com web/php: Fix xss on bogus filenames (reported by Rasmus): include/do-download.inc include/get-download.inc

Commit: 12442a0b4b19ee5578689cc1320969bab3ebe907 Author: Hannes Magnusson <bjori@php.net> Sun, 23 Jan 2011 14:31:11 +0000 Parents: 40eede10ab1d7d5858f7dbefd9c2e46dc1af4dc1 Branches: master Link: http://git.php.net/?p=web/php.git;a=commitdiff;h=12442a0b4b19ee5578689cc1320969bab3ebe907 Log: Fix xss on bogus filenames (reported by Rasmus) Changed paths: M include/do-download.inc M include/get-download.inc Diff: diff --git a/include/do-download.inc b/include/do-download.inc index f7f6c87..22f3389 100644 --- a/include/do-download.inc +++ b/include/do-download.inc @@ -47,7 +47,7 @@ function download_file($mirror, $file) } else { $info = "<p> - The file you requested (<strong>{$file}</strong>) is not found on + The file you requested (<strong> " . htmlspecialchars($file, ENT_QUOTES, "UTF-8") . " </strong>) is not found on this server (<strong>{$MYSITE}</strong>). If this file is a recent addition to our downloads, then it is possible that this particular server is not yet updated to host that file for download. diff --git a/include/get-download.inc b/include/get-download.inc index 00c2432..92878c3 100644 --- a/include/get-download.inc +++ b/include/get-download.inc @@ -37,7 +37,7 @@ if ($file === FALSE) { } else { $info = "<p> - The file you requested (<strong>{$df}</strong>) is not found on + The file you requested (<strong> " . htmlspecialchars($df, ENT_QUOTES, "UTF-8") . " </strong>) is not found on this server (<strong>{$MYSITE}</strong>). If this file is a recent addition to our downloads, then it is possible that this particular server is not yet updated to host that file for download.