svn: /web/php/trunk/include/ do-download.inc get-download.inc
| From: | Hannes Magnusson | Date: | Sun, 23 Jan 2011 14:31:11 +0000 |
| Subject: | svn: /web/php/trunk/include/ do-download.inc get-download.inc | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-10470@lists.php.net to get a copy of this message | ||
bjori Sun, 23 Jan 2011 14:31:11 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=307676
Log:
Fix xss on bogus filenames (reported by Rasmus)
Changed paths:
U web/php/trunk/include/do-download.inc
U web/php/trunk/include/get-download.inc
Modified: web/php/trunk/include/do-download.inc
===================================================================
--- web/php/trunk/include/do-download.inc 2011-01-23 11:38:46 UTC (rev 307675)
+++ web/php/trunk/include/do-download.inc 2011-01-23 14:31:11 UTC (rev 307676)
@@ -47,7 +47,7 @@
}
else {
$info = "<p>
- The file you requested (<strong>{$file}</strong>) is not found on
+ The file you requested (<strong> " . htmlspecialchars($file, ENT_QUOTES,
"UTF-8") . " </strong>) is not found on
this server (<strong>{$MYSITE}</strong>). If this file is a
recent addition to our downloads, then it is possible that this
particular server is not yet updated to host that file for download.
Modified: web/php/trunk/include/get-download.inc
===================================================================
--- web/php/trunk/include/get-download.inc 2011-01-23 11:38:46 UTC (rev 307675)
+++ web/php/trunk/include/get-download.inc 2011-01-23 14:31:11 UTC (rev 307676)
@@ -37,7 +37,7 @@
}
else {
$info = "<p>
- The file you requested (<strong>{$df}</strong>) is not found on
+ The file you requested (<strong> " . htmlspecialchars($df, ENT_QUOTES,
"UTF-8") . " </strong>) is not found on
this server (<strong>{$MYSITE}</strong>). If this file is a
recent addition to our downloads, then it is possible that this
particular server is not yet updated to host that file for download.