Changeset 1933

Timestamp:

01/13/10 16:48:44 (14 years ago)

Author:

rafaelraymundo

Message:

Ticket #000 - Corrigido erro de vulnerabilidade encontrado na aplicacao...

Location:

trunk

Files:

• phpgwapi/templates/classic/login_classic.php (modified) (1 diff)
• phpgwapi/templates/default/login_default.php (modified) (1 diff)
• preferences/preferences.php (modified) (1 diff)

trunk/phpgwapi/templates/classic/login_classic.php

@@ -195 +195 @@
                         }
                 }
+                
+                $_GET['lang'] = addslashes($_GET['lang']);
                 if ($_GET['lang'])
                 {

trunk/phpgwapi/templates/default/login_default.php

@@ -210 +210 @@
                         }
                 }
+                
+                $_GET['lang'] = addslashes($_GET['lang']);
                 if ($_GET['lang'])
                 {

trunk/preferences/preferences.php

@@ -15 +15 @@
                 'noappheader'             => True,
                 'nonavbar'                => True,
-                'currentapp'              => @$_GET['appname'] ? $_GET['appname'] : 'preferences',
+                'currentapp'              => @addslashes($_GET['appname']) ? addslashes($_GET['appname']) : 'preferences',
                 'enable_nextmatchs_class' => True
         );