cvs: php-news-web / group.php
| From: | Rasmus Lerdorf | Date: | Sun, 18 Mar 2007 06:29:01 +0000 |
| Subject: | cvs: php-news-web / group.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-34763@lists.php.net to get a copy of this message | ||
rasmus Sun Mar 18 06:29:01 2007 UTC
Modified files:
/php-news-web group.php
Log:
Another XSS
http://cvs.php.net/viewvc.cgi/php-news-web/group.php?r1=1.21&r2=1.22&diff_format=u
Index: php-news-web/group.php
diff -u php-news-web/group.php:1.21 php-news-web/group.php:1.22
--- php-news-web/group.php:1.21 Wed Sep 21 22:08:57 2005
+++ php-news-web/group.php Sun Mar 18 06:29:00 2007
@@ -43,14 +43,15 @@
error("Failed to get xover data");
}
+$host = htmlspecialchars($_SERVER['HTTP_HOST'], ENT_QUOTES);
switch($format) {
case 'rss':
header("Content-type: text/xml");
echo '<?xml version="1.0" encoding="utf-8"?>' .
"\n";?>
<rss version="0.93">
<channel>
- <title><?php echo $_SERVER['HTTP_HOST']; ?>: <?php echo
$group?></title>
- <link>http://<?php echo $_SERVER['HTTP_HOST'];
?>/group.php?group=<?php echo $group?></link>
+ <title><?php echo $host; ?>: <?php echo $group?></title>
+ <link>http://<?php echo $host;
?>/group.php?group=<?php echo $group?></link>
<description></description>
<?php break;
case 'rdf':
@@ -61,8 +62,8 @@
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns="http://my.netscape.com/rdf/simple/0.9/">
<channel>
- <title><?php echo $_SERVER['HTTP_HOST']; ?>: <?php echo
$group?></title>
- <link>http://<?php echo $_SERVER['HTTP_HOST'];
?>/group.php?group=<?php echo $group?></link>
+ <title><?php echo $host; ?>: <?php echo $group?></title>
+ <link>http://<?php echo $host;
?>/group.php?group=<?php echo $group?></link>
<description><?php echo $group?> Newsgroup at <?php echo NNTP_HOST;
?></description>
<language>en-US</language>
</channel>
@@ -99,7 +100,7 @@
switch($format) {
case 'rss':
echo " <item>\n";
- echo " <link>http://{$_SERVER['HTTP_HOST']}/$group/$n</link>\n";
+ echo " <link>http://$host/$group/$n</link>\n";
echo " <title>", format_subject($subj, $charset), "</title>\n";
echo " <description>", htmlspecialchars(format_author($author, $charset)),
"</description>\n";
echo " <pubDate>$date822</pubDate>\n";
@@ -108,7 +109,7 @@
case 'rdf':
echo " <item>\n";
echo " <title>", format_subject($subj, $charset), "</title>\n";
- echo " <link>http://{$_SERVER['HTTP_HOST']}/$group/$n</link>\n";
+ echo " <link>http://$host/$group/$n</link>\n";
echo " <description>", htmlspecialchars(format_author($author, $charset)),
"</description>\n";
echo " <pubDate>$date822</pubDate>\n";
echo " </item>\n";