Changeset 159

Timestamp:

08/17/05 13:34:33 (5 years ago)

Author:

anti

Message:

+ use htmlspecialchars() on the messages returned by some functions, before displaying them to the user,

because those messages might contain user input (results of add_collection/update_collection do in some cases)
and this could be used for XSS attacks

File:

• trunk/admin/plog-manage.php (modified) (1 diff)

trunk/admin/plog-manage.php

@@ -430 +430 @@
         }
 
+        // pass the results through htmlspecialchars, because they might contain user input
         if (!empty($action_result['errors'])) {
-                $output .= '<p class="errors">' . $action_result['errors'] . '</p>';
+                $output .= '<p class="errors">' . htmlspecialchars($action_result['errors']) . '</p>';
         } elseif (!empty($action_result['output'])) {
-                $output .= '<p class="actions">' . $action_result['output'] . '</p>';
+                $output .= '<p class="actions">' . htmlspecialchars($action_result['output']) . '</p>';
         };
 }