _z("div_zept_cmd_edit");
+#  if (div_zept_cmd_edit) {
+#    div_zept_cmd_edit.style.display = (sw)?"block":"none";
+#  }
+#}
+#</script>
+#
+    <%
+#    end
+=end
+    %>
   <% end %>
     </td>
   </tr>
@@ -271,6 +275,19 @@ dispZeptCmdEdit = function(sw)
 document.getElementById("item_id").value = "<%= @item.id %>";
 <% end %>
 
+onItemXtypeClicked = function(elem)
+{
+  modifiedBasic++;
+
+  if (typeof(dispZeptCmdOpt) == "function") {
+    if (elem.value == "<%= Item::XTYPE_ZEPTAIR_DIST %>") {
+      dispZeptCmdOpt(elem.checked);
+    } else {
+      dispZeptCmdOpt(false);
+    }
+  }
+}
+
 function doSelectFolder(frm)
 {
   var thetisBoxProgress = prog("TOP-RIGHT");

programming_language: Perl
repo_url: https://github.com/sysphonic/thetis
commit_details: repo_url: https://github.com/sysphonic/thetis
author: MORITA Shintaro
author_date: 2015-07-07 10:34:01+09:00
msg: Some trivial bug-fixes.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>
repository: repo_url: https://github.com/sysphonic/thetis
repo_name: sysphonic/thetis
description: Free Open-Source Goupware / Web Collaboration Suite
repo_language: HTML
owner: sysphonic
file_changes: filename: application_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -99,7 +99,12 @@ class ApplicationController < ActionController::Base
 
     HistoryHelper.keep_last(request)
 
-    @login_user = User.find(session[:login_user_id])
+    SqlHelper.validate_token([session[:login_user_id]])
+    begin
+      @login_user = User.find(session[:login_user_id])
+    rescue => evar
+      @login_user = nil
+    end
 
     begin
       if @login_user.nil? \

programming_language: Ruby
repo_url: https://github.com/sysphonic/thetis
commit_details: repo_url: https://github.com/sysphonic/thetis
author: MORITA Shintaro
author_date: 2015-07-04 09:40:26+09:00
msg: x ApplicationHelper.get_sql_like() -> o SqlHelper.get_sql_like()
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>
repository: repo_url: https://github.com/sysphonic/thetis
repo_name: sysphonic/thetis
description: Free Open-Source Goupware / Web Collaboration Suite
repo_language: HTML
owner: sysphonic
file_changes: filename: equipment_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -143,7 +143,7 @@ class EquipmentController < ApplicationController
       if @group_id == '0'
         con << "((groups like '%|0|%') or (groups is null))"
       else
-        con << ApplicationHelper.get_sql_like([:groups], "|#{@group_id}|")
+        con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
       end
     end
 
@@ -219,11 +219,11 @@ class EquipmentController < ApplicationController
       case display_type
        when 'group'
         if @login_user.get_groups_a(true).include?(display_id)
-          con = ApplicationHelper.get_sql_like([:groups], "|#{display_id}|")
+          con = SqlHelper.get_sql_like([:groups], "|#{display_id}|")
         end
        when 'team'
         if @login_user.get_teams_a.include?(display_id)
-          con = ApplicationHelper.get_sql_like([:teams], "|#{display_id}|")
+          con = SqlHelper.get_sql_like([:teams], "|#{display_id}|")
         end
       end
     end

programming_language: Ruby
filename: groups_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -263,7 +263,7 @@ class GroupsController < ApplicationController
       if @group_id == '0'
         con << "((groups like '%|0|%') or (groups is null))"
       else
-        con << ApplicationHelper.get_sql_like([:groups], "|#{@group_id}|")
+        con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
       end
     end
 

programming_language: Ruby
repo_url: https://github.com/sysphonic/thetis
commit_details: repo_url: https://github.com/sysphonic/thetis
author: MORITA Shintaro
author_date: 2015-07-05 22:30:39+09:00
msg: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>
repository: repo_url: https://github.com/sysphonic/thetis
repo_name: sysphonic/thetis
description: Free Open-Source Goupware / Web Collaboration Suite
repo_language: HTML
owner: sysphonic
file_changes: filename: desktop_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -498,9 +498,10 @@ class DesktopController < ApplicationController
     @group_id = nil
     if !params[:thetisBoxSelKeeper].nil?
       @group_id = params[:thetisBoxSelKeeper].split(':').last
-    elsif !params[:group_id].nil? and !params[:group_id].empty?
+    elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
 
     submit_url = url_for(:controller => 'desktop', :action => 'get_group_users')
     render(:partial => 'common/select_users', :layout => false, :locals => {:target_attr => :id, :submit_url => submit_url})

programming_language: Ruby
filename: equipment_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -139,6 +139,8 @@ class EquipmentController < ApplicationController
     elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
+
     unless @group_id.nil?
       if @group_id == '0'
         con << "((groups like '%|0|%') or (groups is null))"

programming_language: Ruby
filename: folders_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -35,9 +35,10 @@ class FoldersController < ApplicationController
       @group_id = nil
       if !params[:thetisBoxSelKeeper].nil?
         @group_id = params[:thetisBoxSelKeeper].split(':').last
-      elsif !params[:group_id].nil? and !params[:group_id].empty?
+      elsif !params[:group_id].blank?
         @group_id = params[:group_id]
       end
+      SqlHelper.validate_token([@group_id])
 
       @folder_tree = Folder.get_tree_by_group_for_admin(@group_id || '0')
     else
@@ -506,6 +507,7 @@ class FoldersController < ApplicationController
   def get_group_users
     Log.add_info(request, params.inspect)
 
+    SqlHelper.validate_token([params[:id]])
     begin
       @folder = Folder.find(params[:id])
     rescue => evar
@@ -515,11 +517,12 @@ class FoldersController < ApplicationController
     @group_id = nil
     if !params[:thetisBoxSelKeeper].nil?
       @group_id = params[:thetisBoxSelKeeper].split(':').last
-    elsif !params[:group_id].nil? and !params[:group_id].empty?
+    elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
 
-    @users = Group.get_users @group_id
+    @users = Group.get_users(@group_id)
 
     render(:partial => 'ajax_select_users', :layout => false)
   end

programming_language: Ruby
filename: items_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -1217,11 +1217,12 @@ class ItemsController < ApplicationController
     @group_id = nil
     if !params[:thetisBoxSelKeeper].nil?
       @group_id = params[:thetisBoxSelKeeper].split(':').last
-    elsif !params[:group_id].nil? and !params[:group_id].empty?
+    elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
 
-    @users = Group.get_users @group_id
+    @users = Group.get_users(@group_id)
 
     render(:partial => 'ajax_select_users', :layout => false)
   end
@@ -1234,7 +1235,7 @@ class ItemsController < ApplicationController
   def wf_issue
     Log.add_info(request, params.inspect)
 
-    begin
+   begin
       @item = Item.find(params[:id])
       @workflow = @item.workflow
     rescue => evar
@@ -1258,7 +1259,7 @@ class ItemsController < ApplicationController
     Log.add_info(request, params.inspect)
 
     team_id = params[:team_id]
-    unless team_id.nil? or team_id.empty?
+    unless team_id.blank?
       begin
         @team = Team.find(team_id)
       rescue
@@ -1280,7 +1281,7 @@ class ItemsController < ApplicationController
 
     if team_members.nil? or team_members.empty?
 
-      unless team_id.nil? or team_id.empty?
+      unless team_id.blank?
         # @team must not be nil.
         @team.save if modified = @team.clear_users
       end
@@ -1289,7 +1290,7 @@ class ItemsController < ApplicationController
 
       if team_members != users
 
-        if team_id.nil? or team_id.empty?
+        if team_id.blank?
 
           item = Item.find(params[:id])
 
@@ -1359,6 +1360,8 @@ class ItemsController < ApplicationController
   def change_team_status
     Log.add_info(request, params.inspect)
 
+    SqlHelper.validate_token([params[:status]])
+
     team_id = params[:team_id]
     begin
       team = Team.find(team_id)
@@ -1382,7 +1385,7 @@ class ItemsController < ApplicationController
   #Filter method to check if the current User is owner of the specified Item.
   #
   def check_owner
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     begin
       owner_id = Item.find(params[:id]).user_id

programming_language: Ruby
filename: locations_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,7 @@ class LocationsController < ApplicationController
     elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
 
     unless params[:keyword].blank?
       con_prim = []
@@ -142,6 +143,7 @@ class LocationsController < ApplicationController
     Log.add_info(request, params.inspect)
 
     group_id = params[:group_id]
+    SqlHelper.validate_token([group_id])
 
     @office_map = OfficeMap.get_for_group(group_id, true)
 
@@ -163,6 +165,7 @@ class LocationsController < ApplicationController
     Log.add_info(request, params.inspect)
 
     group_id = params[:group_id]
+    SqlHelper.validate_token([group_id])
 
     @office_map = OfficeMap.get_for_group(group_id, false)
 

programming_language: Ruby
filename: login_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -96,8 +96,10 @@ class LoginController < ApplicationController
   def send_password
     Log.add_info(request, params.inspect)
 
+    mail_addr = params[:thetisBoxEdit]
+    SqlHelper.validate_token([mail_addr], ['@-'])
     begin
-      users = User.where("email='#{params[:thetisBoxEdit]}'").to_a
+      users = User.where("email='#{mail_addr}'").to_a
     rescue => evar
     end
 

programming_language: Ruby
filename: researches_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -434,8 +434,9 @@ class ResearchesController < ApplicationController
 
     # Specifying page
     @page = '01'
-    unless params[:page].nil? or params[:page].empty?
+    unless params[:page].blank?
       @page = params[:page]
+      SqlHelper.validate_token([@page])
     end
   end
 
@@ -466,12 +467,14 @@ class ResearchesController < ApplicationController
       end
     end
 
-    if params[:research_id].nil? or params[:research_id].empty?
+    research_id = params[:research_id]
+    SqlHelper.validate_token([research_id])
+    if research_id.blank?
       @research = Research.new(params.require(:research).permit(Research::PERMIT_BASE))
       @research.status = Research::U_STATUS_IN_ACTON
       @research.update_attribute(:user_id, @login_user.id)
     else
-      @research = Research.find(params[:research_id])
+      @research = Research.find(research_id)
       @research.update_attributes(params.require(:research).permit(Research::PERMIT_BASE))
     end
 
@@ -552,6 +555,8 @@ class ResearchesController < ApplicationController
     elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
+
     unless @group_id.nil?
       con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
     end
@@ -690,6 +695,7 @@ class ResearchesController < ApplicationController
 
     unless params[:thetisBoxSelKeeper].nil?
       @group_id = params[:thetisBoxSelKeeper].split(':').last
+      SqlHelper.validate_token([@group_id])
 
       group_cons = []
 

programming_language: Ruby
filename: schedules_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -678,9 +678,10 @@ class SchedulesController < ApplicationController
     @group_id = nil
     if !params[:thetisBoxSelKeeper].nil?
       @group_id = params[:thetisBoxSelKeeper].split(':').last
-    elsif !params[:group_id].nil? and !params[:group_id].empty?
+    elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
 
     submit_url = url_for(:controller => 'schedules', :action => 'get_group_users')
     render(:partial => 'common/select_users', :layout => false, :locals => {:target_attr => :id, :submit_url => submit_url})
@@ -708,9 +709,10 @@ class SchedulesController < ApplicationController
     @group_id = nil
     if !params[:thetisBoxSelKeeper].nil?
       @group_id = params[:thetisBoxSelKeeper].split(':').last
-    elsif !params[:group_id].nil? and !params[:group_id].empty?
+    elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
 
     submit_url = url_for(:controller => 'schedules', :action => 'get_group_equipment')
     render(:partial => 'common/select_equipment', :layout => false, :locals => {:target_attr => :id, :submit_url => submit_url})

programming_language: Ruby
filename: send_mails_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -363,9 +363,10 @@ class SendMailsController < ApplicationController
     @group_id = nil
     if !params[:thetisBoxSelKeeper].nil?
       @group_id = params[:thetisBoxSelKeeper].split(':').last
-    elsif !params[:group_id].nil? and !params[:group_id].empty?
+    elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
 
     submit_url = url_for(:controller => 'send_mails', :action => 'get_group_users')
     render(:partial => 'common/select_users', :layout => false, :locals => {:target_attr => :email, :submit_url => submit_url})
@@ -378,7 +379,7 @@ class SendMailsController < ApplicationController
   #
   def check_owner
 
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     email = Email.find(params[:id])
 

programming_language: Ruby
filename: timecards_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -427,6 +427,8 @@ class TimecardsController < ApplicationController
     elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
+
     unless @group_id.nil?
       if @group_id == '0'
         con << "((groups like '%|0|%') or (groups is null))"

programming_language: Ruby
filename: users_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -162,6 +162,7 @@ class UsersController < ApplicationController
     elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
 
 # Copy to FEATURE_PAGING_IN_TREE >>>
     con = ['User.id > 0']
@@ -269,6 +270,7 @@ class UsersController < ApplicationController
     unless params[:thetisBoxSelKeeper].nil?
       @group_id = params[:thetisBoxSelKeeper].split(':').last
     end
+    SqlHelper.validate_token([@group_id])
 
     if @group_id.nil?
       @official_titles = OfficialTitle.get_for('0', false, true)
@@ -351,6 +353,8 @@ class UsersController < ApplicationController
   def update_auth
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     auth = nil
 
     if params[:check_auth_all] == '1'

programming_language: Ruby
filename: zeptair_dist_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -48,6 +48,8 @@ class ZeptairDistController < ApplicationController
     elsif !params[:group_id].blank?
       @group_id = params[:group_id]
     end
+    SqlHelper.validate_token([@group_id])
+
     unless @group_id.nil?
       con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
     end

programming_language: Ruby
filename: sql_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -25,8 +25,8 @@ module SqlHelper
   #
   def self.validate_token(tokens, extra_chars=nil)
 
-    extra_chars ||= []
-    regexp = Regexp.new("^\s*[a-zA-Z0-9_.#{extra_chars.join()}]+\s*$")
+    extra_chars = Regexp.escape((extra_chars || []).join())
+    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_.#{extra_chars}]+[ ]*$")
 
     [tokens].flatten.each do |token|
       next if token.blank?

programming_language: Ruby
filename: 20110524100000_changes_for_ver110.rb
change_type: ModificationType.MODIFY
diff: @@ -15,19 +15,16 @@ class ChangesForVer110 < ActiveRecord::Migration
       t.timestamps
     end
 
-    teams = Team.all
-    unless teams.nil?
-      teams.each do |team|
-        begin
-          item = Item.find(team.item_id)
-        rescue
-        end
-        next if item.nil?
-
-        attrs = ActionController::Parameters.new({created_at: item.created_at, updated_at: item.updated_at})
-        attrs.permit!
-        team.update_attributes(attrs)
+    Team.find_each do |team|
+      begin
+        item = Item.find(team.item_id)
+      rescue
       end
+      next if item.nil?
+
+      attrs = ActionController::Parameters.new({created_at: item.created_at, updated_at: item.updated_at})
+      attrs.permit!
+      team.update_attributes(attrs)
     end
   end
 

programming_language: Ruby
repo_url: https://github.com/sysphonic/thetis
commit_details: repo_url: https://github.com/sysphonic/thetis
author: MORITA Shintaro
author_date: 2015-07-07 10:28:35+09:00
msg: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>
repository: repo_url: https://github.com/sysphonic/thetis
repo_name: sysphonic/thetis
description: Free Open-Source Goupware / Web Collaboration Suite
repo_language: HTML
owner: sysphonic
file_changes: filename: application_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -75,18 +75,18 @@ class ApplicationController < ActionController::Base
   #=== paginate_by_sql
   #
   def paginate_by_sql(model, sql, per_page, options={})
-    if options[:count]
+    if options[:count].blank?
+      total = model.count_by_sql_wrapping_select_query(sql)
+    else
       if options[:count].is_a?(Integer)
         total = options[:count]
-      else
-        total = model.count_by_sql(options[:count])
+      #else
+      #  total = model.count_by_sql(options[:count])
       end
-    else
-      total = model.count_by_sql_wrapping_select_query(sql)
     end
 
+    SqlHelper.validate_token([params['page']])
     object_pages = model.paginate_by_sql(sql, {:page => params['page'], :per_page => per_page})
-    #objects = model.find_by_sql_with_limit(sql, object_pages.current.to_sql[1], per_page)
     return [object_pages, object_pages, total]
   end
 
@@ -99,7 +99,7 @@ class ApplicationController < ActionController::Base
 
     HistoryHelper.keep_last(request)
 
-    @login_user = User.find_by_id(session[:login_user_id])
+    @login_user = User.find(session[:login_user_id])
 
     begin
       if @login_user.nil? \
@@ -118,12 +118,6 @@ end
 
 module ActiveRecord
   class Base
-    def self.find_by_sql_with_limit(sql, offset, limit)
-      sql = sanitize_sql(sql)
-      add_limit!(sql, {:limit => limit, :offset => offset})
-      find_by_sql(sql)
-    end
-
     def self.count_by_sql_wrapping_select_query(sql)
       sql = sanitize_sql(sql)
       count_by_sql("select count(*) from (#{sql}) as my_table")

programming_language: Ruby
filename: mail_filters_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -108,7 +108,10 @@ class MailFiltersController < ApplicationController
       Log.add_info(request, params.inspect)
     end
 
-    @mail_filter = MailFilter.find_by_id(params[:id])
+    begin
+      @mail_filter = MailFilter.find(params[:id])
+    rescue => evar
+    end
     if @mail_filter.nil?
       render(:text => 'ERROR:' + t('msg.already_deleted', :name => MailFilter.model_name.human))
       return
@@ -225,8 +228,8 @@ class MailFiltersController < ApplicationController
   def do_execute
     Log.add_info(request, params.inspect)
 
-    mail_account = MailAccount.find_by_id(params[:mail_account_id])
-    mail_folder = MailFolder.find_by_id(params[:mail_folder_id])
+    mail_account = MailAccount.find(params[:mail_account_id])
+    mail_folder = MailFolder.find(params[:mail_folder_id])
 
     if mail_account.user_id != @login_user.id \
         or mail_folder.user_id != @login_user.id
@@ -258,8 +261,9 @@ class MailFiltersController < ApplicationController
     Log.add_info(request, params.inspect)
 
     mail_account_id = params[:mail_account_id]
+    SqlHelper.validate_token([mail_account_id])
 
-    @mail_account = MailAccount.find_by_id(mail_account_id)
+    @mail_account = MailAccount.find(mail_account_id)
 
     if @mail_account.user_id != @login_user.id
       flash[:notice] = t('msg.need_to_be_owner')
@@ -285,9 +289,11 @@ class MailFiltersController < ApplicationController
     Log.add_info(request, params.inspect)
 
     mail_account_id = params[:mail_account_id]
-    order_ary = params[:mail_filters_order]
+    order_arr = params[:mail_filters_order]
+
+    SqlHelper.validate_token([mail_account_id])
 
-    @mail_account = MailAccount.find_by_id(mail_account_id)
+    @mail_account = MailAccount.find(mail_account_id)
 
     if @mail_account.user_id != @login_user.id
       render(:text => 'ERROR:' + t('msg.need_to_be_owner'))
@@ -301,8 +307,8 @@ class MailFiltersController < ApplicationController
       id_a = filter_a.id.to_s
       id_b = filter_b.id.to_s
 
-      idx_a = order_ary.index(id_a)
-      idx_b = order_ary.index(id_b)
+      idx_a = order_arr.index(id_a)
+      idx_b = order_arr.index(id_b)
 
       if idx_a.nil? or idx_b.nil?
         idx_a = filters.index(id_a)

programming_language: Ruby
filename: mail_folders_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -302,7 +302,7 @@ class MailFoldersController < ApplicationController
 
     email_id = params[:id]
 
-    email = Email.find_by_id(email_id)
+    email = Email.find(email_id)
     if email.nil? or email.user_id != @login_user.id
       render(:text => '')
       return
@@ -327,14 +327,20 @@ class MailFoldersController < ApplicationController
     Log.add_info(request, params.inspect)
 
     attached_id = params[:id].to_i
-    mail_attach = MailAttachment.find_by_id(attached_id)
+    begin
+      mail_attach = MailAttachment.find(attached_id)
+    rescue => evar
+    end
 
     if mail_attach.nil?
       redirect_to(THETIS_RELATIVE_URL_ROOT + '/404.html')
       return
     end
 
-    email = Email.find_by_id(mail_attach.email_id)
+    begin
+      email = Email.find(mail_attach.email_id)
+    rescue => evar
+    end
     if email.nil? or email.user_id != @login_user.id
       render(:text => '')
       return
@@ -438,7 +444,10 @@ class MailFoldersController < ApplicationController
       params[:check_mail].each do |email_id, value|
         next if value != '1'
 
-        email = Email.find_by_id(email_id)
+        begin
+          email = Email.find(email_id)
+        rescue => evar
+        end
         next if email.nil? or (email.user_id != @login_user.id)
 
         if trash_folder.nil? \
@@ -473,7 +482,11 @@ class MailFoldersController < ApplicationController
     Log.add_info(request, params.inspect)
 
     folder_id = params[:thetisBoxSelKeeper].split(':').last
-    mail_folder = MailFolder.find_by_id(folder_id)
+    SqlHelper.validate_token([folder_id])
+    begin
+      mail_folder = MailFolder.find(folder_id)
+    rescue => evar
+    end
 
     if folder_id == '0' \
         or mail_folder.nil? \
@@ -541,15 +554,16 @@ class MailFoldersController < ApplicationController
   def update_folders_order
     Log.add_info(request, params.inspect)
 
-    order_ary = params[:folders_order]
+    order_arr = params[:folders_order]
 
+    SqlHelper.validate_token([params[:id]])
     folders = MailFolder.get_childs(params[:id], false, false)
     # folders must be ordered by xorder ASC.
 
     folders.sort! { |id_a, id_b|
 
-      idx_a = order_ary.index(id_a)
-      idx_b = order_ary.index(id_b)
+      idx_a = order_arr.index(id_a)
+      idx_b = order_arr.index(id_b)
 
       if idx_a.nil? or idx_b.nil?
         idx_a = folders.index(id_a)

programming_language: Ruby
filename: workflows_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -103,6 +103,7 @@ class WorkflowsController < ApplicationController
 
     unless params[:thetisBoxSelKeeper].nil?
       folder_id = params[:thetisBoxSelKeeper].split(':').last
+      SqlHelper.validate_token([folder_id])
 
       workflow = Workflow.find(params[:id])
 

programming_language: Ruby
filename: mail_filters_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -413,8 +413,12 @@ module MailFiltersHelper
   def self.execute_action_move(mail_filter, email, val)
 
     mail_folder_id = val
+    SqlHelper.validate_token([mail_folder_id])
 
-    mail_folder = MailFolder.find_by_id(mail_folder_id)
+    begin
+      mail_folder = MailFolder.find(mail_folder_id)
+    rescue => evar
+    end
     if !mail_folder.nil? and (mail_folder.user_id == email.user_id)
       email.update_attribute(:mail_folder_id, mail_folder_id)
     end

programming_language: Ruby
filename: address.rb
change_type: ModificationType.MODIFY
diff: @@ -210,7 +210,8 @@ class Address < ActiveRecord::Base
   def self.parse_csv_row(row, book, idxs, user)
 
     imp_id = (idxs[0].nil? or row[idxs[0]].nil?)?(nil):(row[idxs[0]].strip)
-    unless imp_id.nil? or imp_id.empty?
+    SqlHelper.validate_token([imp_id])
+    unless imp_id.blank?
       org_address = Address.find_by_id(imp_id)
     end
 
@@ -305,7 +306,11 @@ class Address < ActiveRecord::Base
       if (/^|([0-9]+|)+$/ =~ self.groups) == 0
 
         self.get_groups_a.each do |group_id|
-          group = Group.find_by_id(group_id)
+          begin
+            group = Group.find(group_id)
+          rescue => evar
+            group = nil
+          end
           if group.nil?
             err_msgs << I18n.t('address.import.not_valid_groups') + ': '+group_id.to_s
             break
@@ -322,7 +327,11 @@ class Address < ActiveRecord::Base
       if (/^|([0-9]+|)+$/ =~ self.teams) == 0
 
         self.get_teams_a.each do |team_id|
-          team = Team.find_by_id(team_id)
+          begin
+            team = Team.find(team_id)
+          rescue => evar
+            team = nil
+          end
           if team.nil?
             err_msgs << I18n.t('address.import.not_valid_teams') + ': '+team_id.to_s
             break

programming_language: Ruby
filename: comment.rb
change_type: ModificationType.MODIFY
diff: @@ -104,8 +104,7 @@ class Comment < ActiveRecord::Base
     rescue => evar
       Log.add_error(nil, evar)
     end
-    attachments = [] if attachments.nil?
-    return attachments
+    return (attachments || [])
   end
 
   #=== self.get_toys
@@ -160,5 +159,4 @@ class Comment < ActiveRecord::Base
     end
     return entries
   end
-
 end

programming_language: Ruby
filename: email.rb
change_type: ModificationType.MODIFY
diff: @@ -53,7 +53,7 @@ class Email < ActiveRecord::Base
 # FEATURE_MAIL_STRICT_CAPACITY >>>
     if (email.status != Email::STATUS_TEMPORARY) \
         and (email.size > org_size)
-      mail_account = MailAccount.find_by_id(email.mail_account_id)
+      mail_account = MailAccount.find(email.mail_account_id)
       max_size = mail_account.get_capacity_mb * 1024 * 1024
       con = "(id != #{email.id})" unless email.id.nil?
       cur_size = MailAccount.get_using_size(mail_account.id, con)

programming_language: Ruby
filename: item.rb
change_type: ModificationType.MODIFY
diff: @@ -68,7 +68,11 @@ class Item < ActiveRecord::Base
     return false if self.source_id.nil?
 
     # Exclude those created from system templates.
-    src_item = Item.find_by_id(self.source_id)
+    begin
+      src_item = Item.find(self.source_id)
+    rescue => evar
+      src_item = nil
+    end
     if src_item.nil?
       return true
     else

programming_language: Ruby
filename: toy.rb
change_type: ModificationType.MODIFY
diff: @@ -125,7 +125,7 @@ class Toy < ActiveRecord::Base
     return [] if user.nil?
 
     toys = Toy.where("user_id=#{user.id}").to_a
-    deleted_ary = []
+    deleted_arr = []
 
     return [] if toys.nil?
 
@@ -134,7 +134,7 @@ class Toy < ActiveRecord::Base
         when Toy::XTYPE_ITEM
           item = Item.find_by_id(toy.target_id)
           if item.nil?
-            deleted_ary << toy
+            deleted_arr << toy
             next
           end
           Toy.copy(toy, item)
@@ -142,7 +142,7 @@ class Toy < ActiveRecord::Base
         when Toy::XTYPE_COMMENT
           comment = Comment.find_by_id(toy.target_id)
           if comment.nil?
-            deleted_ary << toy
+            deleted_arr << toy
             next
           end
           Toy.copy(toy, comment)
@@ -150,7 +150,7 @@ class Toy < ActiveRecord::Base
         when Toy::XTYPE_WORKFLOW
           workflow = Workflow.find_by_id(toy.target_id)
           if workflow.nil?
-            deleted_ary << toy
+            deleted_arr << toy
             next
           end
           Toy.copy(toy, workflow)
@@ -158,7 +158,7 @@ class Toy < ActiveRecord::Base
         when Toy::XTYPE_SCHEDULE
           schedule = Schedule.find_by_id(toy.target_id)
           if schedule.nil?
-            deleted_ary << toy
+            deleted_arr << toy
             next
           end
           Toy.copy(toy, schedule)
@@ -166,16 +166,16 @@ class Toy < ActiveRecord::Base
         when Toy::XTYPE_FOLDER
           folder = Folder.find_by_id(toy.target_id)
           if folder.nil?
-            deleted_ary << toy
+            deleted_arr << toy
             next
           end
           Toy.copy(toy, folder)
       end
     end
 
-    deleted_ary.each do |toy|
-      toys.delete toy
-      Toy.destroy toy.id
+    deleted_arr.each do |toy|
+      toys.delete(toy)
+      Toy.destroy(toy.id)
     end
 
     return toys

programming_language: Ruby
filename: user.rb
change_type: ModificationType.MODIFY
diff: @@ -1131,7 +1131,11 @@ class User < ActiveRecord::Base
       if (/^|([0-9]+|)+$/ =~ self.groups) == 0
 
         self.get_groups_a.each do |group_id|
-          group = Group.find_by_id(group_id)
+          begin
+            group = Group.find(group_id)
+          rescue => evar
+            group = nil
+          end
           if group.nil?
             err_msgs << I18n.t('user.import.not_valid_groups') + ': '+group_id.to_s
             break

programming_language: Ruby
filename: _mail_filter_form.html.erb
change_type: ModificationType.MODIFY
diff: @@ -6,7 +6,8 @@ if params[:mail_account_id].blank?
 else
   mail_account_id = params[:mail_account_id]
 end
-mail_account = MailAccount.find_by_id(mail_account_id)
+SqlHelper.validate_token([mail_account_id])
+mail_account = MailAccount.find(mail_account_id)
 %>
 
 <%= render(:partial => 'common/error', :locals => {:obj => @mail_filter}) %>

programming_language: PHP
repo_url: https://github.com/sysphonic/thetis
commit_details: repo_url: https://github.com/sysphonic/thetis
author: MORITA Shintaro
author_date: 2015-07-12 22:32:50+09:00
msg: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>
repository: repo_url: https://github.com/sysphonic/thetis
repo_name: sysphonic/thetis
description: Free Open-Source Goupware / Web Collaboration Suite
repo_language: HTML
owner: sysphonic
file_changes: filename: items_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -354,12 +354,8 @@ class ItemsController < ApplicationController
     if params[:from_action].nil?
       render(:text => params[:id])
     else
-      params.delete(:controller)
-      params.delete(:action)
-      params.delete(:id)
       flash[:notice] = t('msg.delete_success')
-      params[:action] = params[:from_action]
-      redirect_to(params)
+      self.send(params[:from_action])
     end
   end
 

programming_language: Ruby
filename: locations_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -45,7 +45,7 @@ class LocationsController < ApplicationController
       con_second = []
       key_array = params[:keyword].split(nil)
       key_array.each do |key|
-        key_quot = ActiveRecord::Base.connection.quote(key)
+        key_quot = SqlHelper.quote(key)
         con_prim << "(name=#{key_quot} or fullname=#{key_quot} or email=#{key_quot})"
         con_second << SqlHelper.get_sql_like([:name, :fullname, :email], key)
       end

programming_language: Ruby
filename: templates_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -170,8 +170,6 @@ class TemplatesController < ApplicationController
   def copy
     Log.add_info(request, params.inspect)
 
-    return unless request.post?
-
     tmpl_id = params[:thetisBoxSelKeeper].split(':').last
     tmpl_item = Item.find(tmpl_id)
 

programming_language: Ruby
filename: zeptair_post_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -93,7 +93,7 @@ class ZeptairPostController < ApplicationController
     end
 
     unless zeptair_id.blank?
-      target_user = User.where("zeptair_id=#{zeptair_id}").first
+      target_user = User.where("zeptair_id=#{zeptair_id.to_i}").first
     end
 
     if target_user.nil?
@@ -153,7 +153,7 @@ class ZeptairPostController < ApplicationController
 
     unless zeptair_id.blank?
 
-      target_user = User.where("zeptair_id=#{zeptair_id}").first
+      target_user = User.where("zeptair_id=#{zeptair_id.to_i}").first
 
       unless @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id == target_user.id
         target_user = nil

programming_language: Ruby
filename: items_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@ module ItemsHelper
 
     SqlHelper.validate_token([user_id, source_id])
 
-    copied_items = Item.where("user_id=#{user_id} and source_id=#{source_id}").order('created_at DESC').to_a
+    copied_items = Item.where("user_id=#{user_id.to_i} and source_id=#{source_id.to_i}").order('created_at DESC').to_a
 
     rev = 0
     copied_items.each do |item|
@@ -54,7 +54,8 @@ module ItemsHelper
     my_folder = User.get_my_folder(user_id)
 
     unless my_folder.nil?
-      con = "(parent_id=#{my_folder.id}) and (name='#{Item.copies_folder}')"
+      folder_name_quot = SqlHelper.quote(Item.copies_folder)
+      con = "(parent_id=#{my_folder.id}) and (name=#{folder_name_quot})"
 
       begin
         copies_folder = Folder.where(con).first
@@ -89,7 +90,8 @@ module ItemsHelper
     my_folder = User.get_my_folder(user_id)
 
     unless my_folder.nil?
-      con = "(parent_id=#{my_folder.id}) and (name='#{Item.copies_folder}')"
+      folder_name_quot = SqlHelper.quote(Item.copies_folder)
+      con = "(parent_id=#{my_folder.id}) and (name=#{folder_name_quot})"
 
       begin
         copies_folder = Folder.where(con).first

programming_language: Ruby
filename: sql_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -51,7 +51,7 @@ module SqlHelper
   #
   def self.get_sql_like(attr_names, keyword)
 
-    key = ActiveRecord::Base.connection.quote("%#{SqlHelper.escape_for_like(keyword)}%")
+    key = SqlHelper.quote("%#{SqlHelper.escape_for_like(keyword)}%")
 
     con = []
     attr_names.each do |attr_name|
@@ -74,4 +74,16 @@ module SqlHelper
     return nil if str.nil?
     return str.to_s.gsub(/([%_])/){"\\" + $1}
   end
+
+  #=== self.quote
+  #
+  #Quotes string.
+  #
+  #_str_:: Target string.
+  #return:: Quoted string.
+  #
+  def self.quote(str)
+
+    return ActiveRecord::Base.connection.quote(str)
+  end
 end

programming_language: Ruby
filename: templates_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -31,7 +31,7 @@ module TemplatesHelper
   def self.setup_tmpl_folder
 
     begin
-      tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
+      tmpl_folder = Folder.where(name: TMPL_ROOT).first
     rescue
     end
     if tmpl_folder.nil?
@@ -117,7 +117,7 @@ module TemplatesHelper
   #
   def self.get_tmpl_folder
 
-    tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
+    tmpl_folder = Folder.where(name: TMPL_ROOT).first
 
     if tmpl_folder.nil?
 
@@ -168,10 +168,11 @@ module TemplatesHelper
 
     SqlHelper.validate_token([name])
 
-    tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
+    tmpl_folder = Folder.where(name: TMPL_ROOT).first
 
     unless tmpl_folder.nil?
-      con = "(parent_id=#{tmpl_folder.id}) and (name='#{name}')"
+      name_quot = SqlHelper.quote(name)
+      con = "(parent_id=#{tmpl_folder.id}) and (name=#{name_quot})"
       begin
         child = Folder.where(con).first
       rescue => evar

programming_language: Ruby
filename: tree_element.rb
change_type: ModificationType.MODIFY
diff: @@ -100,7 +100,7 @@ module TreeElement
 
     else
 
-      nodes = klass.where("parent_id=#{node_id}").order('xorder ASC, id ASC').to_a
+      nodes = klass.where("parent_id=#{node_id.to_i}").order('xorder ASC, id ASC').to_a
       if ret_obj
         array = nodes
       else
@@ -139,7 +139,7 @@ module TreeElement
     else
       con = Marshal.load(Marshal.dump(conditions)) + ' and '
     end
-    con << "(parent_id=#{node_id})"
+    con << "(parent_id=#{node_id.to_i})"
 
     tree[node_id] = klass.where(con).order(order_by).to_a
 

programming_language: Ruby
filename: zeptair_dist_helper.rb
change_type: ModificationType.MODIFY
diff: @@ -63,7 +63,7 @@ module ZeptairDistHelper
 
     SqlHelper.validate_token([item_id, user_id])
     begin
-      comment = Comment.where("(user_id=#{user_id}) and (item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").first
+      comment = Comment.where("(user_id=#{user_id.to_i}) and (item_id=#{item_id.to_i}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").first
     rescue => evar
       Log.add_error(nil, evar)
     end
@@ -145,7 +145,7 @@ module ZeptairDistHelper
   #
   def self.count_ack_users(item_id)
     SqlHelper.validate_token([item_id])
-    return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").count
+    return Comment.where("(item_id=#{item_id.to_i}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").count
   end
 
   #=== self.count_completed_users
@@ -158,7 +158,7 @@ module ZeptairDistHelper
   def self.count_completed_users(item_id)
     SqlHelper.validate_token([item_id])
     ack_msg = ZeptairDistHelper.completed_ack_message(item_id)
-    return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}') and (message='#{ack_msg}')").count
+    return Comment.where("(item_id=#{item_id.to_i}) and (xtype='#{Comment::XTYPE_DIST_ACK}') and (message='#{ack_msg}')").count
   end
 
   #=== self.get_feeds

programming_language: Ruby
filename: email.rb
change_type: ModificationType.MODIFY
diff: @@ -622,7 +622,7 @@ EOT
     SqlHelper.validate_token([user_id, mail_account_id])
 
     begin
-      count = Email.where("mail_account_id=#{mail_account_id}").count
+      count = Email.where("mail_account_id=#{mail_account_id.to_i}").count
       if count > max
 #logger.fatal("[INFO] Email.trim(user_id:#{user_id}, mail_account_id:#{mail_account_id}, max:#{max})")
         over_num = count - max
@@ -639,7 +639,7 @@ EOT
         # Now, remove others
         if emails.length < over_num
           over_num -= emails.length
-          emails += Email.where("mail_account_id=#{mail_account_id}").order('updated_at ASC').limit(over_num).to_a
+          emails += Email.where("mail_account_id=#{mail_account_id.to_i}").order('updated_at ASC').limit(over_num).to_a
         end
 
         emails.each do |email|
@@ -686,7 +686,7 @@ EOT
 #
 #      # Now, remove others
 #      if over_size > 0
-#        emails = Email.where("mail_account_id=#{mail_account_id}").order('updated_at ASC').to_a
+#        emails = Email.where("mail_account_id=#{mail_account_id.to_i}").order('updated_at ASC').to_a
 #        emails.each do |email|
 #          next if email.size.nil?
 #
@@ -762,7 +762,7 @@ EOT
 
     SqlHelper.validate_token([user_id])
 
-    con = "user_id=#{user_id}"
+    con = "(user_id=#{user_id.to_i})"
     con << " and (#{add_con})" unless add_con.nil? or add_con.empty?
     emails = Email.where(con).to_a
 

programming_language: Ruby
filename: folder.rb
change_type: ModificationType.MODIFY
diff: @@ -240,18 +240,18 @@ class Folder < ActiveRecord::Base
     if group_id.to_s == '0'
       sql = 'select distinct * from folders'
 
-      where = " where (parent_id = #{tree_id})"
-      where << " and ((xtype is null) or not(xtype = '#{XTYPE_GROUP}' or xtype = '#{XTYPE_USER}'))"
+      where = " where (parent_id=#{tree_id.to_i})"
+      where << " and ((xtype is null) or not((xtype='#{XTYPE_GROUP}') or (xtype='#{XTYPE_USER}')))"
 
       order_by = ' order by xorder ASC, id ASC'
     else
       sql = 'select distinct Folder.* from folders Folder, users User'
 
-      where = " where (Folder.parent_id = #{tree_id})"
+      where = " where (Folder.parent_id=#{tree_id.to_i})"
       where << ' and ('
-      where <<      "(Folder.xtype = '#{XTYPE_GROUP}' and Folder.owner_id = #{group_id})"
+      where <<      "((Folder.xtype='#{XTYPE_GROUP}') and (Folder.owner_id=#{group_id.to_i}))"
       where <<      ' or '
-      where <<      "(Folder.xtype = '#{XTYPE_USER}' and  Folder.owner_id = User.id and #{SqlHelper.get_sql_like(['User.groups'], "|#{group_id}|")})"
+      where <<      "((Folder.xtype='#{XTYPE_USER}') and (Folder.owner_id=User.id) and #{SqlHelper.get_sql_like(['User.groups'], "|#{group_id}|")})"
       where <<     ' )'
 
       order_by = ' order by Folder.xorder ASC, Folder.id ASC'
@@ -324,7 +324,7 @@ class Folder < ActiveRecord::Base
     else
       con << ' and '
     end
-    con << "parent_id=#{tree_id}"
+    con << "parent_id=#{tree_id.to_i}"
     folder_tree[tree_id] += Folder.where(con).order('xorder ASC, id ASC').to_a
 
     delete_ary = []
@@ -668,7 +668,7 @@ class Folder < ActiveRecord::Base
       else
         con << ' and '
       end
-      con << "parent_id=#{folder_id}"
+      con << "parent_id=#{folder_id.to_i}"
 
       unless admin
         con << " and (xtype is null or not (xtype='#{Folder::XTYPE_SYSTEM}'))"

programming_language: Ruby
filename: group.rb
change_type: ModificationType.MODIFY
diff: @@ -376,7 +376,7 @@ class Group < ActiveRecord::Base
 
     SqlHelper.validate_token([group_id])
     begin
-      return Folder.where("(owner_id=#{group_id}) and (xtype='#{Folder::XTYPE_GROUP}')").first
+      return Folder.where("(owner_id=#{group_id.to_i}) and (xtype='#{Folder::XTYPE_GROUP}')").first
     rescue => evar
       Log.add_error(nil, evar)
       return nil

programming_language: Ruby
filename: location.rb
change_type: ModificationType.MODIFY
diff: @@ -48,7 +48,7 @@ class Location < ActiveRecord::Base
     if group_id.nil?
       con = 'group_id is null'
     else
-      con = "group_id=#{group_id}"
+      con = "group_id=#{group_id.to_i}"
     end
 
     Location.do_expire(con)

programming_language: Ruby
filename: mail_account.rb
change_type: ModificationType.MODIFY
diff: @@ -72,7 +72,7 @@ class MailAccount < ActiveRecord::Base
     SqlHelper.validate_token([mail_account_id])
 
     con = []
-    con << "(mail_account_id=#{mail_account_id})"
+    con << "(mail_account_id=#{mail_account_id.to_i})"
     con << "(#{add_con})" unless add_con.nil? or add_con.empty?
 
     return (Email.count_by_sql("select SUM(size) from emails where #{con.join(' and ')}") || 0)
@@ -156,7 +156,7 @@ class MailAccount < ActiveRecord::Base
 
     SqlHelper.validate_token([user_id])
 
-    con = "user_id=#{user_id}"
+    con = "(user_id=#{user_id.to_i})"
     con << " and (#{add_con})" unless add_con.nil? or add_con.empty?
     mail_accounts = MailAccount.where(con).to_a
 
@@ -258,7 +258,7 @@ class MailAccount < ActiveRecord::Base
     SqlHelper.validate_token([user_id, xtype])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << '(is_default=1)'
     con << "(xtype='#{xtype}')" unless xtype.blank?
 

programming_language: Ruby
filename: mail_filter.rb
change_type: ModificationType.MODIFY
diff: @@ -67,7 +67,7 @@ class MailFilter < ActiveRecord::Base
     SqlHelper.validate_token([mail_account_id, trigger])
 
     con = []
-    con << "(mail_account_id=#{mail_account_id})"
+    con << "(mail_account_id=#{mail_account_id.to_i})"
     con << "(enabled=#{(enabled)?(1):(0)})" unless enabled.nil?
     con << SqlHelper.get_sql_like([:triggers], "|#{trigger}|") unless trigger.nil?
 

programming_language: Ruby
filename: mail_folder.rb
change_type: ModificationType.MODIFY
diff: @@ -122,6 +122,8 @@ class MailFolder < ActiveRecord::Base
   #
   def self.get_condtions_for(user, mail_account_ids)
 
+    SqlHelper.validate_token([mail_account_ids])
+
     if mail_account_ids.nil? or mail_account_ids.empty?
       return "(user_id=#{user.id} and (mail_account_id is null))"
     else
@@ -151,8 +153,8 @@ class MailFolder < ActiveRecord::Base
     SqlHelper.validate_token([user_id, mail_account_id, xtype])
 
     con = []
-    con << "(user_id=#{user_id})"
-    con << "(mail_account_id=#{mail_account_id})"
+    con << "(user_id=#{user_id.to_i})"
+    con << "(mail_account_id=#{mail_account_id.to_i})"
     con << "(xtype='#{xtype}')"
 
     return MailFolder.where(con.join(' and ')).first
@@ -178,7 +180,7 @@ class MailFolder < ActiveRecord::Base
     SqlHelper.validate_token([user_id])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << "(xtype='#{MailFolder::XTYPE_ACCOUNT_ROOT}')"
 
     order_by = 'xorder ASC, id ASC'

programming_language: Ruby
filename: office_map.rb
change_type: ModificationType.MODIFY
diff: @@ -37,10 +37,10 @@ class OfficeMap < ActiveRecord::Base
       office_map = nil
     else
       if incl_img_content
-        office_map = OfficeMap.where("group_id=#{group_id}").first
+        office_map = OfficeMap.where("group_id=#{group_id.to_i}").first
       else
         sql = 'select id, group_id, img_enabled, img_name, img_size, img_content_type, created_at, updated_at from office_maps'
-        sql << " where group_id=#{group_id}"
+        sql << " where group_id=#{group_id.to_i}"
         begin
           office_map = OfficeMap.find_by_sql(sql).first
         rescue

programming_language: Ruby
filename: official_title.rb
change_type: ModificationType.MODIFY
diff: @@ -70,7 +70,7 @@ class OfficialTitle < ActiveRecord::Base
 
       con << '(' + group_con + ')'
     else
-      con << "(group_id=#{group_id})"
+      con << "(group_id=#{group_id.to_i})"
     end
 
     order_by = 'order by xorder ASC, id ASC'

programming_language: Ruby
filename: paid_holiday.rb
change_type: ModificationType.MODIFY
diff: @@ -34,11 +34,11 @@ class PaidHoliday < ActiveRecord::Base
 
     begin
       con = []
-      con << "(user_id=#{user_id})"
+      con << "(user_id=#{user_id.to_i})"
       if fiscal_year.nil?
         return PaidHoliday.where(con).order('year ASC').to_a
       else
-        con << "(year=#{fiscal_year})"
+        con << "(year=#{fiscal_year.to_i})"
         return PaidHoliday.where(con.join(' and ')).first
       end
     rescue
@@ -61,8 +61,8 @@ class PaidHoliday < ActiveRecord::Base
 
     if num <= 0
       con = []
-      con << "(user_id=#{user_id})"
-      con << "(year=#{fiscal_year})"
+      con << "(user_id=#{user_id.to_i})"
+      con << "(year=#{fiscal_year.to_i})"
       PaidHoliday.destroy_all(con.join(' and '))
       return
     end
@@ -100,7 +100,7 @@ class PaidHoliday < ActiveRecord::Base
     return 0 if paidhld_carry_over.nil? or paidhld_carry_over.empty? or paidhld_carry_over == PaidHoliday::CARRY_OVER_NONE
 
     begin
-      con = "(user_id=#{user_id}) and (year < #{year})"
+      con = "(user_id=#{user_id.to_i}) and (year < #{year.to_i})"
       paidhlds = PaidHoliday.where(con).order('year ASC').to_a
     rescue
     end

programming_language: Ruby
filename: research.rb
change_type: ModificationType.MODIFY
diff: @@ -358,7 +358,7 @@ class Research < ActiveRecord::Base
 
     SqlHelper.validate_token([user_id])
 
-    return Research.where("user_id=#{user_id}").first
+    return Research.where("user_id=#{user_id.to_i}").first
   end
 
   #=== self.get_q_codes

programming_language: Ruby
filename: setting.rb
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
@@ -33,7 +33,7 @@ class Setting < ActiveRecord::Base
     SqlHelper.validate_token([user_id, category])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << "(category='#{category}')" unless category.nil?
 
     settings = Setting.where(con.join(' and ')).to_a
@@ -63,7 +63,7 @@ class Setting < ActiveRecord::Base
     SqlHelper.validate_token([user_id, category, key])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
@@ -88,7 +88,7 @@ class Setting < ActiveRecord::Base
     SqlHelper.validate_token([user_id, category, key])
 
     con = []
-    con << "(user_id=#{user_id})"
+    con << "(user_id=#{user_id.to_i})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
@@ -127,7 +127,7 @@ class Setting < ActiveRecord::Base
     SqlHelper.validate_token([group_id, category])
 
     con = []
-    con << "(group_id=#{group_id})"
+    con << "(group_id=#{group_id.to_i})"
     con << "(category='#{category}')" unless category.nil?
 
     settings = Setting.where(con.join(' and ')).to_a
@@ -157,7 +157,7 @@ class Setting < ActiveRecord::Base
     SqlHelper.validate_token([group_id, category, key])
 
     con = []
-    con << "(group_id=#{group_id})"
+    con << "(group_id=#{group_id.to_i})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
@@ -182,7 +182,7 @@ class Setting < ActiveRecord::Base
     SqlHelper.validate_token([group_id, category, key])
 
     con = []
-    con << "(group_id=#{group_id})"
+    con << "(group_id=#{group_id.to_i})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 

programming_language: Ruby
filename: team.rb
change_type: ModificationType.MODIFY
diff: @@ -367,7 +367,7 @@ class Team < ActiveRecord::Base
 
     SqlHelper.validate_token([team_id])
     begin
-      return Folder.where("(owner_id=#{team_id}) and (xtype='#{Folder::XTYPE_TEAM}')").first
+      return Folder.where("(owner_id=#{team_id.to_i}) and (xtype='#{Folder::XTYPE_TEAM}')").first
     rescue => evar
       Log.add_error(nil, evar)
       return nil
@@ -411,7 +411,7 @@ class Team < ActiveRecord::Base
 
     user_con_a = []
     user_ids.each do |user_id|
-      user_con_a << "(user_id=#{user_id})"
+      user_con_a << "(user_id=#{user_id.to_i})"
     end
 
     con << '(' + user_con_a.join(' or ') + ')'

programming_language: Ruby
filename: timecard.rb
change_type: ModificationType.MODIFY
diff: @@ -429,7 +429,7 @@ class Timecard < ActiveRecord::Base
 
     SqlHelper.validate_token([user_id, date_s])
     begin
-      con = "(user_id=#{user_id}) and (date='#{date_s}')"
+      con = "(user_id=#{user_id.to_i}) and (date='#{date_s}')"
       return Timecard.where(con).first
     rescue
     end
@@ -452,7 +452,7 @@ class Timecard < ActiveRecord::Base
     start_s = start_date.strftime(Schedule::SYS_DATE_FORM)
     end_s = end_date.strftime(Schedule::SYS_DATE_FORM)
 
-    con = "(user_id=#{user_id}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
+    con = "(user_id=#{user_id.to_i}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
     ary = Timecard.where(con).order('date ASC').to_a
     timecards_h = Hash.new
     unless ary.nil?

programming_language: Ruby
filename: toy.rb
change_type: ModificationType.MODIFY
diff: @@ -196,7 +196,7 @@ class Toy < ActiveRecord::Base
 
     SqlHelper.validate_token([xtype, target_id])
 
-    con = "(user_id=#{user.id}) and (xtype='#{xtype}') and (target_id=#{target_id})"
+    con = "(user_id=#{user.id}) and (xtype='#{xtype}') and (target_id=#{target_id.to_i})"
 
     begin
       toy = Toy.where(con).first

programming_language: Ruby
filename: user.rb
change_type: ModificationType.MODIFY
diff: @@ -780,7 +780,7 @@ class User < ActiveRecord::Base
   def self.get_my_folder(user_id)
 
    SqlHelper.validate_token([user_id])
-   return Folder.where("(owner_id=#{user_id}) and (xtype='#{Folder::XTYPE_USER}')").first
+   return Folder.where("(owner_id=#{user_id.to_i}) and (xtype='#{Folder::XTYPE_USER}')").first
   end
 
   #=== create_my_folder
@@ -1166,7 +1166,7 @@ class User < ActiveRecord::Base
     end
 
     SqlHelper.validate_token([order])
-    User.update_all("xorder=#{order}", con)
+    User.update_all("xorder=#{order.to_i}", con)
   end
 
   #=== rename_title

programming_language: Ruby
filename: show_tree.html.erb
change_type: ModificationType.MODIFY
diff: @@ -45,7 +45,7 @@ var modified_teams = 0;
             <input type="button" value="<%= t('btn.new') %>" onclick="onCreateClicked(getPos(this));" style="width:80px;" />
             <input type="button" value="<%= t('btn.rename') %>" onclick="onRenameFolderClicked(getPos(this));" style="width:80px;" />
             <input type="button" value="<%= t('btn.delete') %>" onclick="doDelete();" style="width:80px;" />
-            <input type="button" value="<%= t('btn.move') %>" onclick="doMove();" style="width:80px;" />
+            <input type="button" value="<%= t('btn.move') %>" onclick="onMoveFolderClicked();" style="width:80px;" />
           </td>
         <% else %>
           <td style="padding:5px 20px; text-align:left;">
@@ -492,7 +492,7 @@ function _doDelete(folder_id)
             );
 }
 
-function doMove()
+function onMoveFolderClicked()
 {
   if (document.form_folder_tree.selKeeper.value == "") {
     msg("<%= t('folder.select') %>");
@@ -514,13 +514,26 @@ function doMove()
 
   ThetisBox.openTree("folderTree:"+folder_id, true);
 
+  var addParams = new Array();
+  addParams.push("id="+folder_id);
+  addParams.push("authenticity_token=<%= form_authenticity_token %>");
+
   var thetisBox = new ThetisBox;
-  thetisBox.progress = true;
-  thetisBox.setAdditionalParams(new Array("id="+folder_id, "authenticity_token=<%= form_authenticity_token %>"));
-  thetisBox.show("CENTER", "", "TREE", "<%= url_for(:controller => 'folders', :action => 'move') %>", "<%= t('folder.select_dest')%>", "");
+  thetisBox.setAdditionalParams(addParams);
+  thetisBox.setFormTag("<form action=\"\" method=\"post\" onsubmit=\"doMoveFolder(this); return false;\">");
+  thetisBox.show("CENTER", "", "TREE", "", "<%= t('folder.select_dest')%>", "");
   thetisBox.setTree("<%= url_for(:controller => 'folders', :action => 'ajax_get_tree') %>?id="+folder_id, "0");
 }
 
+function doMoveFolder(frmTree)
+{
+  prog("TOP-RIGHT");
+
+  frmTree.method = "post";
+  frmTree.action = "<%= url_for(:controller => 'folders', :action => 'move') %>";
+  frmTree.submit();
+}
+
 function selectFolder(folder_id)
 {
   var select_opt = _z("select_opt");
@@ -640,7 +653,7 @@ function doApplyAuthUsers(folder_id)
   addParams.push("id=" + folder_id);
   addParams.push(Form.serialize(document.form_folder_auth));
 
-  doUpdateView("get", "<%= url_for(:controller => 'folders', :action => 'set_auth_users') %>", addParams);
+  doUpdateView("post", "<%= url_for(:controller => 'folders', :action => 'set_auth_users') %>", addParams);
 }
 
 function selectTabGroups(folder_id)
@@ -669,7 +682,7 @@ function doApplyAuthGroups(folder_id)
   addParams.push("id=" + folder_id);
   addParams.push(Form.serialize(document.form_folder_auth));
 
-  doUpdateView("get", "<%= url_for(:controller => 'folders', :action => 'set_auth_groups') %>", addParams);
+  doUpdateView("post", "<%= url_for(:controller => 'folders', :action => 'set_auth_groups') %>", addParams);
 }
 
 function selectTabTeams(folder_id)
@@ -698,7 +711,7 @@ function doApplyAuthTeams(folder_id)
   addParams.push("id=" + folder_id);
   addParams.push(Form.serialize(document.form_folder_auth));
 
-  doUpdateView("get", "<%= url_for(:controller => 'folders', :action => 'set_auth_teams') %>", addParams);
+  doUpdateView("post", "<%= url_for(:controller => 'folders', :action => 'set_auth_teams') %>", addParams);
 }
 
 function showGroupTreeToSelect(group_id)

programming_language: PHP
filename: _footer.html.erb
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 
 <table style="width:100%; height:8px; padding:0px; border-spacing:0px;" background="<%= THETIS_RELATIVE_URL_ROOT %>/images/woody.png">
   <tr>
-    <td style="text-align:center; color:white; font-size:8px; line-height:1.0;">
+    <td style="text-align:center; color:white; font-size:8px; line-height:1.0; padding:0px;">
       <a href="javascript:this.onclick()" style="color:white; text-decoration:none; cursor:pointer;" onclick="openWindow('<%= url_for(:controller => 'frames', :action => 'about') %>',600, 360, 'about'); return false;">&copy;2007-2015 Thetis Developers</a>
     </td>
   </tr>

programming_language: PHP
filename: show_tree.html.erb
change_type: ModificationType.MODIFY
diff: @@ -11,7 +11,7 @@
             <input type="button" value="<%= t('btn.new') %>" onclick="onCreateGroupClicked(getPos(this));" style="width:80px;" />
             <input type="button" value="<%= t('btn.rename') %>" onclick="onRenameGroupClicked(getPos(this));" style="width:80px;" />
             <input type="button" value="<%= t('btn.delete') %>" onclick="doDelete();" style="width:80px;" />
-            <input type="button" value="<%= t('btn.move') %>" onclick="doMove();" style="width:80px;"/>
+            <input type="button" value="<%= t('btn.move') %>" onclick="onMoveGroupClicked();" style="width:80px;"/>
           <% else %>
             <%= t('group.only_admin_can_edit_tree') %>
           <% end %>
@@ -279,7 +279,7 @@ function _doDelete(group_id)
         );
 }
 
-function doMove()
+function onMoveGroupClicked()
 {
   if (document.form_group_tree.selKeeper.value == "") {
     msg("<%= t('group.select') %>");
@@ -294,13 +294,26 @@ function doMove()
 
   ThetisBox.openTree("groupTree:"+group_id, true);
 
+  var addParams = new Array();
+  addParams.push("id="+group_id);
+  addParams.push("authenticity_token=<%= form_authenticity_token %>");
+
   var thetisBox = new ThetisBox;
-  thetisBox.progress = true;
-  thetisBox.setAdditionalParams(new Array("id="+group_id, "authenticity_token=<%= form_authenticity_token %>"));
-  thetisBox.show("CENTER", "", "TREE", "<%= url_for(:controller => 'groups', :action => 'move') %>", "<%= t('group.select_dest')%>", "");
+  thetisBox.setAdditionalParams(addParams);
+  thetisBox.setFormTag("<form action=\"\" method=\"post\" onsubmit=\"doMoveGroup(this); return false;\">");
+  thetisBox.show("CENTER", "", "TREE", "", "<%= t('group.select_dest')%>", "");
   thetisBox.setTree("<%= url_for(:controller => 'groups', :action => 'ajax_get_tree') %>?id="+group_id, "0");
 }
 
+function doMoveGroup(frmTree)
+{
+  prog("TOP-RIGHT");
+
+  frmTree.method = "post";
+  frmTree.action = "<%= url_for(:controller => 'groups', :action => 'move') %>";
+  frmTree.submit();
+}
+
 function doGetUsers(group_id)
 {
   var addParams = new Array();

programming_language: HTML
filename: list.html.erb
change_type: ModificationType.MODIFY
diff: @@ -228,12 +228,13 @@ doExecNowFilters = function(mail_account_id, folder_id)
   var addParams = new Array();
   addParams.push("mail_account_id="+mail_account_id);
   addParams.push("mail_folder_id="+folder_id);
+  addParams.push("authenticity_token=<%= form_authenticity_token %>");
 
   var thetisBoxProgress = prog("TOP-RIGHT");
   new Ajax.Request(
               "<%= url_for(:controller => 'mail_filters', :action => 'do_execute') %>",
               {
-                method:"get",
+                method:"post",
                 asynchronous:true,
                 evalScripts:true,
                 parameters:addParams.join("&"),

programming_language: PHP
filename: show_tree.html.erb
change_type: ModificationType.MODIFY
diff: @@ -88,7 +88,7 @@
                         <a class="context_menu_item" href="javascript:this.onclick()" onclick="onRenameFolderClicked(); return false;">
                           <%= t('btn.rename') %>
                         </a>
-                        <a class="context_menu_item" href="javascript:this.onclick()" onclick="doMove(); return false;">
+                        <a class="context_menu_item" href="javascript:this.onclick()" onclick="onMoveFolderClicked(); return false;">
                           <%= t('btn.move') %>
                         </a>
                         <a class="context_menu_item" href="javascript:this.onclick()" onclick="doDelete(); return false;">
@@ -650,7 +650,7 @@ function _doDelete(folder_id)
     );
 }
 
-function doMove()
+function onMoveFolderClicked()
 {
   if (document.form_folder_tree.selKeeper.value == "") {
     msg("<%= t('folder.select') %>");
@@ -671,19 +671,29 @@ function doMove()
 
   ThetisBox.openTree("mailTree:"+folder_id, true);
 
-  var thetisBox = new ThetisBox;
-  thetisBox.progress = true;
   var addParams = new Array();
 <% unless params[:mail_account_xtype].nil? %>
   addParams.push("mail_account_xtype=<%= params[:mail_account_xtype] %>");
 <% end %>
   addParams.push("id="+folder_id);
   addParams.push("authenticity_token=<%= form_authenticity_token %>");
+
+  var thetisBox = new ThetisBox;
   thetisBox.setAdditionalParams(addParams);
-  thetisBox.show("CENTER", "", "TREE", "<%= url_for(:controller => 'mail_folders', :action => 'move') %>", "<%= t('folder.select_dest') %>", "");
+  thetisBox.setFormTag("<form action=\"\" method=\"post\" onsubmit=\"doMoveFolder(this); return false;\">");
+  thetisBox.show("CENTER", "", "TREE", "", "<%= t('folder.select_dest') %>", "");
   thetisBox.setTree("<%= url_for(:controller => 'mail_folders', :action => 'ajax_get_tree') %>?id="+folder_id, "0");
 }
 
+function doMoveFolder(frmTree)
+{
+  prog("TOP-RIGHT");
+
+  frmTree.method = "post";
+  frmTree.action = "<%= url_for(:controller => 'mail_folders', :action => 'move') %>";
+  frmTree.submit();
+}
+
 function doSelectTree(folder_id)
 {
   var menuId = "a_mailTree:" + folder_id;
@@ -1008,7 +1018,7 @@ function _doEmpty(folder_id)
   }
 
   invalidateAccountSummary();
-  doUpdateViewMails("get", "<%= url_for(:controller => 'mail_folders', :action => 'empty') %>", addParams, folder_id);
+  doUpdateViewMails("post", "<%= url_for(:controller => 'mail_folders', :action => 'empty') %>", addParams, folder_id);
 }
 
 

programming_language: PHP
filename: de.yml
change_type: ModificationType.MODIFY
diff: @@ -431,7 +431,7 @@ de:
     select_dest: "Bitte wählen Sie das Ziel zu verschieben aus."
     delete_info1: "] wird gelöscht."
     delete_info2: "(Falls Gruppenordner ist nicht leer, wird das mit R/W (Lesen u. Schreiben) Befugnisse der Mitgliedern weiterbleiben. Wenn keine Mitgliedern in Gruppe geben und keine andere Befugnisse zu Gruppenordner angegeben werden, wird das Veröffentlicht.)"
-    select_to_show: "(Bitte wählen Sie Gruppe zu zeigen aus.)"
+    select_to_show: "Bitte wählen Sie Gruppe zu zeigen aus."
     select_to_change_to: "Bitte wählen Sie Gruppe zu ersetzen durch aus."
     select_to_add: "Bitte wählen Sie Gruppe hinzuzufügen."
     other_group: "Andere Gruppe"

programming_language: CoffeeScript
filename: en.yml
change_type: ModificationType.MODIFY
diff: @@ -431,7 +431,7 @@ en:
     select_dest: "Please select destination group."
     delete_info1: "] will be deleted."
     delete_info2: "(If Group Folder is not empty, it will remain with members' R/W authorities. When no members in the Group and no other authorities specified to Group Folder, it will be PUBLIC.)"
-    select_to_show: "(Please select a group to show.)"
+    select_to_show: "Please select a group to show."
     select_to_change_to: "Please select group to change to."
     select_to_add: "Please select group to add."
     other_group: "Other Group"

programming_language: CoffeeScript
filename: ja.yml
change_type: ModificationType.MODIFY
diff: @@ -435,7 +435,7 @@ ja:
     select_dest: "移動先を選択してください。"
     delete_info1: "」を削除します。"
     delete_info2: "（グループフォルダが空でなければメンバーの読み書き権限付きで残されます。グループにメンバーがおらず他に権限が設定されていない時は、グループフォルダは全ユーザーからアクセス可能になります。）"
-    select_to_show: "（表示するグループを選択してください）"
+    select_to_show: "表示するグループを選択してください。"
     select_to_change_to: "変更先のグループを選択してください。"
     select_to_add: "追加するグループを選択してください。"
     other_group: "他のグループ"

programming_language: CoffeeScript