com web/master: Fix unmangle() to work properly instead of hacky.: include/functions.inc manage/mirrors.php
| From: | Daniel P. Brown | Date: | Thu, 19 Apr 2012 19:36:36 +0000 |
| Subject: | com web/master: Fix unmangle() to work properly instead of hacky.: include/functions.inc manage/mirrors.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-13403@lists.php.net to get a copy of this message | ||
Commit: 9a51032181eb377d4348bd3fec03705c862d614a
Author: Daniel P. Brown <danbrown@php.net> Thu, 19 Apr 2012 15:36:36 -0400
Parents: e8c7756b4aa1eb152becb1143679f4f773db0b52
Branches: master
Link: http://git.php.net/?p=web/master.git;a=commitdiff;h=9a51032181eb377d4348bd3fec03705c862d614a
Log:
Fix unmangle() to work properly instead of hacky.
Changed paths:
M include/functions.inc
M manage/mirrors.php
Diff:
diff --git a/include/functions.inc b/include/functions.inc
index 2c88497..0b07a73 100644
--- a/include/functions.inc
+++ b/include/functions.inc
@@ -205,10 +205,6 @@ function get_ssh_keys($string) {
return $results;
}
-function unmangle($str,$unmangle_quotes=0) {
- // If permitting quotes, remember to sanitize.
- if ($unmangle_quotes) {
- return
str_replace(['<','>','&','ü','"',],['<','>','&','ü','"',],$str);
- }
- return
str_replace(['<','>','&','ü',],['<','>','&','ü',],$str);
+function unmangle($var_name,$filter_type=INPUT_POST,$filter_id=FILTER_UNSAFE_RAW) {
+ return real_clean(filter_input($filter_type,$var_name,$filter_id));
}
diff --git a/manage/mirrors.php b/manage/mirrors.php
index 192e8d2..b896e53 100644
--- a/manage/mirrors.php
+++ b/manage/mirrors.php
@@ -41,10 +41,10 @@ if (isset($id) && isset($hostname)) {
// Perform a full data update on a mirror
case "update":
$query = "UPDATE mirrors SET hostname='$hostname', active=$active,
" .
- "mirrortype=$mirrortype, cname='$cname',
maintainer='".unmangle($maintainer)."', " .
- "providername='".unmangle($providername)."',
providerurl='$providerurl', " .
+ "mirrortype=$mirrortype, cname='$cname',
maintainer='".unmangle('maintainer')."', " .
+
"providername='".unmangle('providername')."',
providerurl='$providerurl', " .
"cc='$cc', lang='$lang', has_stats=$has_stats,
" .
- "lastedited=NOW(),
acmt='".real_clean(unmangle($acmt,1))."' WHERE id = $id";
+ "lastedited=NOW(),
acmt='".unmangle('acmt')."' WHERE id = $id";
$msg = "$hostname updated";
break;
@@ -60,8 +60,8 @@ if (isset($id) && isset($hostname)) {
"cname, maintainer, providername, providerurl, cc, " .
"lang, has_stats, created, lastedited, acmt) " .
"VALUES ('$hostname', $active, $mirrortype,
'$cname', " .
- "'".unmangle($maintainer)."',
'".unmangle($providername)."', '$providerurl', '$cc', "
.
- "'$lang', $has_stats, NOW(), NOW(),
'".real_clean(unmangle($acmt,1))."')";
+ "'".unmangle('maintainer')."',
'".unmangle('providername')."', '$providerurl',
'$cc', " .
+ "'$lang', $has_stats, NOW(), NOW(),
'".unmangle('acmt')."')";
$msg = "$hostname added";
break;
}