Changeset 3649:3b0b868d58b0 for admin/user.php

Timestamp:

01/12/18 07:57:00 (5 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Children:

3650:11cb6291eea7, 3651:6980a7a06518

Message:

Fix potential XSS - thank's Trí Chim Trích for report

File:

• admin/user.php (modified) (2 diffs)

admin/user.php

@@ -80 +80 @@
           $cur->user_id = $_POST['user_id'];
           $cur->user_super = $user_super = !empty($_POST['user_super']) ? 1 : 0;
-          $cur->user_name = $user_name = $_POST['user_name'];
-          $cur->user_firstname = $user_firstname = $_POST['user_firstname'];
-          $cur->user_displayname = $user_displayname = $_POST['user_displayname'];
-          $cur->user_email = $user_email = $_POST['user_email'];
-          $cur->user_url = $user_url = $_POST['user_url'];
-          $cur->user_lang = $user_lang = $_POST['user_lang'];
-          $cur->user_tz = $user_tz = $_POST['user_tz'];
-          $cur->user_post_status = $user_post_status = $_POST['user_post_status'];
+          $cur->user_name = $user_name = html::escapeHTML($_POST['user_name']);
+          $cur->user_firstname = $user_firstname = html::escapeHTML($_POST['user_firstname']);
+          $cur->user_displayname = $user_displayname = html::escapeHTML($_POST['user_displayname']);
+          $cur->user_email = $user_email = html::escapeHTML($_POST['user_email']);
+          $cur->user_url = $user_url = html::escapeHTML($_POST['user_url']);
+          $cur->user_lang = $user_lang = html::escapeHTML($_POST['user_lang']);
+          $cur->user_tz = $user_tz = html::escapeHTML($_POST['user_tz']);
+          $cur->user_post_status = $user_post_status = html::escapeHTML($_POST['user_post_status']);
 
           if ($user_id && $cur->user_id == $core->auth->userID() && $core->auth->isSuperAdmin()) {
@@ -105 +105 @@
           }
 
-          $user_options['post_format'] = $_POST['user_post_format'];
+          $user_options['post_format'] = html::escapeHTML($_POST['user_post_format']);
           $user_options['edit_size'] = (integer) $_POST['user_edit_size'];