com web/master: Allow quotes, too, for some fields.: include/functions.inc manage/mirrors.php

Commit: d0d1a1cebdb80f78f2e902d4662147507a07d994 Author: Daniel P. Brown <danbrown@php.net> Thu, 5 Apr 2012 15:20:40 -0400 Parents: 9bfc7e93f3088a871645cd02df02aebdeba73c20 Branches: master Link: http://git.php.net/?p=web/master.git;a=commitdiff;h=d0d1a1cebdb80f78f2e902d4662147507a07d994 Log: Allow quotes, too, for some fields.. Changed paths: M include/functions.inc M manage/mirrors.php Diff: diff --git a/include/functions.inc b/include/functions.inc index 5fd65f1..2c88497 100644 --- a/include/functions.inc +++ b/include/functions.inc @@ -205,6 +205,10 @@ function get_ssh_keys($string) { return $results; } -function unmangle($str) { +function unmangle($str,$unmangle_quotes=0) { + // If permitting quotes, remember to sanitize. + if ($unmangle_quotes) { + return str_replace(['&lt;','&gt;','&amp;','&uuml;','&quot;',],['<','>','&','ü','"',],$str); + } return str_replace(['&lt;','&gt;','&amp;','&uuml;',],['<','>','&','ü',],$str); } diff --git a/manage/mirrors.php b/manage/mirrors.php index 3f2309b..06ac037 100644 --- a/manage/mirrors.php +++ b/manage/mirrors.php @@ -44,7 +44,7 @@ if (isset($id) && isset($hostname)) { "mirrortype=$mirrortype, cname='$cname', maintainer='".unmangle($maintainer)."', " . "providername='".unmangle($providername)."', providerurl='$providerurl', " . "cc='$cc', lang='$lang', has_stats=$has_stats, " . - "lastedited=NOW(), acmt='".unmangle($acmt)."' WHERE id = $id"; + "lastedited=NOW(), acmt='".real_clean(unmangle($acmt,1))."' WHERE id = $id"; $msg = "$hostname updated"; break; @@ -61,7 +61,7 @@ if (isset($id) && isset($hostname)) { "lang, has_stats, created, lastedited, acmt) " . "VALUES ('$hostname', $active, $mirrortype, '$cname', " . "'".unmangle($maintainer)."', '".unmangle($providername)."', '$providerurl', '$cc', " . - "'$lang', $has_stats, NOW(), NOW(), '".unmangle($acmt)."')"; + "'$lang', $has_stats, NOW(), NOW(), '".real_clean(unmangle($acmt,1))."')"; $msg = "$hostname added"; break; }