From fcb3c824a0ee2c750453de1ccc12dd4a9af8f0b0 Mon Sep 17 00:00:00 2001
From: rub <rub@piwigo.org>
Date: Thu, 7 Jun 2007 18:52:40 +0000
Subject: Resolved issue 0000702: Code Injection with picture comment

Merge BSF 2029:2030 into branch-1_7

git-svn-id: http://piwigo.org/svn/branches/branch-1_7@2031 68402e56-0260-453c-a942-63ccdbb3a9ee
---
 admin/comments.php              | 2 +-
 comments.php                    | 2 +-
 include/common.inc.php          | 1 +
 include/picture_comment.inc.php | 5 +++--
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/admin/comments.php b/admin/comments.php
index 6bba32a96..bae32dcb3 100644
--- a/admin/comments.php
+++ b/admin/comments.php
@@ -162,7 +162,7 @@ while ($row = mysql_fetch_assoc($result))
           '&amp;image_id='.$row['image_id'],
       'ID' => $row['id'],
       'TN_SRC' => $thumb,
-      'AUTHOR' => $row['author'],
+      'AUTHOR' => trigger_event('render_comment_author', $row['author']),
       'DATE' => format_date($row['date'],'mysql_datetime',true),
       'CONTENT' => trigger_event('render_comment_content',$row['content'])
       )
diff --git a/comments.php b/comments.php
index de328152f..efcd7dfb5 100644
--- a/comments.php
+++ b/comments.php
@@ -411,7 +411,7 @@ SELECT id, name, permalink, uppercats
         'U_PICTURE' => $url,
         'TN_SRC' => $thumbnail_src,
         'ALT' => $name,
-        'AUTHOR' => $author,
+        'AUTHOR' => trigger_event('render_comment_author', $author),
         'DATE'=>format_date($comment['date'],'mysql_datetime',true),
         'CONTENT'=>trigger_event('render_comment_content',$comment['content']),
         ));
diff --git a/include/common.inc.php b/include/common.inc.php
index 8c7c9d85d..1ab44143f 100644
--- a/include/common.inc.php
+++ b/include/common.inc.php
@@ -243,5 +243,6 @@ if (isset($conf['header_notes']))
 // default event handlers
 add_event_handler('render_comment_content', 'htmlspecialchars');
 add_event_handler('render_comment_content', 'parse_comment_content');
+add_event_handler('render_comment_author', 'strip_tags');
 trigger_action('init');
 ?>
diff --git a/include/picture_comment.inc.php b/include/picture_comment.inc.php
index c84f2a629..7ae87d78a 100644
--- a/include/picture_comment.inc.php
+++ b/include/picture_comment.inc.php
@@ -136,9 +136,10 @@ SELECT id,author,date,image_id,content
       $template->assign_block_vars(
         'comments.comment',
         array(
-          'COMMENT_AUTHOR' => empty($row['author'])
+          'COMMENT_AUTHOR' => trigger_event('render_comment_author', 
+            empty($row['author'])
             ? $lang['guest']
-            : $row['author'],
+            : $row['author']),
 
           'COMMENT_DATE' => format_date(
             $row['date'],
-- 
cgit v1.2.3