cvs: phpweb /include langchooser.inc
| From: | Hannes Magnusson | Date: | Sat, 12 May 2007 15:43:50 +0000 |
| Subject: | cvs: phpweb /include langchooser.inc | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-35362@lists.php.net to get a copy of this message | ||
bjori Sat May 12 15:43:50 2007 UTC
Modified files:
/phpweb/include langchooser.inc
Log:
Fixed bug#41376 (a xss bug on php.net website)
# Found by André moulu
http://cvs.php.net/viewvc.cgi/phpweb/include/langchooser.inc?r1=1.33&r2=1.34&diff_format=u
Index: phpweb/include/langchooser.inc
diff -u phpweb/include/langchooser.inc:1.33 phpweb/include/langchooser.inc:1.34
--- phpweb/include/langchooser.inc:1.33 Fri Aug 8 14:07:33 2003
+++ phpweb/include/langchooser.inc Sat May 12 15:43:49 2007
@@ -1,6 +1,6 @@
<?php // -*- C++ -*-
-// $Id: langchooser.inc,v 1.33 2003/08/08 14:07:33 goba Exp $
+// $Id: langchooser.inc,v 1.34 2007/05/12 15:43:49 bjori Exp $
/*
@@ -54,7 +54,7 @@
$explicitly_specified = language_add($_REQUEST['lang'], $languages);
// Set the language in a cookie for a year
- mirror_setcookie("LAST_LANG", $_REQUEST['lang'], 60*60*24*365);
+ mirror_setcookie("LAST_LANG", $explicitly_specified, 60*60*24*365);
}
// Specified in a shortcut URL (eg. /en/echo or /pt_br/echo)
@@ -176,8 +176,8 @@
{
global $LANGUAGES, $INACTIVE_ONLINE_LANGUAGES;
- // Make language code lowercase
- $langcode = strtolower($langcode);
+ // Make language code lowercase, html encode special chars and remove slashes
+ $langcode = strtolower(htmlspecialchars(get_magic_quotes_gpc() ? stripslashes($langcode) :
$langcode));
// The Brazilian Portuguese code needs special attention
if ($langcode == 'pt_br') { $langcode = 'pt_BR'; }