cvs: phpweb / source.php
| From: | jim winstead | Date: | Mon, 25 Mar 2002 19:23:21 +0000 |
| Subject: | cvs: phpweb / source.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-9243@lists.php.net to get a copy of this message | ||
jimw Mon Mar 25 14:23:21 2002 EDT
Modified files:
/phpweb source.php
Log:
protect against cross-site scripting attack via "url" parameter
Index: phpweb/source.php
diff -u phpweb/source.php:1.11 phpweb/source.php:1.12
--- phpweb/source.php:1.11 Thu Dec 13 14:23:14 2001
+++ phpweb/source.php Mon Mar 25 14:23:20 2002
@@ -31,7 +31,7 @@
exit;
}
-echo "<h1>Source of: $url</h1>" . hdelim();
+echo "<h1>Source of: ", htmlentities($url), "</h1>", hdelim();
$legal_dirs = array(
"/manual" => 1,
@@ -53,12 +53,15 @@
$page_name = basename($url);
}
-echo("<!-- $page_name -->\n");
+echo "<!-- ", htmlentities($page_name), " -->\n";
if (file_exists($page_name) && !is_dir($page_name)) {
show_source($page_name);
} else if (@is_dir($page_name)) {
echo "<p>No file specified. Can't show source for a
directory.</p>\n";
+}
+else {
+ echo "<p>This file does not exist.</p>\n";
}
commonFooter();