Changeset 794:0555e761f509 for admin/auth.php

Timestamp:

02/08/12 20:53:04 (13 years ago)

Author:

Dsls <dsls@…>

Branch:

2.4

Message:

Advisory ID: HTB23074 - 1.1: Sanitize admin/auth.php login_data parameter

File:

• admin/auth.php (modified) (1 diff)

admin/auth.php

@@ -31 +31 @@
 
 $change_pwd = $core->auth->allowPassChange() && isset($_POST['new_pwd']) && isset($_POST['new_pwd_c']) && isset($_POST['login_data']);
-$login_data = !empty($_POST['login_data']) ? $_POST['login_data'] : null;
+$login_data = !empty($_POST['login_data']) ? html::escapeHTML($_POST['login_data']) : null;
 $recover = $core->auth->allowPassChange() && !empty($_REQUEST['recover']);
 $safe_mode = !empty($_REQUEST['safe_mode']);