claunia/qemudb
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

When filtering copy Xinha variables verbatim instead of stripping out html tags

Browse Source
This commit is contained in:
Chris Morgan
2007-01-05 04:59:04 +00:00
committed by WineHQ
parent 44ef334d79
commit 9f88239d1f
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
include/filter.php
View File

@@ -14,10 +14,19 @@ function filter_gpc()
// Special cases for variables that don't fit our filtering scheme // Special cases for variables that don't fit our filtering scheme
// don't filter the AppDB session cookie and MAX_FILE_SIZE // don't filter the AppDB session cookie and MAX_FILE_SIZE
// and the DialogX values that xinha uses // and the DialogX values that xinha uses
if($aKeys[$i] == "whq_appdb" || ($aKeys[$i] == "MAX_FILE_SIZE") || ($aKeys[$i] == "PHPSESSID") if(strpos($aKeys[$i], "Dialog") == 0) // Xinha variables
|| (strpos($aKeys[$i], "Dialog") == 0) || (strpos($aKeys[$i], "pref_") == 0))
{ {
// copy the key over to the clean array // copy the key over to the clean array
// NOTE: we do not strip html tags or trim any Xinha variables
// because Xinha is a html editor and removing html tags
// would break the ability to use Xinha to create or edit html
$aClean[$aKeys[$i]] = $_REQUEST[$aKeys[$i]];
continue; // go to the next entry
} else if($aKeys[$i] == "whq_appdb" || ($aKeys[$i] == "MAX_FILE_SIZE")
|| ($aKeys[$i] == "PHPSESSID")
|| (strpos($aKeys[$i], "pref_") == 0)) // other variables
{
// copy the key over to the clean array after stripping tags and trimming
$aClean[$aKeys[$i]] = trim(strip_tags($_REQUEST[$aKeys[$i]])); $aClean[$aKeys[$i]] = trim(strip_tags($_REQUEST[$aKeys[$i]]));
continue; // go to the next entry continue; // go to the next entry
} }