cvs: php-bugs-web / bug-pwd-finder.php bug.php fix.php lbugs.php report.php
| From: | Rasmus Lerdorf | Date: | Sun, 08 May 2005 16:04:09 +0000 |
| Subject: | cvs: php-bugs-web / bug-pwd-finder.php bug.php fix.php lbugs.php report.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-28117@lists.php.net to get a copy of this message | ||
rasmus Sun May 8 12:04:09 2005 EDT
Modified files:
/php-bugs-web bug-pwd-finder.php bug.php fix.php lbugs.php
report.php
Log:
More PHP_SELF XSS fixes here
http://cvs.php.net/diff.php/php-bugs-web/bug-pwd-finder.php?r1=1.12&r2=1.13&ty=u
Index: php-bugs-web/bug-pwd-finder.php
diff -u php-bugs-web/bug-pwd-finder.php:1.12 php-bugs-web/bug-pwd-finder.php:1.13
--- php-bugs-web/bug-pwd-finder.php:1.12 Fri Apr 22 09:25:07 2005
+++ php-bugs-web/bug-pwd-finder.php Sun May 8 12:04:08 2005
@@ -68,7 +68,7 @@
<?php if ($msg) { echo "<p><font
color=\"#cc0000\">$msg</font></p>"; } ?>
-<form method="post" action="<?php echo $PHP_SELF;?>">
+<form method="post" action="<?php echo strip_tags($PHP_SELF);?>">
<p>
<b>Bug Report ID:</b> #<input type="text" size="20"
name="bug_id"><br><br>
<b>CAPTCHA:</b>
http://cvs.php.net/diff.php/php-bugs-web/bug.php?r1=1.76&r2=1.77&ty=u
Index: php-bugs-web/bug.php
diff -u php-bugs-web/bug.php:1.76 php-bugs-web/bug.php:1.77
--- php-bugs-web/bug.php:1.76 Mon Apr 25 18:01:13 2005
+++ php-bugs-web/bug.php Sun May 8 12:04:08 2005
@@ -52,6 +52,8 @@
exit;
}
+$self = strip_tags($PHP_SELF);
+
# Delete comment
if ($edit == 1 && isset($delete_comment)) {
$addon = '';
@@ -59,7 +61,7 @@
delete_comment($id, $delete_comment);
$addon = '&thanks=1';
}
- header("Location: $PHP_SELF?id=$id&edit=1$addon");
+ header("Location: $self?id=$id&edit=1$addon");
exit();
}
@@ -89,7 +91,7 @@
# Don't allow comments by the original report submitter
if (stripslashes($in['commentemail']) == $bug['email']) {
- header("Location: $PHP_SELF?id=$id&edit=2");
+ header("Location: $self?id=$id&edit=2");
exit();
}
@@ -200,7 +202,7 @@
if ($in && !$errors && $success) {
mail_bug_updates($bug,$in,$from,$ncomment,$edit);
- header("Location: $PHP_SELF?id=$id&thanks=$edit");
+ header("Location: $self?id=$id&thanks=$edit");
exit;
}
@@ -277,9 +279,11 @@
<div id="controls">
<?php
function control($num,$desc) {
+ global $self;
+
$active = ($GLOBALS['edit'] == $num);
echo "<span id=\"control_$num\" class=\"control", ($active ? '
active' : ''), "\">",
- !$active ? "<a href=\"$PHP_SELF?id=$GLOBALS[id]".($num ?
"&edit=$num" : "")."\">" : "",
+ !$active ? "<a href=\"$self?id=$GLOBALS[id]".($num ?
"&edit=$num" : "")."\">" : "",
$desc, !$active ? "</a>" : "", "</span> ";
}
@@ -304,7 +308,7 @@
}
if ($edit == 1 || $edit == 2) {?>
-<form id="update" action="<?php echo $PHP_SELF?>"
method="post">
+<form id="update" action="<?php echo $self?>"
method="post">
<?php
if ($edit == 2) {
if (!$in && $pw && $bug['passwd'] &&
stripslashes($pw)==$bug['passwd']) {?>
@@ -319,7 +323,7 @@
<?php if (!$in) {?>
Welcome back! If you're the original bug submitter, here's where you can edit
the bug or add additional notes. If this is not your bug, you can <a
-href="<?php echo "$PHP_SELF?id=$id&edit=3"?>">add a comment by
following
+href="<?php echo "$self?id=$id&edit=3"?>">add a comment by
following
this link</a> or the box above that says 'Add Comment'. If this is your bug,
but you forgot your password, <a href="bug-pwd-finder.php">you can retrieve
your password here</a>.
@@ -353,9 +357,9 @@
<div class="explain">
<?php if (!$in) {?>
Welcome! If you don't have a CVS account, you can't do anything here. You can
-<a href="<?php echo "$PHP_SELF?id=$id&edit=3"?>">add a
comment by following
+<a href="<?php echo "$self?id=$id&edit=3"?>">add a comment
by following
this link</a> or if you reported this bug, you can <a href="<?php echo
-"$PHP_SELF?id=$id&edit=2"?>">edit this bug over here</a>.
+"$self?id=$id&edit=2"?>">edit this bug over here</a>.
<?php }?>
<table>
<tr>
@@ -422,13 +426,13 @@
</form>
<?php }?>
<?php if ($edit == 3) {?>
-<form id="comment" action="<?php echo $PHP_SELF?>"
method="post">
+<form id="comment" action="<?php echo $self?>"
method="post">
<?php if (!$in) {?>
<div class="explain">
Anyone can comment on a bug. Have a simpler test case? Does it work for you on
a different platform? Let us know! Just going to say 'Me too!'? Don't clutter
the database with that please
-<?php if (canvote()) { echo " — but make sure to <a
href=\"$PHP_SELF?id=$id\">vote on the bug</a>"; } ?>!
+<?php if (canvote()) { echo " — but make sure to <a
href=\"$self?id=$id\">vote on the bug</a>"; } ?>!
</div>
<div class="errors">
Do <b>NOT</b> use the comment system to ask questions related to bug reports,
@@ -522,15 +526,15 @@
function output_note($com_id, $ts, $email, $comment)
{
- global $edit, $id, $trusted_developers, $user;
+ global $edit, $id, $trusted_developers, $user, $self;
echo "<a name=\"c$com_id\"></a>";
echo "<div class=\"comment\">";
echo "<b>[",format_date($ts),"] ",
htmlspecialchars(spam_protect($email)), "</b>\n";
- echo ($edit == 1 && $com_id !== 0 && in_array($user, $trusted_developers)) ?
"<a
href=\"$PHP_SELF?id=$id&edit=1&delete_comment=$com_id\">[delete]</a>\n"
: '';
+ echo ($edit == 1 && $com_id !== 0 && in_array($user, $trusted_developers)) ?
"<a
href=\"$self?id=$id&edit=1&delete_comment=$com_id\">[delete]</a>\n"
: '';
echo "<pre class=\"note\">";
$note =
addlinks(preg_replace("/(\r?\n){3,}/","\n\n",wordwrap($comment,72,"\n",1)));
- echo preg_replace('/(bug\ *#([0-9]+))/i', "<a
href=\"$PHP_SELF?id=\\2\">\\1</a>", $note);
+ echo preg_replace('/(bug\ *#([0-9]+))/i', "<a
href=\"$self?id=\\2\">\\1</a>", $note);
echo "</pre>\n";
echo "</div>";
}
http://cvs.php.net/diff.php/php-bugs-web/fix.php?r1=1.18&r2=1.19&ty=u
Index: php-bugs-web/fix.php
diff -u php-bugs-web/fix.php:1.18 php-bugs-web/fix.php:1.19
--- php-bugs-web/fix.php:1.18 Thu Aug 5 09:55:44 2004
+++ php-bugs-web/fix.php Sun May 8 12:04:08 2005
@@ -39,7 +39,7 @@
commonHeader("Resolve Bug");
display_errors($errors);
?>
-<form method="post" action="<?php echo $PHP_SELF?>">
+<form method="post" action="<?php echo strip_tags($PHP_SELF)?>">
<input type="hidden" name="id" value="<?php echo $id?>"
/>
<table>
<tr>
http://cvs.php.net/diff.php/php-bugs-web/lbugs.php?r1=1.14&r2=1.15&ty=u
Index: php-bugs-web/lbugs.php
diff -u php-bugs-web/lbugs.php:1.14 php-bugs-web/lbugs.php:1.15
--- php-bugs-web/lbugs.php:1.14 Thu Aug 5 09:55:44 2004
+++ php-bugs-web/lbugs.php Sun May 8 12:04:08 2005
@@ -46,7 +46,7 @@
for($i=0;$i<$len; $i++) $s.= "=";
echo "$s</b>\n";
}
- printf("<a
href=\"%s?id=%d\">%4d</a>",$PHP_SELF,$row['id'],$row['id']);
+ printf("<a
href=\"%s?id=%d\">%4d</a>",strip_tags($PHP_SELF),$row['id'],$row['id']);
printf(" %-9s ",$row['status']);
echo " ".htmlspecialchars($row['sdesc'])."\n";
}
http://cvs.php.net/diff.php/php-bugs-web/report.php?r1=1.59&r2=1.60&ty=u
Index: php-bugs-web/report.php
diff -u php-bugs-web/report.php:1.59 php-bugs-web/report.php:1.60
--- php-bugs-web/report.php:1.59 Fri Apr 22 21:52:39 2005
+++ php-bugs-web/report.php Sun May 8 12:04:08 2005
@@ -237,7 +237,7 @@
if ($errors) display_errors($errors);
?>
-<form method="post" action="<?php echo $PHP_SELF;?>">
+<form method="post" action="<?php echo strip_tags($PHP_SELF);?>">
<input type="hidden" name="in[did_luser_search]" value="<?php echo
$in['did_luser_search'] ? 1 : 0; ?>" />
<table>
<tr>