cvs: php-news-web / article.php getpart.php group.php
| From: | Derick Rethans | Date: | Sun, 27 Jul 2008 10:22:39 +0000 |
| Subject: | cvs: php-news-web / article.php getpart.php group.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-2217@lists.php.net to get a copy of this message | ||
derick Sun Jul 27 10:22:39 2008 UTC
Modified files:
/php-news-web article.php getpart.php group.php
Log:
- Sanitize the group name, as it's echo'ed back.
http://cvs.php.net/viewvc.cgi/php-news-web/article.php?r1=1.35&r2=1.36&diff_format=u
Index: php-news-web/article.php
diff -u php-news-web/article.php:1.35 php-news-web/article.php:1.36
--- php-news-web/article.php:1.35 Sat Dec 30 03:57:36 2006
+++ php-news-web/article.php Sun Jul 27 10:22:39 2008
@@ -10,7 +10,7 @@
}
if (isset($_GET['group'])) {
- $group = $_GET['group'];
+ $group = preg_replace('[^A-Za-z0-9.-]', '', $_GET['group']);
} else {
$group = false;
}
http://cvs.php.net/viewvc.cgi/php-news-web/getpart.php?r1=1.3&r2=1.4&diff_format=u
Index: php-news-web/getpart.php
diff -u php-news-web/getpart.php:1.3 php-news-web/getpart.php:1.4
--- php-news-web/getpart.php:1.3 Wed Jan 26 16:52:39 2005
+++ php-news-web/getpart.php Sun Jul 27 10:22:39 2008
@@ -4,7 +4,7 @@
require 'nntp.inc';
if (isset($_GET['group'])) {
- $group = $_GET['group'];
+ $group = preg_replace('[^A-Za-z0-9.-]', '', $_GET['group']);
} else {
$group = false;
}
http://cvs.php.net/viewvc.cgi/php-news-web/group.php?r1=1.22&r2=1.23&diff_format=u
Index: php-news-web/group.php
diff -u php-news-web/group.php:1.22 php-news-web/group.php:1.23
--- php-news-web/group.php:1.22 Sun Mar 18 06:29:00 2007
+++ php-news-web/group.php Sun Jul 27 10:22:39 2008
@@ -4,7 +4,7 @@
require 'nntp.inc';
if (isset($_GET['group'])) {
- $group = $_GET['group'];
+ $group = preg_replace('[^A-Za-z0-9.-]', '', $_GET['group']);
} else {
error("Missing group");
}