asmecher

diff --git a/controllers/api/file/linkAction/DownloadFileLinkAction.inc.php b/controllers/api/file/linkAction/DownloadFileLinkAction.inc.php
index d74897f391..dc097bb803 100644
--- a/controllers/api/file/linkAction/DownloadFileLinkAction.inc.php
+++ b/controllers/api/file/linkAction/DownloadFileLinkAction.inc.php
@@ -42,7 +42,7 @@ function __construct($request, $submissionFile, $stageId = null, $label = null)
 
 		// Configure the file link action.
 		parent::__construct(
-			'downloadFile', $redirectRequest, $this->getLabel($submissionFile),
+			'downloadFile', $redirectRequest, htmlspecialchars($this->getLabel($submissionFile)),

asmecher

diff --git a/controllers/grid/issues/IssueGridCellProvider.inc.php b/controllers/grid/issues/IssueGridCellProvider.inc.php
index 0f36e7af3b..092a925213 100644
--- a/controllers/grid/issues/IssueGridCellProvider.inc.php
+++ b/controllers/grid/issues/IssueGridCellProvider.inc.php
@@ -48,7 +48,7 @@ function getCellActions($request, $row, $column, $position = GRID_ACTION_POSITIO
 						'modal_edit',
 						true
 					),
-					$issue->getIssueIdentification()
+					htmlspecialchars($issue->getIssueIdentification())

asmecher

      1 : SELECT * FROM journals WHERE journal_id = ?
      1 : SELECT	* FROM navigation_menu_items WHERE path = ? and context_id = ? and type= ?
      1 : SELECT i.* FROM issues i WHERE journal_id = ? AND current = 1
      2 : SELECT *
      3 : SELECT	DISTINCT ug.role_id
      4 : SELECT * FROM sections WHERE journal_id = ? ORDER BY seq
      6 : SELECT last_run FROM scheduled_tasks WHERE class_name = ?
      7 : SELECT count(*) FROM notifications WHERE user_id = ? AND date_read IS NULL AND level = ?
      7 : SELECT * FROM sessions WHERE session_id = ?
      7 : SELECT * FROM site

asmecher

<?php

/**
 * @file PluginTest.php
 *
 * Copyright (c) 2014-2018 Simon Fraser University
 * Copyright (c) 2000-2018 John Willinsky
 * Distributed under the GNU GPL v2. For full terms see the file docs/COPYING.
 *
 * @class PluginTest

asmecher

Read a plain-text description of this CLA here: https://pkp.sfu.ca/contributor-license-agreement/

1. Definitions. 
"You" (or "Your") shall mean the copyright owner or legal entity authorized by the copyright owner that is making this Agreement with the PKP.  For legal entities, the entity making a Contribution and all other entities that control, are controlled by, or are under common control with that entity are considered to be a single Contributor. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding  shares, or (iii) beneficial ownership of such entity. 
"Contribution" shall mean the code, documentation or other original works of authorship expressly identified in Schedule B, as well as any original work of authorship, including any modifications or additions to an existing work, that is intentionally submitted by You

asmecher

diff --git a/lib/pkp/lib/adodb/adodb-datadict.inc.php b/lib/pkp/lib/adodb/adodb-datadict.inc.php
index 4a44dc0..d2f317d 100644
--- a/lib/pkp/lib/adodb/adodb-datadict.inc.php
+++ b/lib/pkp/lib/adodb/adodb-datadict.inc.php
@@ -516,7 +516,9 @@ class ADODB_DataDict {
 	{
 		$tabname = $this->TableName ($tabname);
 		if ($flds) {
-			list($lines,$pkey,$idxs) = $this->_GenFields($flds);
+			// Avoid use of SERIAL for existing columns, 2014-04-14

asmecher

diff --git a/classes/security/RoleDAO.inc.php b/classes/security/RoleDAO.inc.php
index 6c5122e..6a3f91e 100644
--- a/classes/security/RoleDAO.inc.php
+++ b/classes/security/RoleDAO.inc.php
@@ -114,10 +114,16 @@ class RoleDAO extends DAO {
 	 * @return bool True iff at least one such role exists
 	 */
 	function userHasRole($contextId, $userId, $roleId) {
+		$includeAdminRoles = $roleId === ROLE_ID_SITE_ADMIN || (is_array($roleId) && in_array(ROLE_ID_SITE_ADMIN, $roles));
+