svn: /web/php-testfest/trunk/scripts/testfestsource/src/ get.php viewfilecontents.php

rasmus Sun, 11 Dec 2011 16:33:41 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=320864 Log: Looks like the testfest server doesn't have input filtering turned on by default Changed paths: U web/php-testfest/trunk/scripts/testfestsource/src/get.php U web/php-testfest/trunk/scripts/testfestsource/src/viewfilecontents.php Modified: web/php-testfest/trunk/scripts/testfestsource/src/get.php =================================================================== --- web/php-testfest/trunk/scripts/testfestsource/src/get.php 2011-12-11 15:11:41 UTC (rev 320863) +++ web/php-testfest/trunk/scripts/testfestsource/src/get.php 2011-12-11 16:33:41 UTC (rev 320864) @@ -1,17 +1,17 @@ <?php switch($_GET['test']) { case 'post': - var_dump($_POST); - break; + var_dump(filter_var_array($_POST, FILTER_SANITIZE_FULL_SPECIAL_CHARS)); + break; case 'getpost': - var_dump($_GET); - var_dump($_POST); + var_dump(filter_var_array($_GET, FILTER_SANITIZE_FULL_SPECIAL_CHARS)); + var_dump(filter_var_array($_POST, FILTER_SANITIZE_FULL_SPECIAL_CHARS)); break; case 'referer': - echo $_SERVER['HTTP_REFERER']; + echo htmlspecialchars($_SERVER['HTTP_REFERER'], ENT_QUOTES, 'UTF-8'); break; case 'useragent': - echo $_SERVER['HTTP_USER_AGENT']; + echo htmlspecialchars($_SERVER['HTTP_USER_AGENT'], ENT_QUOTES, 'UTF-8'); break; default: echo "Hello World!\n"; Modified: web/php-testfest/trunk/scripts/testfestsource/src/viewfilecontents.php =================================================================== --- web/php-testfest/trunk/scripts/testfestsource/src/viewfilecontents.php 2011-12-11 15:11:41 UTC (rev 320863) +++ web/php-testfest/trunk/scripts/testfestsource/src/viewfilecontents.php 2011-12-11 16:33:41 UTC (rev 320864) @@ -28,11 +28,11 @@ $file = $_GET['file']; $basename = $_SESSION['basename']; -echo "<br><b>File:".$file."</b><br><br>"; +echo "<br><b>File:".htmlspecialchars($file, ENT_QUOTES, 'UTF-8')."</b><br><br>"; $file = realpath($file); if (strpos($file, '/p2/var/www/results.testfest.php.net/public_html/publishresults/') !== 0) { - echo "Test file $file outside expected path<br />"; + echo "Test file ".htmlspecialchars($file, ENT_QUOTES, 'UTF-8')." outside expected path<br />"; } else { highlight_file($file); }