svn: /web/php-master/trunk/entry/ svn-account.php
| From: | Ferenc Kovacs | Date: | Sun, 24 Jul 2011 18:31:04 +0000 |
| Subject: | svn: /web/php-master/trunk/entry/ svn-account.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-11755@lists.php.net to get a copy of this message | ||
tyrael Sun, 24 Jul 2011 18:31:04 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=313653
Log:
fix an xss vuln (the previous commit could be enough, but just in case)
Changed paths:
U web/php-master/trunk/entry/svn-account.php
Modified: web/php-master/trunk/entry/svn-account.php
===================================================================
--- web/php-master/trunk/entry/svn-account.php 2011-07-24 18:25:26 UTC (rev 313652)
+++ web/php-master/trunk/entry/svn-account.php 2011-07-24 18:31:04 UTC (rev 313653)
@@ -70,6 +70,7 @@
$cvspasswd = crypt($passwd, substr(md5(time()), 0, 2));
$md5passwd = md5($passwd);
$svnpasswd = gen_svn_pass($username, $passwd);
+$note = htmlspecialchars($note, ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO users (name,email,passwd,svnpasswd,md5passwd,username) VALUES ";
$query .=
"('$name','$email','$cvspasswd','$svnpasswd','$md5passwd','$username')";