diff options
| author | plegall <plg@piwigo.org> | 2010-04-29 10:44:30 +0000 |
|---|---|---|
| committer | plegall <plg@piwigo.org> | 2010-04-29 10:44:30 +0000 |
| commit | e7487082c32de87efd756bf05ae8539d38cda373 (patch) | |
| tree | 1f3c53b9fbb15fc576755f9af428b3a33178cf76 | |
| parent | ba70c8f5cbd1f22c912a9b44363c246b6eb84dd7 (diff) | |
bug 1484: prevent XSS vulnerability, encode url.
improvement: no need to transmit the REQUEST_URI from PHP, Smarty already
knows it.
git-svn-id: http://piwigo.org/svn/trunk@5990 68402e56-0260-453c-a942-63ccdbb3a9ee
| -rw-r--r-- | identification.php | 2 | ||||
| -rw-r--r-- | include/block.class.php | 1 | ||||
| -rw-r--r-- | themes/default/template/identification.tpl | 2 | ||||
| -rw-r--r-- | themes/default/template/menubar_identification.tpl | 2 |
4 files changed, 3 insertions, 4 deletions
diff --git a/identification.php b/identification.php index cbfd40947..89bc9fe85 100644 --- a/identification.php +++ b/identification.php @@ -54,7 +54,7 @@ if (isset($_POST['login'])) } else { - $redirect_to = isset($_POST['redirect']) ? $_POST['redirect'] : ''; + $redirect_to = isset($_POST['redirect']) ? urldecode($_POST['redirect']) : ''; $remember_me = isset($_POST['remember_me']) and $_POST['remember_me']==1; if ( try_log_user($_POST['username'], $_POST['password'], $remember_me) ) { diff --git a/include/block.class.php b/include/block.class.php index af84330bd..e8f091741 100644 --- a/include/block.class.php +++ b/include/block.class.php @@ -134,7 +134,6 @@ class BlockManager global $template; $template->set_filename('menubar', $file); - $template->assign(array('U_REDIRECT' => $_SERVER['REQUEST_URI'])); trigger_action('blockmanager_apply', array(&$this) ); foreach( $this->display_blocks as $id=>$block) diff --git a/themes/default/template/identification.tpl b/themes/default/template/identification.tpl index 1541fd471..1a34744ac 100644 --- a/themes/default/template/identification.tpl +++ b/themes/default/template/identification.tpl @@ -21,7 +21,7 @@ <fieldset> <legend>{'Connection settings'|@translate}</legend> - <input type="hidden" name="redirect" value="{$U_REDIRECT}"> + <input type="hidden" name="redirect" value="{$U_REDIRECT|urlencode}"> <ul> <li> diff --git a/themes/default/template/menubar_identification.tpl b/themes/default/template/menubar_identification.tpl index c0af6047d..b686b9601 100644 --- a/themes/default/template/menubar_identification.tpl +++ b/themes/default/template/menubar_identification.tpl @@ -28,7 +28,7 @@ {if isset($U_LOGIN)} <form method="post" action="{$U_LOGIN}" id="quickconnect"> - <input type="hidden" name="redirect" value="{$U_REDIRECT}"> + <input type="hidden" name="redirect" value="{$smarty.server.REQUEST_URI|urlencode}"> <fieldset> <legend>{'Quick connect'|@translate}</legend> <div> |