mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-10 18:54:08 +02:00
Code Issues Releases Wiki Activity

Merge branch 'develop-ascraeus' into develop

Browse Source 
* develop-ascraeus:
  [ticket/13280] Remove unneeded str_replace in build_url()
  [ticket/13280] Only run sanitizer for server superglobal and modify tests
  [ticket/13280] Seperate server sanitizer call and add comment
  [ticket/13280] Add additional sanitizer for ampersands in server superglobal
  [ticket/13280] Correctly format user page for build_url()
  [ticket/13280] Properly format the current page and add sanitizer to tests
This commit is contained in:
Tristan Darricau
2014-11-07 11:10:26 +01:00
parent 29d2a7bc9f a1b58d05d1
commit 122c1c6e05
4 changed files with 38 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
phpBB/phpbb/session.php
View File

@@ -43,7 +43,7 @@ class session
// First of all, get the request uri...
$script_name = $symfony_request->getScriptName();
$args = explode('&', $symfony_request->getQueryString());
$args = explode('&', $symfony_request->getQueryString());
// If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...
if (!$script_name)
@@ -61,8 +61,8 @@ class session
// Since some browser do not encode correctly we need to do this with some "special" characters...
// " -> %22, ' => %27, < -> %3C, > -> %3E
$find = array('"', "'", '<', '>');
$replace = array('%22', '%27', '%3C', '%3E');
$find = array('"', "'", '<', '>', '&quot;', '&lt;', '&gt;');
$replace = array('%22', '%27', '%3C', '%3E', '%22', '%3C', '%3E');
foreach ($args as $key => $argument)
{

10
phpBB/phpbb/symfony_request.php
View File

@@ -30,6 +30,12 @@ class symfony_request extends Request
$type_cast_helper->set_var($value, $value, gettype($value), true);
};
// This function is meant for additional handling of server variables
$server_sanitizer = function(&$value, $key) use ($sanitizer) {
$sanitizer($value, $key);
$value = str_replace('&amp;', '&', $value);
};
$get_parameters = $phpbb_request->get_super_global(\phpbb\request\request_interface::GET);
$post_parameters = $phpbb_request->get_super_global(\phpbb\request\request_interface::POST);
$server_parameters = $phpbb_request->get_super_global(\phpbb\request\request_interface::SERVER);
@@ -38,10 +44,12 @@ class symfony_request extends Request
array_walk_recursive($get_parameters, $sanitizer);
array_walk_recursive($post_parameters, $sanitizer);
array_walk_recursive($server_parameters, $sanitizer);
array_walk_recursive($files_parameters, $sanitizer);
array_walk_recursive($cookie_parameters, $sanitizer);
// Run special sanitizer for server superglobal
array_walk_recursive($server_parameters, $server_sanitizer);
parent::__construct($get_parameters, $post_parameters, array(), $cookie_parameters, $files_parameters, $server_parameters);
}
}