com web/php: Fix xss problems: include/do-download.inc include/langchooser.inc

Commit: 40eede10ab1d7d5858f7dbefd9c2e46dc1af4dc1 Author: Rasmus Lerdorf <rasmus@php.net> Fri, 21 Jan 2011 15:28:33 +0000 Parents: 1ccb1722b46f915b24a329fcf3d8eadce721858c Branches: master Link: http://git.php.net/?p=web/php.git;a=commitdiff;h=40eede10ab1d7d5858f7dbefd9c2e46dc1af4dc1 Log: Fix xss problems Changed paths: M include/do-download.inc M include/langchooser.inc Diff: diff --git a/include/do-download.inc b/include/do-download.inc index 1b49d7d..f7f6c87 100644 --- a/include/do-download.inc +++ b/include/do-download.inc @@ -32,7 +32,7 @@ function download_file($mirror, $file) // If user comes from a mirror selection page, provide a backlink if (isset($_SERVER['HTTP_REFERER']) && preg_match("!/from/a/mirror$!", $_SERVER['HTTP_REFERER'])) { - $moreinfo = ", or <a href=\"{$_SERVER['HTTP_REFERER']}\">reconsider your mirror selection</a>"; + $moreinfo = ", or <a href=\"".htmlspecialchars($_SERVER['HTTP_REFERER'],ENT_QUOTES,'UTF-8')."\">reconsider your mirror selection</a>"; } else { $moreinfo = ""; } // An executable was requested (temp fix for rsync change) diff --git a/include/langchooser.inc b/include/langchooser.inc index 2c1e7c8..243f12b 100644 --- a/include/langchooser.inc +++ b/include/langchooser.inc @@ -31,7 +31,7 @@ */ // Default STRIPPED_URI -$_SERVER['STRIPPED_URI'] = $_SERVER['REQUEST_URI']; +$_SERVER['STRIPPED_URI'] = htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, 'UTF-8'); // The code is encapsulated in a function, // so the variable namespace is not polluted @@ -51,14 +51,14 @@ function language_choose_code() // Specified for the request (GET/POST parameter) if (!empty($_REQUEST['lang'])) { - $explicitly_specified = language_add($_REQUEST['lang'], $languages); + $explicitly_specified = language_add(htmlspecialchars($_REQUEST['lang'], ENT_QUOTES, 'UTF-8'), $languages); // Set the language in a cookie for a year mirror_setcookie("LAST_LANG", $explicitly_specified, 60*60*24*365); } // Specified in a shortcut URL (eg. /en/echo or /pt_br/echo) - if (preg_match("!^/(\\w{2}(_\\w{2})?)/!", $_SERVER['REQUEST_URI'], $flang)) { + if (preg_match("!^/(\\w{2}(_\\w{2})?)/!", htmlspecialchars($_SERVER['REQUEST_URI'],ENT_QUOTES, 'UTF-8'), $flang)) { // Put language into preference list $rlang = language_add($flang[1], $languages); @@ -70,13 +70,13 @@ function language_choose_code() // Drop out langauge specification from URL, as this is already handled $_SERVER['STRIPPED_URI'] = preg_replace( - "!^/$flang[1]/!", "/", $_SERVER['REQUEST_URI'] + "!^/$flang[1]/!", "/", htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, 'UTF-8') ); } // Specified in a manual URL (eg. manual/en/ or manual/pt_br/) - if (preg_match("!^/manual/(\\w{2}(_\\w{2})?)(/|$)!", $_SERVER['REQUEST_URI'], $flang)) { + if (preg_match("!^/manual/(\\w{2}(_\\w{2})?)(/|$)!", htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, 'UTF-8'), $flang)) { $flang = language_add($flang[1], $languages);