svn: /web/php/trunk/include/ results.inc
| From: | Peter Cowburn | Date: | Wed, 17 Aug 2011 15:14:38 +0000 |
| Subject: | svn: /web/php/trunk/include/ results.inc | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-11947@lists.php.net to get a copy of this message | ||
salathe Wed, 17 Aug 2011 15:14:38 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=315076
Log:
xss fix - search results summaries can contain HTML
Changed paths:
U web/php/trunk/include/results.inc
Modified: web/php/trunk/include/results.inc
===================================================================
--- web/php/trunk/include/results.inc 2011-08-17 15:11:24 UTC (rev 315075)
+++ web/php/trunk/include/results.inc 2011-08-17 15:14:38 UTC (rev 315076)
@@ -55,6 +55,7 @@
// Fix > double escaping
$summary = str_replace('&', '&', $hit['Summary']);
+ $summary = htmlspecialchars($summary, ENT_QUOTES, 'UTF-8');
echo <<<EOB
<li>
<p class="result">{$types[$type]}<a
href="{$real_url}">{$display_title}</a></p>