Changeset 2548

Show
Ignore:
Timestamp:
04/21/08 13:47:53 (5 months ago)
Author:
Geert
Message:

Security update to prevent XSS.
See: http://forum.kohanaphp.com/comments.php?DiscussionID=352

Location:
trunk/system
Files:
3 modified

Legend:

Unmodified
Added
Removed

  • trunk/system/helpers/form.php

    r2518 r2548  
    3434                { 
    3535                        // Use the current URL as the default action 
    36                         $action = url::site(Router::$current_uri); 
     36                        // Apply htmlspecialchars to current URI to prevent XSS 
     37                        $action = url::site(html::specialchars(Router::$current_uri)); 
    3738                } 
    3839                elseif (strpos($action, '://') === FALSE) 

  • trunk/system/views/kohana_error_disabled.php

    r2287 r2548  
    1010</style> 
    1111<div id="framework_error" style="width:24em;margin:50px auto;"> 
    12 <h3><?php echo $error ?></h3> 
    13 <p style="text-align:center"><?php echo $message ?></p> 
     12<h3><?php echo html::specialchars($error) ?></h3> 
     13<p style="text-align:center"><?php echo html::specialchars($message) ?></p> 
    1414</div> 
    1515</body> 

  • trunk/system/views/kohana_error_page.php

    r2251 r2548  
    1111</style> 
    1212<div id="framework_error" style="width:42em;margin:20px auto;"> 
    13 <h3><?php echo $error ?></h3> 
    14 <p><?php echo $description ?></p> 
     13<h3><?php echo html::specialchars($error) ?></h3> 
     14<p><?php echo html::specialchars($description) ?></p> 
    1515<?php if ( ! empty($line) AND ! empty($file)): ?> 
    1616<p><?php echo Kohana::lang('core.error_file_line', $file, $line) ?></p> 
    1717<?php endif ?> 
    18 <p><code class="block"><?php echo $message ?></code></p> 
     18<p><code class="block"><?php echo html::specialchars($message) ?></code></p> 
    1919<?php if ( ! empty($trace)): ?> 
    2020<h3><?php echo Kohana::lang('core.stack_trace') ?></h3>