cvs: php-bugs-web / bug-pwd-finder.php
| From: | Rasmus Lerdorf | Date: | Sun, 11 Feb 2007 07:09:25 +0000 |
| Subject: | cvs: php-bugs-web / bug-pwd-finder.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-34219@lists.php.net to get a copy of this message | ||
rasmus Sun Feb 11 07:09:25 2007 UTC
Modified files:
/php-bugs-web bug-pwd-finder.php
Log:
Fix XSS. strip_tags() isn't enough inside a tag like this.
http://cvs.php.net/viewvc.cgi/php-bugs-web/bug-pwd-finder.php?r1=1.13&r2=1.14&diff_format=u
Index: php-bugs-web/bug-pwd-finder.php
diff -u php-bugs-web/bug-pwd-finder.php:1.13 php-bugs-web/bug-pwd-finder.php:1.14
--- php-bugs-web/bug-pwd-finder.php:1.13 Sun May 8 16:04:08 2005
+++ php-bugs-web/bug-pwd-finder.php Sun Feb 11 07:09:25 2007
@@ -68,7 +68,7 @@
<?php if ($msg) { echo "<p><font
color=\"#cc0000\">$msg</font></p>"; } ?>
-<form method="post" action="<?php echo strip_tags($PHP_SELF);?>">
+<form method="post" action="<?php echo htmlspecialchars($PHP_SELF,
ENT_QUOTES);?>">
<p>
<b>Bug Report ID:</b> #<input type="text" size="20"
name="bug_id"><br><br>
<b>CAPTCHA:</b>