cvs: php-gtk-web / manual-lookup.php /error index.php /include shared-manual.inc /wiki index.php pmwiki.php
[email protected] ("Rasmus Lerdorf")
| Newsgroups | php.gtk.webmaster |
|---|---|
| Message-ID | <cvsrasmus1132535525@cvsserver> |
rasmus Sun Nov 20 20:12:05 2005 EDT
Modified files:
/php-gtk-web manual-lookup.php
/php-gtk-web/error index.php
/php-gtk-web/include shared-manual.inc
/php-gtk-web/wiki index.php pmwiki.php
Log:
Fix XSS problems
http://cvs.php.net/diff.php/php-gtk-web/manual-lookup.php?r1=1.2&r2=1.3&ty=u
Index: php-gtk-web/manual-lookup.php
diff -u php-gtk-web/manual-lookup.php:1.2 php-gtk-web/manual-lookup.php:1.3
--- php-gtk-web/manual-lookup.php:1.2 Sun May 11 21:40:04 2003
+++ php-gtk-web/manual-lookup.php Sun Nov 20 20:12:01 2005
@@ -20,7 +20,7 @@
function make404($lang) {
commonHeader("404 Not Found");
- $no_path = str_replace("/php-gtk-web/manual-lookup.php?lang=$lang&function=", "", $_SERVER[REQUEST_URI]);
+ $no_path = str_replace("/php-gtk-web/manual-lookup.php?lang=$lang&function=", "", htmlspecialchars($_SERVER[REQUEST_URI]));
$no_path = ereg_replace('&[x]=[0-9]&[y]=[0-9]', '', $no_path);
echo "<br> <H1>Not Found</H1><br>";
if(strlen($no_path) < 3)
http://cvs.php.net/diff.php/php-gtk-web/error/index.php?r1=1.5&r2=1.6&ty=u
Index: php-gtk-web/error/index.php
diff -u php-gtk-web/error/index.php:1.5 php-gtk-web/error/index.php:1.6
--- php-gtk-web/error/index.php:1.5 Mon May 12 21:24:22 2003
+++ php-gtk-web/error/index.php Sun Nov 20 20:12:03 2005
@@ -6,7 +6,7 @@
header('HTTP/1.0 404 Not Found');
commonHeader('404 Not Found');
echo "<H1>Not Found</H1>\n";
- echo "<P>The page <B>" . $_SERVER['REQUEST_URI'] . "</B> could not be found.</P>\n";
+ echo "<P>The page <B>" . htmlspecialchars($_SERVER['REQUEST_URI']) . "</B> could not be found.</P>\n";
commonFooter();
}
@@ -15,6 +15,8 @@
include_once "../configuration.inc";
}
+$ri = htmlspecialchars($_SERVER['REQUEST_URI']);
+
if (preg_match('/\.(pdf|gif|jpg)$/', $_SERVER['REQUEST_URI'])) {
make404();
exit;
@@ -25,7 +27,7 @@
$lang = "en"; // fall back to English
}
# handle .php3 files that were renamed to .php
-if (preg_match("/(.*\.php)3$/", $_SERVER['REQUEST_URI'], $array)) {
+if (preg_match("/(.*\.php)3$/", $ri, $array)) {
if($_SERVER['SERVER_PORT']!=80) {
$url = "http://".$_SERVER['SERVER_NAME'].":".$_SERVER['SERVER_PORT'].$array[1];
} else {
@@ -42,7 +44,7 @@
}
# handle moving english manual down into its own directory
-if (eregi("^(.*)/manual/((html/)?[^/]+)$", $_SERVER['REQUEST_URI'], $array)) {
+if (eregi("^(.*)/manual/((html/)?[^/]+)$", $ri, $array)) {
if($_SERVER['SERVER_PORT']!=80) {
$url = "http://".$_SERVER['SERVER_NAME'].":".$_SERVER['SERVER_PORT']."$array[1]/manual/$lang/".$array[2];
} else {
http://cvs.php.net/diff.php/php-gtk-web/include/shared-manual.inc?r1=1.57&r2=1.58&ty=u
Index: php-gtk-web/include/shared-manual.inc
diff -u php-gtk-web/include/shared-manual.inc:1.57 php-gtk-web/include/shared-manual.inc:1.58
--- php-gtk-web/include/shared-manual.inc:1.57 Mon Aug 25 21:01:04 2003
+++ php-gtk-web/include/shared-manual.inc Sun Nov 20 20:12:04 2005
@@ -215,7 +215,7 @@
if ($i>1) {
echo ' <font color="#999999">|</font> ';
}
- print_link($_SERVER['PHP_SELF'].'?rate_id='.$row['id'].'&rate_note='.$i, $i);
+ print_link(htmlspecialchars($_SERVER['PHP_SELF']).'?rate_id='.$row['id'].'&rate_note='.$i, $i);
}
echo '<br>';
}
@@ -304,7 +304,7 @@
$back_url = 'http://' . $_SERVER['SERVER_NAME'] .
(($SERVER_PORT==80) ? '' : ':'.$_SERVER['SERVER_PORT'] ) .
- $_SERVER['PHP_SELF'];
+ htmlspecialchars($_SERVER['PHP_SELF']);
echo '<tr bgcolor="#d0d0d0" valign="top">';
echo '<td><small>User Contributed Notes<br></small><b>' . $title . '</b><br></td>';
http://cvs.php.net/diff.php/php-gtk-web/wiki/index.php?r1=1.2&r2=1.3&ty=u
Index: php-gtk-web/wiki/index.php
diff -u php-gtk-web/wiki/index.php:1.2 php-gtk-web/wiki/index.php:1.3
--- php-gtk-web/wiki/index.php:1.2 Sat Nov 12 03:42:31 2005
+++ php-gtk-web/wiki/index.php Sun Nov 20 20:12:05 2005
@@ -29,8 +29,8 @@
$WikiTitle = "PmWiki";
$DefaultGroup = "Main";
$DefaultTitle = "HomePage";
-$ScriptUrl = 'http://'.$_SERVER['HTTP_HOST'];
-$ScriptUrl .= $_SERVER['SCRIPT_NAME'];
+$ScriptUrl = 'http://'.htmlspecialchars($_SERVER['HTTP_HOST']);
+$ScriptUrl .= htmlspecialchars($_SERVER['SCRIPT_NAME']);
$PubDirUrl = preg_replace("#/[^/]*\$#","/pub",$ScriptUrl,1);
$DiffKeepDays = 3650;
$WikiDir = "wiki.d";
@@ -221,7 +221,7 @@
SDV($EnablePathInfo,!preg_match("/^cgi/",php_sapi_name()));
if ($pagename=='' && $EnablePathInfo)
- $pagename = @substr($_SERVER['PATH_INFO'],1);
+ $pagename = @substr(htmlspecialchars($_SERVER['PATH_INFO']),1);
if (preg_match('/[\\x80-\\xbf]/',$pagename)) $pagename=utf8_decode($pagename);
if ($action=='') $action='browse';
http://cvs.php.net/diff.php/php-gtk-web/wiki/pmwiki.php?r1=1.2&r2=1.3&ty=u
Index: php-gtk-web/wiki/pmwiki.php
diff -u php-gtk-web/wiki/pmwiki.php:1.2 php-gtk-web/wiki/pmwiki.php:1.3
--- php-gtk-web/wiki/pmwiki.php:1.2 Fri Oct 15 10:03:21 2004
+++ php-gtk-web/wiki/pmwiki.php Sun Nov 20 20:12:05 2005
@@ -29,8 +29,8 @@
$WikiTitle = "PmWiki";
$DefaultGroup = "Main";
$DefaultTitle = "HomePage";
-$ScriptUrl = 'http://'.$_SERVER['HTTP_HOST'];
-$ScriptUrl .= $_SERVER['SCRIPT_NAME'];
+$ScriptUrl = 'http://'.htmlspecialchars($_SERVER['HTTP_HOST']);
+$ScriptUrl .= htmlspecialchars($_SERVER['SCRIPT_NAME']);
$PubDirUrl = preg_replace("#/[^/]*\$#","/pub",$ScriptUrl,1);
$DiffKeepDays = 3650;
$WikiDir = "wiki.d";
@@ -221,7 +221,7 @@
SDV($EnablePathInfo,!preg_match("/^cgi/",php_sapi_name()));
if ($pagename=='' && $EnablePathInfo)
- $pagename = @substr($_SERVER['PATH_INFO'],1);
+ $pagename = @substr(htmlspecialchars($_SERVER['PATH_INFO']),1);
if (preg_match('/[\\x80-\\xbf]/',$pagename)) $pagename=utf8_decode($pagename);
if ($action=='') $action='browse';