cvs: php-gcov-web /www skip.php tests.php valgrind.php
| From: | Nuno Lopes | Date: | Fri, 29 Dec 2006 20:38:17 +0000 |
| Subject: | cvs: php-gcov-web /www skip.php tests.php valgrind.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-33628@lists.php.net to get a copy of this message | ||
nlopess Fri Dec 29 20:38:17 2006 UTC
Modified files:
/php-gcov-web/www skip.php tests.php valgrind.php
Log:
fix a few xss problems on invalid file ids
http://cvs.php.net/viewvc.cgi/php-gcov-web/www/skip.php?r1=1.3&r2=1.4&diff_format=u
Index: php-gcov-web/www/skip.php
diff -u php-gcov-web/www/skip.php:1.3 php-gcov-web/www/skip.php:1.4
--- php-gcov-web/www/skip.php:1.3 Fri Dec 29 20:18:44 2006
+++ php-gcov-web/www/skip.php Fri Dec 29 20:38:17 2006
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: skip.php,v 1.3 2006/12/29 20:18:44 nlopess Exp $ */
+/* $Id: skip.php,v 1.4 2006/12/29 20:38:17 nlopess Exp $ */
if (!defined('IN_GCOV_CODE')) exit;
@@ -33,14 +33,15 @@
} elseif (isset($_GET['file'])) {
$file = $_GET['file'];
- $appvars['page']['title'] = "PHP: $version Skip Report for $file";
- $appvars['page']['head'] = "Skip Report for $file";
-
if (isset($data[$file])) {
$data = $data[$file];
+ $file = htmlspecialchars($file);
$script = highlight_string($data[0], true);
$reason = htmlspecialchars($data[1] ? $data[1] : '(no reason given)');
+ $appvars['page']['title'] = "PHP: $version Skip Report for $file";
+ $appvars['page']['head'] = "Skip Report for $file";
+
$content = <<< HTML
<h2>Script</h2>
$script
http://cvs.php.net/viewvc.cgi/php-gcov-web/www/tests.php?r1=1.3&r2=1.4&diff_format=u
Index: php-gcov-web/www/tests.php
diff -u php-gcov-web/www/tests.php:1.3 php-gcov-web/www/tests.php:1.4
--- php-gcov-web/www/tests.php:1.3 Fri Dec 29 20:18:44 2006
+++ php-gcov-web/www/tests.php Fri Dec 29 20:38:17 2006
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: tests.php,v 1.3 2006/12/29 20:18:44 nlopess Exp $ */
+/* $Id: tests.php,v 1.4 2006/12/29 20:38:17 nlopess Exp $ */
if (!defined('IN_GCOV_CODE')) exit;
@@ -33,16 +33,18 @@
} elseif (isset($_GET['file'])) {
$file = $_GET['file'];
- $appvars['page']['title'] = "PHP: $version Test Failure Report for
$file";
- $appvars['page']['head'] = "Test Failure Report for $file";
-
if (isset($data[$file])) {
$data = $data[$file];
+ $file = htmlspecialchars($file);
+ $title = htmlspecialchars($data[1]);
$diff = htmlspecialchars($data[2]);
$exp = htmlspecialchars($data[3]);
$output = htmlspecialchars($data[4]);
$script = highlight_string($data[5], true);
+ $appvars['page']['title'] = "PHP: $version Test Failure Report for
$file";
+ $appvars['page']['head'] = "Test Failure Report for $file
('$title')";
+
$content = <<< HTML
<h2>Script</h2>
$script
http://cvs.php.net/viewvc.cgi/php-gcov-web/www/valgrind.php?r1=1.2&r2=1.3&diff_format=u
Index: php-gcov-web/www/valgrind.php
diff -u php-gcov-web/www/valgrind.php:1.2 php-gcov-web/www/valgrind.php:1.3
--- php-gcov-web/www/valgrind.php:1.2 Fri Dec 29 20:18:44 2006
+++ php-gcov-web/www/valgrind.php Fri Dec 29 20:38:17 2006
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: valgrind.php,v 1.2 2006/12/29 20:18:44 nlopess Exp $ */
+/* $Id: valgrind.php,v 1.3 2006/12/29 20:38:17 nlopess Exp $ */
if (!defined('IN_GCOV_CODE')) exit;
@@ -33,14 +33,16 @@
} elseif (isset($_GET['file'])) {
$file = $_GET['file'];
- $appvars['page']['title'] = "PHP: $version Valgrind Report for
$file";
- $appvars['page']['head'] = "Valgrind Report for $file";
-
if (isset($data[$file])) {
$data = $data[$file];
+ $file = htmlspecialchars($file);
+ $title = htmlspecialchars($data[0]);
$script = highlight_string($data[2], true);
$report = htmlspecialchars($data[3]);
+ $appvars['page']['title'] = "PHP: $version Valgrind Report for
$file";
+ $appvars['page']['head'] = "Valgrind Report for $file
('$title')";
+
$content = <<< HTML
<h2>Script</h2>
$script