Changeset 3649:3b0b868d58b0

Timestamp:

01/12/18 07:57:00 (5 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Children:

3650:11cb6291eea7, 3651:6980a7a06518

Message:

Fix potential XSS - thank's Trí Chim Trích for report

Files:

• CHANGELOG (modified) (1 diff)
• admin/auth.php (modified) (1 diff)
• admin/blogs.php (modified) (1 diff)
• admin/comments.php (modified) (1 diff)
• admin/posts.php (modified) (1 diff)
• admin/user.php (modified) (2 diffs)
• admin/users.php (modified) (1 diff)

CHANGELOG

@@ -4 +4 @@
 * 🛡 Security: New password management system (including silent migration)
 * 🛡 Security: Add Referrer-Policy header in admin pages
+* 🛡 Security: Fix potential XSS - thank's Trí Chim Trích for report
 * Dotclear news are now displayed in async way by js
 * Dotclear core update check is now done by async js - a forced check may still be done on <admin>/update.php page

admin/auth.php

@@ -83 +83 @@
 {
      $user_id = !empty($_POST['user_id']) ? $_POST['user_id'] : null;
-     $user_email = !empty($_POST['user_email']) ? $_POST['user_email'] : '';
+     $user_email = !empty($_POST['user_email']) ? html::escapeHTML($_POST['user_email']) : '';
      try
      {

admin/blogs.php

@@ -54 +54 @@
 
 if (!empty($_GET['nb']) && (integer) $_GET['nb'] > 0) {
-     if ($nb_per_page != $_GET['nb']) {
+     if ($nb_per_page !=  (integer) $_GET['nb']) {
           $show_filters = true;
      }

admin/comments.php

@@ -78 +78 @@
 
 if (!empty($_GET['nb']) && (integer) $_GET['nb'] > 0) {
-     if ($nb_per_page != $_GET['nb']) {
+     if ($nb_per_page !=  (integer) $_GET['nb']) {
           $show_filters = true;
      }

admin/posts.php

@@ -179 +179 @@
 
 if (!empty($_GET['nb']) && (integer) $_GET['nb'] > 0) {
-     if ($nb_per_page != $_GET['nb']) {
+     if ($nb_per_page !=  (integer) $_GET['nb']) {
           $show_filters = true;
      }

admin/user.php

@@ -80 +80 @@
           $cur->user_id = $_POST['user_id'];
           $cur->user_super = $user_super = !empty($_POST['user_super']) ? 1 : 0;
-          $cur->user_name = $user_name = $_POST['user_name'];
-          $cur->user_firstname = $user_firstname = $_POST['user_firstname'];
-          $cur->user_displayname = $user_displayname = $_POST['user_displayname'];
-          $cur->user_email = $user_email = $_POST['user_email'];
-          $cur->user_url = $user_url = $_POST['user_url'];
-          $cur->user_lang = $user_lang = $_POST['user_lang'];
-          $cur->user_tz = $user_tz = $_POST['user_tz'];
-          $cur->user_post_status = $user_post_status = $_POST['user_post_status'];
+          $cur->user_name = $user_name = html::escapeHTML($_POST['user_name']);
+          $cur->user_firstname = $user_firstname = html::escapeHTML($_POST['user_firstname']);
+          $cur->user_displayname = $user_displayname = html::escapeHTML($_POST['user_displayname']);
+          $cur->user_email = $user_email = html::escapeHTML($_POST['user_email']);
+          $cur->user_url = $user_url = html::escapeHTML($_POST['user_url']);
+          $cur->user_lang = $user_lang = html::escapeHTML($_POST['user_lang']);
+          $cur->user_tz = $user_tz = html::escapeHTML($_POST['user_tz']);
+          $cur->user_post_status = $user_post_status = html::escapeHTML($_POST['user_post_status']);
 
           if ($user_id && $cur->user_id == $core->auth->userID() && $core->auth->isSuperAdmin()) {
@@ -105 +105 @@
           }
 
-          $user_options['post_format'] = $_POST['user_post_format'];
+          $user_options['post_format'] = html::escapeHTML($_POST['user_post_format']);
           $user_options['edit_size'] = (integer) $_POST['user_edit_size'];
 

admin/users.php

@@ -52 +52 @@
 
 if (!empty($_GET['nb']) && (integer) $_GET['nb'] > 0) {
-     if ($nb_per_page != $_GET['nb']) {
+     if ($nb_per_page !=  (integer) $_GET['nb']) {
           $show_filters = true;
      }
-     $nb_per_page = $_GET['nb'];
+     $nb_per_page =  (integer) $_GET['nb'];
 }