com web/master: escape the $user variable coming from $_REQUEST magic_quote_gpc makes this not expl oitable, but we should move away from that so oner
or later: forgot.php
| From: | Ferenc Kovacs | Date: | Wed, 11 Jun 2014 10:11:33 +0000 |
| Subject: | com web/master: escape the $user variable coming from $_REQUEST magic_quote_gpc makes this not expl oitable, but we should move away from that so oner or later: forgot.php |
||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-19238@lists.php.net to get a copy of this message | ||
Commit: 9404bdc83562397e78c35e6daf2c91bf8a886f60
Author: kovacs.ferenc <kovacs.ferenc@ustream.tv> Wed, 11 Jun 2014 12:11:33 +0200
Parents: e024ef1a36b36785955816a1ee95c9c498ad0550
Branches: master
Link: http://git.php.net/?p=web/master.git;a=commitdiff;h=9404bdc83562397e78c35e6daf2c91bf8a886f60
Log:
escape the $user variable coming from $_REQUEST
magic_quote_gpc makes this not exploitable, but we should move away from that sooner or later
Changed paths:
M forgot..php
Diff:
diff --git a/forgot.php b/forgot.php
index eef660c..43d33bc 100644
--- a/forgot.php
+++ b/forgot.php
@@ -69,6 +69,7 @@ password: <input type="password" name="n1"
value="<?= hsc($n1)?>" />
exit;
}
elseif ($user) {
+ $user = mysql_real_escape_string($user);
$res = @mysql_query("SELECT * FROM users WHERE username = '$user'");
if ($res && ($row = mysql_fetch_array($res,MYSQL_ASSOC))) {
$newpass = random_password();