blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-26 09:04:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed XSS issues

Browse Source
This commit is contained in:
bison-paolo
2016-11-24 17:04:46 +01:00
parent 6fabc46a48
commit b97aac7c4b
6 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cis/private/tools/suche.php
+4 -1
View File
@@ -61,7 +61,10 @@ echo '<h1>',$p->t('tools/suche'),'</h1>';
$search = (isset($_REQUEST['search'])?$_REQUEST['search']:'');
echo '<form action="',$_SERVER['PHP_SELF'],'" name="searchform" method="GET">
// Uses htmlspecialchars to avoid XSS issues
$self = htmlspecialchars($_SERVER["PHP_SELF"], ENT_QUOTES, "utf-8");
echo '<form action="',$self,'" name="searchform" method="GET">
<input type="search" placeholder="'.$p->t('tools/suchbegriff').' ..." size="40" name="search" value="',$db->convert_html_chars($search),'" />
<img src="../../../skin/images/search.png" onclick="document.searchform.submit()" height="15px" class="suchicon"/>
</form><br>';
cis/private/tools/zeitaufzeichnung.php
+2 -1
View File
@@ -86,7 +86,8 @@ $activities_str = "'".implode("','", $activities)."'";
$gesperrt_bis = '2015-08-31';
$sperrdatum = date('c', strtotime($gesperrt_bis));
$zeitaufzeichnung_id = (isset($_GET['zeitaufzeichnung_id'])?$_GET['zeitaufzeichnung_id']:'');
// Uses urlencode to avoid XSS issues
$zeitaufzeichnung_id = urlencode(isset($_GET['zeitaufzeichnung_id'])?$_GET['zeitaufzeichnung_id']:'');
$projekt_kurzbz = (isset($_POST['projekt'])?$_POST['projekt']:'');
$oe_kurzbz_1 = (isset($_POST['oe_kurzbz_1'])?$_POST['oe_kurzbz_1']:'');
$oe_kurzbz_2 = (isset($_POST['oe_kurzbz_2'])?$_POST['oe_kurzbz_2']:'');