cvs: php-bugs-web / bugstats.php report.php source.php

rasmus Sun Feb 11 07:23:28 2007 UTC Modified files: /php-bugs-web bugstats.php report.php source.php Log: A few more XSS problems. This code is over 10 years old and really could use some attention. http://cvs.php.net/viewvc.cgi/php-bugs-web/bugstats.php?r1=1.25&r2=1.26&diff_format=u Index: php-bugs-web/bugstats.php diff -u php-bugs-web/bugstats.php:1.25 php-bugs-web/bugstats.php:1.26 --- php-bugs-web/bugstats.php:1.25 Thu Aug 5 13:55:44 2004 +++ php-bugs-web/bugstats.php Sun Feb 11 07:23:28 2007 @@ -11,6 +11,8 @@ $query = "SELECT status,bug_type,email,php_version,php_os FROM bugdb"; +$phpver = (int)$phpver; + if ($phpver > 0) { $query .= " WHERE SUBSTRING(php_version,1,1) = '$phpver'"; } http://cvs.php.net/viewvc.cgi/php-bugs-web/report.php?r1=1.66&r2=1.67&diff_format=u Index: php-bugs-web/report.php diff -u php-bugs-web/report.php:1.66 php-bugs-web/report.php:1.67 --- php-bugs-web/report.php:1.66 Sun Jan 7 17:11:24 2007 +++ php-bugs-web/report.php Sun Feb 11 07:23:28 2007 @@ -52,7 +52,7 @@ $query = "SELECT * from bugdb $where_clause LIMIT 5"; - $res = mysql_query($query) or die(htmlspecialchars($query) . "<br>" . mysql_error()); + $res = mysql_query($query) or die(htmlspecialchars($query, ENT_QUOTES) . "<br>" . mysql_error()); if (mysql_num_rows($res) == 0) { $ok_to_submit_report = 1; @@ -247,7 +247,7 @@ if ($errors) display_errors($errors); ?> -<form method="post" action="<?php echo strip_tags($PHP_SELF);?>"> +<form method="post" action="<?php echo htmlspecialchars($PHP_SELF, ENT_QUOTES);?>"> <input type="hidden" name="in[did_luser_search]" value="<?php echo $in['did_luser_search'] ? 1 : 0; ?>" /> <table> <tr> http://cvs.php.net/viewvc.cgi/php-bugs-web/source.php?r1=1.5&r2=1.6&diff_format=u Index: php-bugs-web/source.php diff -u php-bugs-web/source.php:1.5 php-bugs-web/source.php:1.6 --- php-bugs-web/source.php:1.5 Fri Jan 23 03:05:28 2004 +++ php-bugs-web/source.php Sun Feb 11 07:23:28 2007 @@ -9,7 +9,7 @@ exit; } ?> -Source of: <? echo htmlspecialchars($url); ?><BR> +Source of: <? echo htmlspecialchars($url, ENT_QUOTES); ?><BR> <? @@ -22,9 +22,9 @@ $dir = dirname($url); if ($dir && $legal_dirs[$dir]) { - $page_name = $DOCUMENT_ROOT . $url; + $page_name = $DOCUMENT_ROOT . htmlspecialchars($url, ENT_QUOTES); } else { - $page_name = basename($url); + $page_name = basename(htmlspecialchars($url, ENT_QUOTES)); } echo("<!-- $page_name -->\n");