From af0b4d9a305bf83e388a0006a32c5e4c36e1f039 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andreas=20=C3=96sterreicher?= Date: Thu, 23 Sep 2010 12:33:51 +0000 Subject: [PATCH] Security Fix bei der Ausgabe der Dateinamen und Verzeichnisnamen --- cis/private/lehre/upload.php | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/cis/private/lehre/upload.php b/cis/private/lehre/upload.php index 00b83c9cc..896506ec9 100644 --- a/cis/private/lehre/upload.php +++ b/cis/private/lehre/upload.php @@ -961,7 +961,7 @@ A:hover { } else { - echo '/'.$subdir; + echo '/'.htmlentities($subdir,ENT_QUOTES,'UTF-8'); } } else @@ -1056,33 +1056,33 @@ A:hover { { if(isset($subdir) && $subdir != "") { - echo "kuerzel&subdir=$subdir/$entry\"> $entry "; + echo "kuerzel&subdir=$subdir/$entry\"> ".htmlentities($entry,ENT_QUOTES,'UTF-8')." "; } else { - echo "kuerzel&subdir=$entry\"> $entry "; + echo "kuerzel&subdir=$entry\"> ".htmlentities($entry,ENT_QUOTES,'UTF-8')." "; } } else if(isset($short)) { if(isset($subdir) && $subdir != "") { - echo " $entry "; + echo " ".htmlentities($entry,ENT_QUOTES,'UTF-8')." "; } else { - echo " $entry "; + echo " ".htmlentities($entry,ENT_QUOTES,'UTF-8')." "; } } else { if(isset($subdir) && $subdir != "") { - echo " $entry "; + echo " ".htmlentities($entry,ENT_QUOTES,'UTF-8')." "; } else { - echo " $entry "; + echo " ".htmlentities($entry,ENT_QUOTES,'UTF-8')." "; } } @@ -1244,7 +1244,7 @@ A:hover { } else { - echo '/'.$subdir; + echo '/'.htmlentities($subdir,ENT_QUOTES,'UTF-8'); } } else @@ -1325,7 +1325,7 @@ A:hover { $link_path = '../../../documents'.mb_substr($dest_dir->path, mb_strlen($link_cut)).'/'.urlencode($entry); //+ durch %20 ersetzten damit Files mit leerzeichen geoeffnet werden koennen $link_path = str_replace("+","%20",$link_path); - echo "  $entry "; + echo "  ".htmlentities($entry, ENT_QUOTES, 'UTF-8')." "; if(isset($_POST['new_file_name'.$file_count])) $new_file_name_ = $_POST['new_file_name'.$file_count];