com web/php: Prevent response header splitting: cached.php manual/change.php

Commit: efc35ac0f036067081e13aabca445f68d6e7b9b4 Author: Rasmus Lerdorf <rasmus@php.net> Wed, 12 Mar 2014 08:11:21 -0700 Parents: d807946a2456f6faa1762e37b6b641b86e7f4027 Branches: master Link: http://git.php.net/?p=web/php.git;a=commitdiff;h=efc35ac0f036067081e13aabca445f68d6e7b9b4 Log: Prevent response header splitting Changed paths: M cached.php M manual/change.php Diff: diff --git a/cached.php b/cached.php index 6793c04..a716a7a 100644 --- a/cached.php +++ b/cached.php @@ -11,7 +11,7 @@ $abs = $pwd. "/" .(string)$_GET["f"]; $abs = realpath($abs); if (strncmp($abs, $pwd, strlen($pwd)) != 0) { - header("Location: http://php.net/" . $_GET["f"]); + header("Location: http://php.net/" . strtr($_GET["f"],array("\r"=>"","\n"=>""))); exit; } diff --git a/manual/change.php b/manual/change.php index 3d9dcbc..72089f3 100644 --- a/manual/change.php +++ b/manual/change.php @@ -3,7 +3,7 @@ include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; $page = isset($_GET['page']) ? htmlspecialchars($_GET['page'], ENT_QUOTES, 'UTF-8') : ''; +$page = strtr($page, array("\r"=>"","\n"=>"")); // Redirect to new manual page mirror_redirect("/manual/" . $page); -?> \ No newline at end of file