cvs: php-bugs-web / bug.php fix.php lbugs.php report.php

bjori Thu Oct 16 12:07:14 2008 UTC Modified files: /php-bugs-web bug.php fix.php lbugs.php report.php Log: Fix few XSS issues (reported by execut3-at-gmail.com) http://cvs.php.net/viewvc.cgi/php-bugs-web/bug.php?r1=1.89&r2=1.90&diff_format=u Index: php-bugs-web/bug.php diff -u php-bugs-web/bug.php:1.89 php-bugs-web/bug.php:1.90 --- php-bugs-web/bug.php:1.89 Fri Jun 13 20:25:36 2008 +++ php-bugs-web/bug.php Thu Oct 16 12:07:14 2008 @@ -52,7 +52,7 @@ exit; } -$self = strip_tags($PHP_SELF); +$self = htmlspecialchars($_SERVER["PHP_SELF"], ENT_QUOTES); /* Is trusted ? */ $is_trusted = false; http://cvs.php.net/viewvc.cgi/php-bugs-web/fix.php?r1=1.20&r2=1.21&diff_format=u Index: php-bugs-web/fix.php diff -u php-bugs-web/fix.php:1.20 php-bugs-web/fix.php:1.21 --- php-bugs-web/fix.php:1.20 Tue Feb 27 18:41:15 2007 +++ php-bugs-web/fix.php Thu Oct 16 12:07:14 2008 @@ -39,7 +39,7 @@ commonHeader("Resolve Bug"); display_errors($errors); ?> -<form method="post" action="<?php echo strip_tags($PHP_SELF)?>"> +<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"], ENT_QUOTES)?>"> <input type="hidden" name="id" value="<?php echo $id?>" /> <table> <tr> http://cvs.php.net/viewvc.cgi/php-bugs-web/lbugs.php?r1=1.15&r2=1.16&diff_format=u Index: php-bugs-web/lbugs.php diff -u php-bugs-web/lbugs.php:1.15 php-bugs-web/lbugs.php:1.16 --- php-bugs-web/lbugs.php:1.15 Sun May 8 16:04:08 2005 +++ php-bugs-web/lbugs.php Thu Oct 16 12:07:14 2008 @@ -46,7 +46,7 @@ for($i=0;$i<$len; $i++) $s.= "="; echo "$s</b>\n"; } - printf("<a href=\"%s?id=%d\">%4d</a>",strip_tags($PHP_SELF),$row['id'],$row['id']); + printf("<a href=\"%s?id=%d\">%4d</a>",htmlspecialchars($_SERVER["PHP_SELF"], ENT_QUOTES),$row['id'],$row['id']); printf(" %-9s ",$row['status']); echo " ".htmlspecialchars($row['sdesc'])."\n"; } http://cvs.php.net/viewvc.cgi/php-bugs-web/report.php?r1=1.70&r2=1.71&diff_format=u Index: php-bugs-web/report.php diff -u php-bugs-web/report.php:1.70 php-bugs-web/report.php:1.71 --- php-bugs-web/report.php:1.70 Sat Jul 26 08:27:31 2008 +++ php-bugs-web/report.php Thu Oct 16 12:07:14 2008 @@ -251,7 +251,7 @@ if ($errors) display_errors($errors); ?> -<form method="post" action="<?php echo htmlspecialchars($PHP_SELF, ENT_QUOTES);?>"> +<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"], ENT_QUOTES);?>"> <input type="hidden" name="in[did_luser_search]" value="<?php echo $in['did_luser_search'] ? 1 : 0; ?>" /> <table> <tr>