Changeset 185 for tags/2.0.2/lib


Ignore:
Timestamp:
Jun 24, 2006 11:02:54 PM (18 years ago)
Author:
scdev
Message:

Q - added oTxt() around all printed PHP_SELFs to avoid XSS attack. See: ​http://blog.phpdoc.info/archives/13-XSS-Woes.html

Location:
tags/2.0.2/lib
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • tags/2.0.2/lib/PEdit.inc.php

    r101 r185  
    212212        }
    213213        ?>       
    214         <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" id="sc-pedit-form">
    215         <input type="hidden" name="filename" value="<?php echo $_SERVER['PHP_SELF']; ?>" />
     214        <form action="<?php echo oTxt($_SERVER['PHP_SELF']); ?>" method="post" id="sc-pedit-form">
     215        <input type="hidden" name="filename" value="<?php echo oTxt($_SERVER['PHP_SELF']); ?>" />
    216216        <input type="hidden" name="file_hash" value="<?php echo $this->_fileHash(); ?>" />
    217217        <?php

  • tags/2.0.2/lib/RecordLock.inc.php

    r111 r185  
    334334    {
    335335        ?>
    336         <form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
     336        <form method="post" action="<?php echo oTxt($_SERVER['PHP_SELF']); ?>">
    337337        <?php App::printHiddenSession() ?>
    338338        <input type="hidden" name="lock_id" value="<?php echo $this->getID(); ?>" />
Note: See TracChangeset for help on using the changeset viewer.