bn8/ldapsaisie
1
0
Fork 0
mirror of https://gitlab.easter-eggs.com/ee/ldapsaisie.git synced 2024-12-18 14:33:49 +01:00
Code Issues Projects Releases Wiki Activity

Fix XSS problem using LSdebug/LSerror/LSinfos

Browse source
This commit is contained in:
Benjamin Renard 2018-06-08 17:41:28 +02:00
parent 98d8d73709
commit 06b37ea2f6
4 changed files with 11 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
public_html/includes/class/class.LSerror.php
View file

@ -132,7 +132,7 @@ class LSerror {
* @retvat string Le texte des erreurs
*/
private static function getError($error) {
return "(Code ".$error[0].") ".getFData(self :: $_errorCodes[$error[0]]['msg'],$error[1]);
return "(Code ".htmlentities($error[0]).") ".htmlentities(getFData(self :: $_errorCodes[$error[0]]['msg'],$error[1]));
}
/**

7
public_html/includes/class/class.LSsession.php
View file

@ -1424,12 +1424,7 @@ class LSsession {
// Infos
if((!empty($_SESSION['LSsession_infos']))&&(is_array($_SESSION['LSsession_infos']))) {
$txt_infos="<ul>\n";
foreach($_SESSION['LSsession_infos'] as $info) {
$txt_infos.="<li>$info</li>\n";
}
$txt_infos.="</ul>\n";
LStemplate :: assign('LSinfos',$txt_infos);
LStemplate :: assign('LSinfos',$_SESSION['LSsession_infos']);
$_SESSION['LSsession_infos']=array();
}

4
public_html/includes/functions.php
View file

@ -257,10 +257,10 @@ function LSdebug_print($return=false,$ul=true) {
if ($ul) $txt='<ul>'; else $txt="";
foreach($GLOBALS['LSdebug_fields'] as $debug) {
if (is_array($debug)||is_object($debug)) {
$txt.='<li><pre>'.print_r($debug,true).'</pre></li>';
$txt.='<li><pre>'.htmlentities(print_r($debug,true)).'</pre></li>';
}
else {
$txt.='<li><pre>'.$debug.'</pre></li>';
$txt.='<li><pre>'.htmlentities(strval($debug)).'</pre></li>';
}
}
if ($ul) $txt.='</ul>';

8
public_html/templates/default/LSdefault.tpl
View file

@ -1,6 +1,12 @@
<div id='LSjsConfig'>{$LSjsConfig}</div>
<div id='LSinfos_txt'>{$LSinfos}</div>
<div id='LSinfos_txt'>{if is_array($LSinfos) && !empty($LSinfos)}
<ul>
{foreach $LSinfos as $info}
<li>{$info|escape:"htmlall"}</li>
{/foreach}
</ul>
{/if}</div>
<div id='LSerror_txt'>{$LSerrors}</div>