/var/softaculous/rosariosis/
/var/softaculous/rosariosis
NameSizeModeActions
images/-0755rm
lang/-0755rm
php53/-0755rm
php56/-0755rm
php71/-0755rm
php81/-0755rm
php82/-0755rm
changelog.txt320540644editdlrm
clone.php38650644editdlrm
config.inc.php17620644editdlrm
edit.php51900644editdlrm
edit.xml4330644editdlrm
fileindex.php6020644editdlrm
import.php31440644editdlrm
info.xml20030644editdlrm
install.js9210644editdlrm
install.php83350644editdlrm
install.xml14250644editdlrm
md544590644editdlrm
notes.txt13240644editdlrm
update_pass.php2280644editdlrm
Edit: /var/softaculous/rosariosis/changelog.txt (32054B)
Changes in 12.9.3 ----------------- - Security fix #397 Unauthenticated stored XSS: remove HTML tags in SaveReport.php, thanks to @Bradsen - Only return 403 Forbidden code if not AJAX request in Warehouse.php - Logout if no Staff or Student session ID when modfunc=first-login in Warehouse.php Changes in 12.9.2 ----------------- - Fix SQL syntax error "AND STUDENT_ID IN()" when nothing to save in InputFinalGrades.php & EnterEligibility.php - SQL fix "Enroll student for next school year" when student is inactive in Enrollment.fnc.php - Fix saving new user when current Staff ID set (in other browser tab) & user has no permission to edit User Profile in User.php - CSP Do not save violations triggered by VisualSPHost in SaveReport.php - No user in session yet, send 403 Forbidden (99% chances its a bot) in Warehouse.php - Fix SQL error retro-compatibility with old Grade Level inputs in GetStuList.fnc.php - Corrections to the Spanish help texts translation in help.mo - Security fix #390 Reflected XSS - unescaped reflection into `
` in MenuReports.php, thanks to @MDnyn Changes in 12.9.1 ----------------- - Fix double escaping Course Period Short Name in Courses.php & Courses.fnc.php - Fix SQL error unknown column 'ssm.STUDENT_ID' in 'on clause', use explicit JOIN in Export.php - Security fix #377 IDOR: Unauthorized Cross-Roster Data Assignment in TakeAttendance.php, MakeReferral.php, EnterEligibility.php & InputFinalGrades.php - Security fix #378 BOLA: Students and parents can read other students' transcripts and schedules via `st_arr[]` bypass in Transcripts.fnc.php & PrintSchedules.php, thanks to @weilai-8 - Security fix #379 BOLA: Any authenticated user can read assignment details outside their enrolled courses via `assignment_id` parameter in Calendar.php, thanks to @weilai-8 - SQL use actual null value in DBUpdate() $columns param in AttendanceCodes.php, Menus.php, Accounts.php, ReportCardCommentCodes.php & Address.inc.php - CSP Do not save violations triggered by AdBlock360 in SaveReport.php - Add Italian help translation in locale/it_IT.utf8/, thanks to Stefania Binda Changes in 12.9 --------------- - Fix PHP warning undefined index when school was deleted in School.php & Schools.php - Security fix Request Forgery: remove modfunc= in links in MarkDownHTML.fnc.php - Performance: do not sort `functions/*.php` files in Warehouse.php - SQL performance: replace subqueries with LEFT JOINs in StaffBalances.php, StudentSummary.php, StudentBalances.php & Export.php - Use Select2 input when more than 12 Grade Levels in GetStuList.fnc.php & Search.fnc.php - Fix Format Credit Earned, display 0.33 instead of 0.333333333333333 in Transcripts.fnc.php - Security fix GitHub issue 301 IDOR in save/delete operations, program wide, thanks to @lighthousekeeper1212 - Change "only 1 grading period open at any given time" check from error to warning in MarkingPeriods.php - CSP Do not save violations triggered by "sandbox eval code" in SaveReport.php - First login, prefill form inputs with default "admin" username & password in index.php - HTML use number type for Days Absent and Course Period Absences widgets inputs in Absences.php & CpAbsences.php - HTML use number type for custom Number field inputs in Search.fnc.php - Fix show "Use Grade Scale Comments" checkbox for every tab in InputFinalGrades.php - Use button() with "+" icon instead of text link in MassDrops.php, MassRequests.php & MassSchedule.php - Fix skip begin / end dates / number if "No Value" checked in CustomFields.fnc.php - Security fix #372 forbid path traversal sequences in FileUpload.fnc.php, thanks to @kazisabu - Security fix #371 Request Forgery add CSRF token to links/forms containing `modfunc=` in PreparePHP_SELF.fnc.php, Warehouse.php, index.php, warehouse.js & Requests.js, thanks to @kazisabu - Remove `modfunc=` from Find a Student/User form URL if no modfunc set in Search.inc.php - Fix PHP8.5 deprecated using null as an array offset in Config.fnc.php - Multilingual course title: SQL fix search Course Title add wildcard in Requests.php - Remove `&modfunc=` from link, never actually used in Assignments.php, MassCreateAssignments.php, Courses.php & MarkingPeriods.php - Skip CSP violation triggered by domain: overbridgenet.com, .goguardian, tl.ytlogs.ru, mainf.global-cache.online & wallet.binance.com in SaveReport.php - Remove duplicate GET params from form URL (start & end date, others) in Percent.php, CategoryBreakdown.php, CategoryBreakdownTime.php, StudentFieldBreakdown.php, TransactionsReport.php, AddDrop.php, Calendar.php, StudentBreakdown.php & AddDropBreakdownTime.php - Security fix #375 Authenticated Time-based SQL Injection (non-student roles) in StudentSumary.php, thanks to @Cresp0 - Security fix #376 IDOR: Unauthorized Cross-School Data Assignment in AddAbsences.php, AddActivity.php, Requests.php, MassAssignFees.php, MassAssignPayments.php, AssignOtherInfo.php & AddStudents.php, thanks to @Cresp0 - HTML display checkbox before its label in MailingLabels.php, ProgressReports.php & PrintStudentInfo.php - Fix SQL error when "Search All Schools" checked: update UserMP() in Search.fnc.php - Default School Year: 2026 (2026-2027) in config.inc.sample.php, rosariosis.sql & rosariosis_mysql.sql - Add Italian translation in locale/it_IT.utf8/, thanks to Stefania Binda Changes in 12.8.1 ----------------- - Fix Advanced Search "No Value" for custom date and number fields in CustomFields.fnc.php - Fix SQL error escape CSP string in Content_Security_Policy/includes/common.fnc.php - Multilingual course title: use ParseMLField() in StudentList.php - Fix valid domain check: remove FILTER_VALIDATE_DOMAIN, too permissive in Content_Security_Policy/includes/common.fnc.php - Fix save various domains in Content_Security_Policy/config.inc.php - CSS theme FlatSIS fix "Prevent body from scrolling when submenu open" in stylesheet.css Changes in 12.8 --------------- - Fix PHP warning undefined array key when Meal Item Short Name was edited in MenuReports.php - Fix PHP8.5 deprecated using null as an array offset, use an empty string instead in program wide - Fix PHP warning undefined array key when switching Meals in ServeMenus.php - Fix SQL error when no Quarters found (Course widget) in Course.php - Fix PHP8.5 deprecated trim() Passing null to parameter 1 of type string in StudentFieldBreakdown.php & StudentBreakdown.php - Display Enrollment Calendar to Student in Calendar.php - CSS add .calendar-block class in CalendarDay.inc.php & stylesheet.css - CSS themes transition slide menu & help in rtl.css, stylesheet.css & zresponsive.css - JS slide menu & help, use CSS class .slide in warehouse.js - JS fix rt2colorBox if content is InputDivOnclick in warehouse.js - JS Prevent focusing input when opening tooltip on mobile devices in csp/functions.js - CSS themes search form adjustments & increase number input width in stylesheet.css & zresponsive.css - CSS FlatSIS theme adjust stackable list margin & colorBox padding in stylesheet.css & zresponsive.css - Sanitize redirect_to: remove &delete_ok=1 in index.php - Add $html parameter & pass $pdf object by reference to the functions/PDF.php|pdf_stop_pdf action hook in PDF.php & Actions.php - CSS FlatSIS theme style checkbox & radio inputs in checkbox-radio.css & Gruntfile.js - List Courses to Secondary Teacher in StudentGrades.php - Add Secondary Teacher to Tip Message in StudentGrades.php & StudentAssignments.fnc.php - Add RosarioSIS URL to Installation Poll in FirstLogin.fnc.php - SQL add comment to Student/User Field columns in rosariosis.sql & rosariosis_mysql.sql - SQL add comment to Field column in Fields.fnc.php, StudentFields.php, PeopleFields.php, AddressFields.php, SchoolFields.php & UserFields.php - Remove Database Backup program (secure by default) in DatabaseBackup.php, School_Setup/Menu.php, rosariosis.sql, rosariosis_mysql.sql - Remove $DatabaseDumpPath global variable in diagnostic.php, config.inc.sample.php, INSTALL.md, INSTALL_es.md & INSTALL_fr.md - Remove check for passthru function in Portal.php - Use SQLLimitForList() function in AddDrop.php & ClassSearchWidget.fnc.php - Use DBUpdate() function, program wide - Allow save unchecked state when checkbox field is required in AssignOtherInfo.php - Security fix arbitrary Table Row Deletion via `$_REQUEST['table']` in Medical.inc.php, thanks to @lighthousekeeper1212 - SQL performance: use explicit JOINs & remove School column in Portal.php - SQL performance + harmonize SQL logic for Block Periods in AddAbsences.phph, Administration.php, TakeAttendance.php, TeacherCompletion.php, UpdateAttendanceDaily.fnc.php & Courses.fnc.php - Skip CSP violation triggered by Facebook Click Identifier in SaveReport.php - Fix SQL error when staff is manually created in next school year in Rollover.php - Fix SQL error when school was created after Rollover and not rolling schools in Rollover.php - SQL add "Review RosarioSIS" link to Resources in rosariosis.sql & rosariosis_mysql.sql - Spanish translation: do not capitalize words & use "tú" instead of "usted" in rosariosis.po, help.po & rosariosis.sql Changes in 12.7.5 ----------------- - Fix SQL showing all assignment types when "Hide previous quarters assignment types" is checked in Assignments.php - Fix SQL error when Marking Period ID is Progress Period in GetMP.php Changes in 12.7.4 ----------------- - CSP Skip CSP violation triggered by domain: connect.facebook.net, safesearchinc.com, infird.com in SaveReport.php - Fix #367 SQL do not use GetStuList() so we get all students in class in Grades.fnc.php, thanks to @Macadoshis - JS Fix regression since 12.5 trigger change event when selecting date from calendar in calendar-setup.js Changes in 12.7.3 ----------------- - Fix Help button not showing help, compile error in plugins.min.js Changes in 12.7.2 ----------------- - Fix Checkbox input, use `_makeCheckboxInput()` function in Schools.php - Fix CSS responsive header, use .rseparator class in Grades.php, AnomalousGrades.php & Statements.php - Fix SQL error invalid input syntax for type date: "" in AssignOtherInfo.php - Fix Final Grade when assignments are weighted in StudentGrades.php - Fix Multilingual course title: use ParseMLField() in ProgressReports.php, thanks to @Macadoshis - Fix CSS responsive List width: do NOT use the .fixed-col class, use pure CSS in Schedule.inc.php - Fix regression since 12.5 JS update body on mobile: menu button adds #! to URL, remove hash in warehouse.js - Fix regression since 12.5 JS do not setInnerHTML if no target in warehouse.js - Fix CSS theme WPadmin menu loading icon height in stylesheet.css & zresponsive.css Changes 12.7.1 -------------- - Fix reassign existing Barcode to student Food Service account in Food_Service/Students/Accounts.php - Add `_skipDie()` function, used when skipping CSP report in SaveReport.php - Multilingual course title: use ParseMLField() in Schedule.inc.php - CSS responsive fix Schedule table, use .rbr class in Schedule.inc.php - Skip CSP violation triggered by safari-web-extension & sandbox eval code in SaveReport.php - Fix Chrome user logged out after CSP violation in SaveReport.php Changes in 12.7 --------------- - SQL allow array in $where_columns: WHERE COLUMN IN(val1,val2) in DBUpsert.php - Fix #363 Pull-Down field: add "No Value" option in AssignOtherInfo.php - Fix #363 Checkbox Field: save unchecked state in AssignOtherInfo.php - Fix #363 Auto Pull-Down field: add "-Edit-" option in AssignOtherInfo.php - Rework save logic & use DBUpdate() function in AssignOtherInfo.php - Move PhpMyAdmin\MoTranslator classes to match their namespace in classes/PhpMyAdmin/MoTranslator/ - Move Symfony\Polyfill classes to match their namespace in classes/Symfony/Polyfill/ - Remove XML-RPC compatibility classes in classes/PHPCompatibility/Xmlrpc/ - Remove XML-RPC compatibility functions in ProgramFunctions/PHPCompatibility/xmlrpc.php & plugins/Moodle/client.php - Move Services_JSON class to match its namespace (none) in classes/ - Move PHPMailer\PHPMailer classes to match their namespace in classes/PHPMailer/PHPMailer/ - Move mikehaertl classes to match their namespace in classes/mikehaertl/ - Move Shuchkin classes to match their namespace in classes/Shuchkin/ - Move StaffWidgets & Widgets classes to match their namespace in classes/RosarioSIS/ - Move StaffWidget classes to match their namespace in classes/RosarioSIS/StaffWidget/ - Move Widget classes to match their namespace in classes/RosarioSIS/Widget/ - Autoload classes (PSR-4): classes/[Namespace]/[Class].php in Warehouse.php - Autoload classes (PSR-4): remove require_once, program wide - Custom widget classes should now use \Addon_Name\StaffWidget\ or \Addon_Name\Widget\ namespace - Fix "Last Year Course" widget responsive: add .st class in modules/Scheduling/functions.inc.php - Deprecate PhpDebugBar() & Kint() functions in Debug.fnc.php - Minor corrections to the Russian and Ukrainian translations in rosariosis.po & rosariosis.sql - Simplify PHP logic of HackingLog(): 17 lines gain in HackingLog.fnc.php - Use MultipleCheckboxInput() function in `_makeMultipleInput()` in StudentsUsersInfo.fnc.php - Fix PHP8.5 deprecated curl_close() function in curl.php - Double (free) Comment input size when MP does not do Comments in InputFinalGrades.php - Misconfiguration hint: Scale Value different from max GPA Value in ReportCardGrades.php - Misconfiguration hint: Minimum Passing Grade > Scale Value in ReportCardGrades.php - CSS themes enlarge custom Numeric field in stylesheet.css - HTML increase "Course" input maxlength to 100 in EditReportCardGrades.php - HTML use number type for Grade and Credit inputs in EditReportCardGrades.php - Do not save CSP violations triggered by browser extensions, some domains & custom ones in SaveReport.php - Add Czech (Czech Republic) translation in locale/cz_CZ.utf8/ - Fix regression since 12.5 Calendar select input was erasing calendar days in Calendar.php - Fix PHP8.5 deprecated imagedestroy() function in ImageResizeGD.php Changes in 12.6 --------------- - HTML responsive stackable tables in Export.php - Export list: add Total row in ListOutput.fnc.php - Add rounded flag icons in locale/[locale_code]/flag.png - Fix #362 Order by Points as Letter Grade is alphabetically sorted (may be inaccurate) in Grades.php - Add Activity field is required + "Remove" activity (instead of "Delete") in Eligibility/Student.php - Fix responsive image height, rename $width param to $height in FS_Icons.inc.php & MenuItems.php - HTML add fieldset & padding to PopTable in MassRequests.php - CSS add .class-picture class in PrintClassPictures.php - CSS fix #365 pictures width, height & name overflow in PrintClassPictures.php - Remove `_saveRosarioModules()` local function, use Config() in Modules.inc.php - Remove `_saveRosarioPlugins()` local function, use Config() in Plugins.inc.php - CSS Fix first column (list, table) in DailySummary.php, Grades.php, Search.inc.php, rtl.css, stylesheet.css & zresponsive.css - CSS FlatSIS theme reduce bottom buttons height in stylesheet.css & zresponsive.css - Display short month and year labels instead of short month only in CategoryBreakdownTime.php - SQL order Transcript Grades by Course Title in Transcripts.fnc.php - Add Administrator option to Visible To User Profiles in Resources.fnc.php, rosariosis.sql & rosariosis_mysql.sql - Create Student Account: Force Default School in index.php, Configuration.php, Student.php, General_Info.inc.php, rosariosis.sql & rosariosis_mysql.sql - SQL add csp_reports table in rosariosis.sql & rosariosis_mysql.sql - Add Content Security Policy plugin in plugins/Content_Security_Policy/, rosariosis.sql & rosariosis_mysql.sql - Update to version 12.6 in Update.fnc.php - Add Content-Security-Policy-Report-Only HTTP header in Warehouse.php - Fix SQL error foreign keys: force roll Schools in Rollover.php - Update French & Spanish translations in rosariosis.po - Add Russian & Ukrainian translations in InstallDatabase.php, locale/ru_RU.utf8/ & locale/uk_UA.utf8/ Changes in 12.5 --------------- - Add '&modfunc=save' to form URL in Expenses.php, Incomes.php, Salaries.php, StaffPayments.php, DisciplineForm.php, Referrals.php, EnterEligibility.php, InputFinalGrades.php, StudentFees.php, StudentPayments.php & Preferences.php - SQL case-insensitive username uniqueness check in ImportUsers.fnc.php - Fix HTML error label's for attribute doesn't match any element id in General_Info.php - Fix add .tinymce CSS class when class already set in $extra param in Inputs.php - JS add CSP root, functions & programFunctions (global, always loaded) in Gruntfile.js, assets/js/csp/ - JS add setInnerHTML() function in warehouse.js - JS add submenuOnTouch() function in warehouse.js - JS Prevent submitting form if no checkboxes are checked in warehouse.js & Inputs.php - JS add bottomButtonClick() Bottom.php buttons click related events in warehouse.js & Bottom.php - JS deprecate switchMenu() function: use `
` instead in warehouse.js, General_Info.inc.php, Search.fnc.php & Widgets.php - JS ajaxPrepare(): handle #ajax_update_body, #menu_user_session & #warehouse_user_session in warehouse.js, Side.php & Warehouse.php - JS use #x_redirect_url value instead of XRedirectUrl global var in warehouse.js & PreparePHP_SELF.fnc.php - JS Trigger custom ajaxPrepare event in warehouse.js - Deprecate `_printPageHead()` function & rework display logic in PasswordHelp.php - JS add backPrompt() function in BackPrompt.js & Prompts.php - JS remove inline code from CaptchaInput() in Inputs.php & CaptchaInput.js - JS remove inline code from FileInput() in Inputs.php & FileInput.js - JS remove inline code from MLTextInput() in Inputs.php & MLTextInput.js - JS remove inline code from MarkDownInputPreview() in Inputs.php & MarkDownInputPreview.js - JS required group of checkboxes in Inputs.php & MultipleCheckboxInput.js - JS remove inline code from PasswordInput() in Inputs.php & PasswordInput.js - JS remove inline code from DeletePrompt() & Prompt() + add .button-prompt-cancel CSS class in Prompts.php & Prompt.js - JS remove inline code from Search() in Search.fnc.php & Search.js - JS remove inline code from Select2Input() in Inputs.php & Select2Input.js - JS remove inline code from TinyMCEInput() in Inputs.php & TinyMCEInput.js - JS remove inline code from Widget_course in Widget.php & Course.js - JS remove inline AJAX call in ClassRank.inc.php, FinalGrades.inc.php, Addon.fnc.php, Modules.inc.php, Plugins.inc.php & AjaxUrl.js - JS remove inline code from MoodleImportFormSubmitJS() in Moodles/config.inc.php, ImportUsers.fnc.php & ImportFormSubmit.js - JS remove inline reload menu code in MarkingPeriods.php, Rollover.php, Modules.inc.php, Profiles.php & ReloadMenu.js - JS remove inline code from `_makePaymentsCommentsInput()` in Accounting/functions.inc.php & MakePaymentsCommentsInput.js - JS remove inline code from program in Administration.php & Administration.js - JS remove inline code from program in FixDailyAttendance.php & FixDailyAttendance.js - JS remove inline code from RegistrationAdminContactEnable() in RegistrationAdmin.fnc.php & RegistrationAdminContactEnable.js - JS remove inline code from RegistrationSiblingUseContactsAddress() in Registration.fnc.php & RegistrationSiblingUseContactsAddress.js - JS remove inline code from program in MassCreateAssignments.php & MassCreateAssignments.js - JS remove inline code from StudentAssignmentSubmissionOutput() in StudentAssignments.fnc.php & StudentAssignmentSubmissionOutput.js - JS remove inline code from program in ChooseCourse.php & ChooseCourse.js - JS remove inline code from program in ChooseRequest.php & ChooseRequest.js - JS remove inline code from program in Export.php & Export.js - JS remove inline code from program in Courses.php & Courses.js - JS remove inline code from program in MassDrops.php & MassDrops.js - JS remove inline code from program in MassRequests.php & MassRequests.js - JS remove inline code from program in MassSchedule.php & MassSchedule.js - JS remove inline code from program in Requests.php & Requests.js - JS remove inline code from program in Schedule.php & Schedule.js - JS remove inline code from program in Scheduler.php & Scheduler.js - JS remove inline code from program in AccessLog.php & AccessLog.js - JS remove inline code from program in Configuration.php & Configuration.js - JS remove inline code from program in MarkingPeriods.php & MarkingPeriods.js - JS remove inline code from program in PortalPolls.php & PortalPolls.js - JS remove inline code from program in Rollover.php & Rollover.js - JS remove inline code from `_makePaymentsCommentsInput()` in Student_Billing/functions.inc.php & MakePaymentsCommentsInput.js - JS remove inline code from Addresses & Contacts tab in Address.inc.php & Address.js - JS remove inline code from General Info tab in General_Info.inc.php & CreateStudentAccount.js - JS remove inline code from program in StudentLabels.fnc.php & StudentLabels.js - JS remove inline code from BottomButtonBackUpdate() in Bottom.fnc.php & BottomButtonBackUpdate.js - JS remove inline code from ChartjsChart() in Charts.fnc.php & ChartjsChart.js - JS remove inline code from GetFieldsForm() in Fields.fnc.php & FieldsGetForm.js - JS remove inline code from SubstitutionsInput() in Substitutions.fnc.php & SubstitutionsInput.js - JS fix CSP error: use setInnerHTML() instead of jQuery .append() function in jquery.colorbox.js & jquery.colorbox-min.js - JS not available, reload page (eg. when reopening closed tab) in Warehouse.php, noJsReload.js & warehouse.js - Module is addon, set custom module icon & remove $icon param in DashboardModule.fnc.php - CSP Redirection is done in HTML in HackingLog.fnc.php, Theme.fnc.php, Student.php & User.php - Fix reload theme when "Force" checked in Theme.fnc.php - CSP add .onmouseover-tipmsg CSS class, use `data-title` & `data-msg` attributes in TipMessage.fnc.php - Redirection is done in HTML in case current request is AJAX in Warehouse.php - Add `_gradeScaleInputHtml()` & `_search()` private methods to Widget_letter_grade object in Widget.php - Use Select2 input + AJAX search when scale has more than 1003 grades in Widget.php - Change User-Agent to "RosarioSIS/1.0; +https://www.rosariosis.org/" in curl.php - Cache config values, avoid calling Config() function X times in Currency.fnc.php & User.fnc.php - Submit selected date: use `onchange-date-submit` CSS class & `data-name` attribute in Date.php - Add CSS classes to .list element in ListOutput.fnc.php - CSP use the 'vertical-tab-navigation' class option for ListOutput() in Grades.php & InputFinalGrades.php - CSP remove unsafe-inline Javascript: use `data-url` attribute in ListOutput.fnc.php - Use MultipleCheckboxInput() function in AddAbsences.php - CSP add .onclick-checkall CSS class & use `data-name-like` attribute in AddAbsences.php, DuplicateAttendance.php, Exceptions.php & Profiles.php - CSP add .onclick-toggle CSS class & use `data-id` attribute in CreateParents.php, ReportCards.fnc.php & Transcripts.fnc.php - FinalGradeSave() can save COMMENT column in FinalGrades.inc.php - Include Students active as of Timeframe end date in DailyTransactions.php - CSP add .onchange-maybe-edit-select CSS class in StudentsUsersInfo.fnc.php & Address.inc.php - Prevent using username, or email in the password in General_Info.inc.php - CSP add .onclick-ajax-link & .onchange-ajax-link CSS classes, use `data-link` attribute, program wide - CSP add .onchange-ajax-post-form CSS class, program wide - CSP use curl POST instead of AJAX to send data to external domain in FirstLogin.fnc.php - HTML space gain: remove minus between letter & percent grades in Grades.php - SQL remove unused columns in GradebookBreakdown.php - CSP use `