CVS update: /cowiki/includes/cowiki/plugin/

User: dgorski 
Date: 2005/07/07 18:54:19

Modified:
   cowiki/includes/cowiki/plugin/class.PrivateFrontSearchQuery.php

Log:
 Fixed issue #234: Possible JavaScript cross site scripting attacks in search field.

File Changes:

Directory: /cowiki/includes/cowiki/plugin/
==========================================

File [changed]: class.PrivateFrontSearchQuery.php
Url: http://cowiki.tigris.org/source/browse/cowiki/includes/cowiki/plugin/class.PrivateFrontSearchQuery.php?r1=1.6&r2=1.7
Delta lines:  +13 -4
--------------------
--- class.PrivateFrontSearchQuery.php	16 Jan 2005 23:32:09 -0000	1.6
+++ class.PrivateFrontSearchQuery.php	8 Jul 2005 01:54:17 -0000	1.7
@@ -2,7 +2,7 @@
 
 /**
  *
- * $Id: class.PrivateFrontSearchQuery.php,v 1.6 2005/01/16 23:32:09 dgorski Exp $
+ * $Id: class.PrivateFrontSearchQuery.php,v 1.7 2005/07/08 01:54:17 dgorski Exp $
  *
  * This file is part of coWiki. coWiki is free software under the terms of
  * the GNU General Public License (GPL). Read the LICENSE file. If you did
@@ -31,7 +31,7 @@
  * @author      Daniel T. Gorski, <[email protected]>
  * @copyright   (C) Daniel T. Gorski, {@link http://www.develnet.org}
  * @license     http://www.gnu.org/licenses/gpl.html
- * @version     $Revision: 1.6 $
+ * @version     $Revision: 1.7 $
  *
  */
 
@@ -52,6 +52,8 @@
     // Put in the interface version the plugin works with
     const REQUIRED_INTERFACE_VERSION = 1;
 
+    // --------------------------------------------------------------------
+
     /**
      * Init
      *
@@ -68,6 +70,8 @@
         return parent::init(self::REQUIRED_INTERFACE_VERSION);
     }
 
+    // --------------------------------------------------------------------
+
     /**
      * Perform
      *
@@ -97,8 +101,13 @@
         $nWidth = ((int)$this->Registry->get('MENU_MIN_WIDTH')) - 22;
         $this->Template->set('TPL_INPUT_WIDTH', $nWidth);
 
-        // Input field value
-        $this->Template->set('TPL_INPUT_QUERY', $this->Request->get('q').'');
+        // Input field value. Avoid JavaScript cross site scripting attacks
+        // (XSS attack) and escape the query string.
+        $this->Template->set(
+            'TPL_INPUT_QUERY',
+            htmlentities($this->Request->get('q'))
+            .''
+        );
 
         // Parse template
         $Tpl = $this->Context->getTemplateProcessor();