Changes in [791:f8f30fe55f7b:801:da8bc9d70ae7]

Files:

• .hgtags (modified) (1 diff)
• CHANGELOG (modified) (1 diff)
• admin/auth.php (modified) (1 diff)
• admin/blogs.php (modified) (1 diff)
• admin/comments.php (modified) (5 diffs)
• admin/posts.php (modified) (8 diffs)
• plugins/tags/tag_posts.php (modified) (1 diff)

.hgtags

@@ -1 +1 @@
 ec077f3c6b20bc6f7f40a113acaff0220457a2c4 2.3.0
 4e0137ddb12474d62b88c4966d5895a391b6d382 2.3.1
+43a9cace0f39c95463e66346dcc953ced40836be 2.4.2
+43a9cace0f39c95463e66346dcc953ced40836be 2.4.2
+0000000000000000000000000000000000000000 2.4.2
+0000000000000000000000000000000000000000 2.4.2
+6b3942c0cf7eee71ebd906ec0827c5962823dedf 2.4.2

CHANGELOG

@@ +1 @@
+Dotclear 2.4.2 - 2012-02-11
+===========================================================
+* Security fix release
+* 4 XSS vulnerabilities fixed, discovered by High-Tech Bridge
+
 Dotclear 2.4.1.2 - 2011-12-24
 ===========================================================

admin/auth.php

@@ -31 +31 @@
 
 $change_pwd = $core->auth->allowPassChange() && isset($_POST['new_pwd']) && isset($_POST['new_pwd_c']) && isset($_POST['login_data']);
-$login_data = !empty($_POST['login_data']) ? $_POST['login_data'] : null;
+$login_data = !empty($_POST['login_data']) ? html::escapeHTML($_POST['login_data']) : null;
 $recover = $core->auth->allowPassChange() && !empty($_REQUEST['recover']);
 $safe_mode = !empty($_REQUEST['safe_mode']);

admin/blogs.php

@@ -35 +35 @@
 
 if (!empty($_GET['nb']) && (integer) $_GET['nb'] > 0) {
-     $nb_per_page = $_GET['nb'];
+     $nb_per_page = (integer) $_GET['nb'];
 }
 

admin/comments.php

@@ -73 +73 @@
      $params['q_author'] = $author;
      $show_filters = true;
+} else {
+     $author='';
 }
 
@@ -79 +81 @@
      $params['comment_trackback'] = ($type == 'tb');
      $show_filters = true;
+} else {
+     $type='';
 }
 
@@ -87 +91 @@
 } elseif (!$with_spam) {
      $params['comment_status_not'] = -2;
+     $status='';
+} else {
+     $status='';
 }
 
@@ -99 +106 @@
      if ($order !== '' && in_array($order,$order_combo)) {
           $params['order'] = $sortby.' '.$order;
+     } else {
+          $order = 'desc';
      }
      
@@ -104 +113 @@
           $show_filters = true;
      }
+} else {
+     $sortby = 'comment_dt';
+     $order = 'desc';
 }
 

admin/posts.php

@@ -166 +166 @@
      $params['user_id'] = $user_id;
      $show_filters = true;
+} else {
+     $user_id='';
 }
 
@@ -172 +174 @@
      $params['cat_id'] = $cat_id;
      $show_filters = true;
+} else {
+     $cat_id='';
 }
 
@@ -178 +182 @@
      $params['post_status'] = $status;
      $show_filters = true;
+} else {
+     $status='';
 }
 
@@ -184 +190 @@
      $params['post_selected'] = $selected;
      $show_filters = true;
+} else {
+     $selected='';
 }
 
@@ -191 +199 @@
      $params['post_year'] = substr($month,0,4);
      $show_filters = true;
+} else {
+     $month='';
 }
 
@@ -197 +207 @@
      $params['post_lang'] = $lang;
      $show_filters = true;
+} else {
+     $lang='';
 }
 
@@ -203 +215 @@
      if ($order !== '' && in_array($order,$order_combo)) {
           $params['order'] = $sortby.' '.$order;
+     } else {
+          $order='desc';
      }
      
@@ -208 +222 @@
           $show_filters = true;
      }
+} else {
+     $sortby='post_dt';
+     $order='desc';
 }
 

plugins/tags/tag_posts.php

@@ -17 +17 @@
 
 
-$page = !empty($_GET['page']) ? $_GET['page'] : 1;
+$page = !empty($_GET['page']) ? (integer) $_GET['page'] : 1;
 $nb_per_page =  30;