blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-25 00:24:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed XSS issues

Browse Source
This commit is contained in:
bison-paolo
2016-11-24 17:04:46 +01:00
parent 6fabc46a48
commit b97aac7c4b
6 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cis/private/lehre/lesson.php
+2 -1
View File
@@ -64,7 +64,8 @@ $lv_obj->load($lvid);
$lv=$lv_obj;
if(isset($_GET['studiensemester_kurzbz']))
$studiensemester_kurzbz=$_GET['studiensemester_kurzbz'];
// Uses urlencode to avoid XSS issues
$studiensemester_kurzbz = urlencode($_GET['studiensemester_kurzbz']);
else
$studiensemester_kurzbz='';
cis/private/lvplan/stpl_week.php
+3 -2
View File
@@ -55,10 +55,11 @@ if (isset($_GET['datum']))
if (isset($_POST['datum']))
$datum=$_POST['datum'];
// Uses urlencode to avoid XSS issues
if (isset($_GET['ort_kurzbz']))
$ort_kurzbz=$_GET['ort_kurzbz'];
$ort_kurzbz = urlencode($_GET['ort_kurzbz']);
else if (isset($_POST['ort_kurzbz']))
$ort_kurzbz=$_POST['ort_kurzbz'];
$ort_kurzbz = urlencode($_POST['ort_kurzbz']);
else
$ort_kurzbz=null;
cis/private/tools/suche.php
+4 -1
View File
@@ -61,7 +61,10 @@ echo '<h1>',$p->t('tools/suche'),'</h1>';
$search = (isset($_REQUEST['search'])?$_REQUEST['search']:'');
echo '<form action="',$_SERVER['PHP_SELF'],'" name="searchform" method="GET">
// Uses htmlspecialchars to avoid XSS issues
$self = htmlspecialchars($_SERVER["PHP_SELF"], ENT_QUOTES, "utf-8");
echo '<form action="',$self,'" name="searchform" method="GET">
<input type="search" placeholder="'.$p->t('tools/suchbegriff').' ..." size="40" name="search" value="',$db->convert_html_chars($search),'" />
<img src="../../../skin/images/search.png" onclick="document.searchform.submit()" height="15px" class="suchicon"/>
</form><br>';
cis/private/tools/zeitaufzeichnung.php
+2 -1
View File
@@ -86,7 +86,8 @@ $activities_str = "'".implode("','", $activities)."'";
$gesperrt_bis = '2015-08-31';
$sperrdatum = date('c', strtotime($gesperrt_bis));
$zeitaufzeichnung_id = (isset($_GET['zeitaufzeichnung_id'])?$_GET['zeitaufzeichnung_id']:'');
// Uses urlencode to avoid XSS issues
$zeitaufzeichnung_id = urlencode(isset($_GET['zeitaufzeichnung_id'])?$_GET['zeitaufzeichnung_id']:'');
$projekt_kurzbz = (isset($_POST['projekt'])?$_POST['projekt']:'');
$oe_kurzbz_1 = (isset($_POST['oe_kurzbz_1'])?$_POST['oe_kurzbz_1']:'');
$oe_kurzbz_2 = (isset($_POST['oe_kurzbz_2'])?$_POST['oe_kurzbz_2']:'');