From b58ac827442801d56c0bd68dbf5b297fc4346014 Mon Sep 17 00:00:00 2001
From: david <darranz@rodax-software.com>
Date: Thu, 7 Apr 2011 15:44:25 +0000
Subject: [PATCH] Tarea #567 -> Enciptar el ID de formulario en el enlace que
 se manda.

git-svn-id: https://192.168.0.254/svn/Proyectos.Incam_FormulariosCalidad/trunk@16 e2c41b2c-0c6f-0149-8b81-50b1a9191bb3
---
 manage_form.php |  4 ++--
 view.php        | 34 +++++++++++++++++-----------------
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/manage_form.php b/manage_form.php
index 59d7677..ce6872d 100644
--- a/manage_form.php
+++ b/manage_form.php
@@ -476,10 +476,10 @@ EOT;
 			    <td ><a href="<?php echo "manage_entries.php?id={$data['form_id']}"; ?>">Respuestas</a></td>
 			    <td><a href="<?php echo "edit_form.php?id={$data['form_id']}"; ?>">Editar form.</a></td>
 			    <td nowrap><a href="<?php echo "edit_css.php?id={$data['form_id']}"; ?>">Editar estilo</a></td>
-			    <td nowrap><a href="<?php echo "email_settings.php?id={$data['form_id']}"; ?>">Emails</a></td>
+			    <td nowrap><a href="<?php echo "email_settings.php?id={$data['form_id']}"; ?>">Notificaciones</a></td>
 				<td nowrap><a href="<?php echo "embed_code.php?id={$data['form_id']}"; ?>">Código</a></td>
 			    <td>&nbsp;</td>
-			    <td><a href="view.php?id=<?php echo $data['form_id']; ?>" target="_blank">Ver formulario</a></td>
+			    <td><a href="view.php?id=<?php echo base64_encode($data['form_id']); ?>" target="_blank">Ver formulario</a></td>
 			    <td>&nbsp;</td>
 			    <td><a href="<?php echo "manage_form.php?duplicate={$data['form_id']}"; ?>">Duplicar</a></td>
 			    <td><a href="manage_form.php?pageno=<?php echo $pageno; ?>&delete=<?php echo $data['form_id']; ?>" onclick="javascript: return confirm('Este formulario y sus respuestas se eliminarán. ¿Desea continuar?');">Borrar</a></td>
diff --git a/view.php b/view.php
index 8994f3c..95a6a8a 100644
--- a/view.php
+++ b/view.php
@@ -1,15 +1,15 @@
 <?php
 /******************************************************************************
  MachForm
-  
+
  Copyright 2007 Appnitro Software. This code cannot be redistributed without
  permission from http://www.appnitro.com/
- 
+
  More info at: http://www.appnitro.com/
  ******************************************************************************/
 	header("p3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"");
 	session_start();
-	
+
 	require('config.php');
 	require('includes/language.php');
 	require('includes/db-core.php');
@@ -23,21 +23,21 @@
 	require('lib/class.phpmailer.php');
 	require('lib/recaptchalib.php');
 	require('lib/php-captcha/php-captcha.inc.php');
-		
+
 	//get data from database
 	connect_db();
-	
+
 	if(!empty($_POST['submit'])){ //if form submitted
 		$input_array   = ap_sanitize_input($_POST);
-		
+
 		$submit_result = process_form($input_array);
-		
+
 		if(!isset($input_array['password'])){ //if normal form submitted
 			if($submit_result['status'] === true){
 				if(empty($submit_result['review_id'])){
 					if(empty($submit_result['form_redirect'])){
-						$ssl_suffix = get_ssl_suffix();						
-						
+						$ssl_suffix = get_ssl_suffix();
+
 						header("Location: http{$ssl_suffix}://".$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']."?id={$input_array['form_id']}&done=1");
 						exit;
 					}else{
@@ -45,8 +45,8 @@
 						exit;
 					}
 				}else{ //redirect to review page
-					$ssl_suffix = get_ssl_suffix();	
-					
+					$ssl_suffix = get_ssl_suffix();
+
 					$_SESSION['review_id'] = $submit_result['review_id'];
 					header("Location: http{$ssl_suffix}://".$_SERVER['HTTP_HOST'].get_dirname($_SERVER['PHP_SELF'])."/confirm.php?id={$input_array['form_id']}");
 					exit;
@@ -55,7 +55,7 @@
 				$old_values = $submit_result['old_values'];
 				$custom_error = @$submit_result['custom_error'];
 				$error_elements = $submit_result['error_elements'];
-							
+
 				$markup = display_form($input_array['form_id'],$old_values,$error_elements,$custom_error);
 			}
 		}else{ //if password form submitted
@@ -67,26 +67,26 @@
 			}
 		}
 	}else{
-		$form_id = (int) trim($_GET['id']);
+		$form_id = (int) base64_decode(trim($_GET['id']));
 		if(empty($form_id)){
 			die('ID required.');
 		}
-		
+
 		//check for delete file option
 		//this is available for form with review enabled
 		if(!empty($_GET['delete_file']) && !empty($_SESSION['review_id'])){
 			$element_id = (int) trim($_GET['delete_file']);
 			delete_review_file_entry($form_id,$_SESSION['review_id'],$element_id);
 		}
-		
+
 		if(!empty($_GET['done'])){
 			$markup = display_success($form_id);
 		}else{
 			$markup = display_form($form_id);
 		}
 	}
-	
+
 	header("Content-Type: text/html; charset=UTF-8");
 	echo $markup;
-	
+
 ?>