cvs: php-news-web / index.php
| From: | Rasmus Lerdorf | Date: | Sun, 11 Feb 2007 07:30:41 +0000 |
| Subject: | cvs: php-news-web / index.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-34221@lists.php.net to get a copy of this message | ||
rasmus Sun Feb 11 07:30:41 2007 UTC
Modified files:
/php-news-web index.php
Log:
Don't trust the host header here
http://cvs.php.net/viewvc.cgi/php-news-web/index.php?r1=1.10&r2=1.11&diff_format=u
Index: php-news-web/index.php
diff -u php-news-web/index.php:1.10 php-news-web/index.php:1.11
--- php-news-web/index.php:1.10 Wed Jan 26 16:52:39 2005
+++ php-news-web/index.php Sun Feb 11 07:30:41 2007
@@ -56,8 +56,8 @@
<h1>Welcome!</h1>
<p>
This is a completely experimental interface to the PHP mailing lists as
- reflected on the <a href="news://<?php echo
$_SERVER['HTTP_HOST']; ?>/">
- <?php echo $_SERVER['HTTP_HOST']; ?> NNTP server</a>.
+ reflected on the <a href="news://<?php echo
htmlspecialchars($_SERVER['HTTP_HOST'],ENT_QUOTES); ?>/">
+ <?php echo htmlspecialchars($_SERVER['HTTP_HOST'], ENT_QUOTES); ?> NNTP
server</a>.
</p>
<p>
There may be a little more info in the <a href="README">README</a>
file.