Changeset 1274

Show
Ignore:
Timestamp:
02/13/06 23:12:17 (3 years ago)
Author:
mbonetti
Message:

fix for two possible security holes

Location:
trunk/rss
Files:
2 modified

Legend:

Unmodified
Added
Removed

  • trunk/rss/feed.php

    r1242 r1274  
    169169} 
    170170elseif (array_key_exists('channel',$_REQUEST) || array_key_exists('folder',$_REQUEST) || array_key_exists('vfolder',$_REQUEST)) { 
    171     $cid= (array_key_exists('channel',$_REQUEST))?$_REQUEST['channel']:""; 
    172     $iid= (array_key_exists('iid',$_REQUEST))?$_REQUEST['iid']:""; 
    173     $fid= (array_key_exists('folder',$_REQUEST))?$_REQUEST['folder']:""; 
    174     $vfid= (array_key_exists('vfolder',$_REQUEST))?$_REQUEST['vfolder']:""; 
    175  
    176     $y= (array_key_exists('y',$_REQUEST))?$_REQUEST['y']:"0"; 
    177     $m= (array_key_exists('m',$_REQUEST))?$_REQUEST['m']:"0"; 
    178     $d= (array_key_exists('d',$_REQUEST))?$_REQUEST['d']:"0"; 
     171    $cid= (array_key_exists('channel',$_REQUEST))?preg_replace('#\s#','',$_REQUEST['channel']):""; 
     172    $iid= (array_key_exists('iid',$_REQUEST))?preg_replace('#\s#','',$_REQUEST['iid']):""; 
     173    $fid= (array_key_exists('folder',$_REQUEST))?preg_replace('#\s#','',$_REQUEST['folder']):""; 
     174    $vfid= (array_key_exists('vfolder',$_REQUEST))?preg_replace('#\s#','',$_REQUEST['vfolder']):""; 
     175     
     176    $y= (array_key_exists('y',$_REQUEST))?preg_replace('#\s#','',$_REQUEST['y']):"0"; 
     177    $m= (array_key_exists('m',$_REQUEST))?preg_replace('#\s#','',$_REQUEST['m']):"0"; 
     178    $d= (array_key_exists('d',$_REQUEST))?preg_replace('#\s#','',$_REQUEST['d']):"0"; 
    179179 
    180180    if ($fid) { 

  • trunk/rss/init.php

    r1206 r1274  
    111111// 
    112112$lang = getConfig('rss.output.lang'); 
    113  
     113if (!preg_match('#^[a-zA-Z]+$#', $lang)) { 
     114    die('woopsie, bad lang: ' .$lang); 
     115} 
    114116if ($lang && file_exists(dirname(__FILE__) . "/" . "intl/$lang.php")) { 
    115117    rss_require("intl/$lang.php");