From 6e7650e64024ac6e9e2ef00c889fcf0698dc17a4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andreas=20=C3=96sterreicher?= Date: Mon, 2 Jul 2012 12:28:27 +0000 Subject: [PATCH] =?UTF-8?q?XSS=20L=C3=BCcke=20geschlossen?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cis/index.php | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/cis/index.php b/cis/index.php index 903e4b26e..8aecfc60e 100644 --- a/cis/index.php +++ b/cis/index.php @@ -36,7 +36,11 @@ if(isset($_GET['sprache'])) die('Sprache invalid'); } if(isset($_GET['content_id'])) +{ $id = $_GET['content_id']; + if(!is_numeric($id)) + $id=''; +} else $id = ''; @@ -52,6 +56,7 @@ else $sprache = getSprache(); $p = new phrasen($sprache); +$db = new basis_db(); ?> @@ -74,7 +79,7 @@ function changeSprache(sprache) menu = escape(menu); content = escape(content); - window.location.href="index.php?sprache="+sprache+"&content_id=&menu="+menu+"&content="+content; + window.location.href="index.php?sprache="+sprache+"&content_id=convert_html_chars($id);?>&menu="+menu+"&content="+content; } function gettimestamp() { @@ -135,10 +140,10 @@ function loadampel() - -