mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-05-04 22:58:10 +02:00
Code Issues Releases Wiki Activity

Explicitly intval the poll option id's

Browse Source 
git-svn-id: file:///svn/phpbb/branches/phpBB-2_0_0@5506 89ea8834-ac86-4346-8a33-228a782c2dd0
This commit is contained in:
Graham Eames 2006-01-28 14:56:51 +00:00
parent 27f2ed076c
commit 3c54fa68e5
2 changed files with 5 additions and 5 deletions

8
phpBB/includes/functions_post.php

@ -46,7 +46,7 @@ function prepare_message($message, $html_on, $bbcode_on, $smile_on, $bbcode_uid
if ($html_on)
{
$message = addslashes(preg_replace_callback('/<\/?(\w+)((?:\s+\w+=(?:"[^"]*"|\'[^\']*\'|`[^`]*`|[^\'"`]*?))*)\s*?\/?>/', 'clean_html', stripslashes($message)));
$message = addslashes(preg_replace_callback('/<\/?(\w+)((?:[\W]+\w+\s*=\s*(?:"[^"]*"|\'[^\']*\'|`[^`]*`|.*?))*)\s*?\/?>/', 'clean_html', stripslashes($message)));
}
else
{
@ -137,7 +137,7 @@ function prepare_post(&$mode, &$post_data, &$bbcode_on, &$html_on, &$smilies_on,
$option_text = trim($option_text);
if (!empty($option_text))
{
$temp_option_text[$option_id] = htmlspecialchars($option_text);
$temp_option_text[intval($option_id)] = htmlspecialchars($option_text);
}
}
$option_text = $temp_option_text;
@ -819,12 +819,12 @@ function clean_html($tag)
{
// Get all the elements of a tag so that they can be checked in turn
$matches = array();
preg_match_all('/\s+(\w+)=("[^"]*"|\'[^\']*\'|`[^`]*`|[^\'"`]*)/', $tag[2], $matches);
preg_match_all('/[\W]+(\w+)\s*=\s*("[^"]*"|\'[^\']*\'|`[^`]*`|[^\'"`]*)/', $tag[2], $matches);
foreach ($matches[1] as $key => $value)
{
// Remove any attributes which are not allowed
if (preg_match($disallowed_attributes, strtolower($value)) || preg_match('/(?!["\'`])[^0-9a-zA-Z\\x2D\\x2E\\x3A\\x5F]+(?!["\'`])/', $matches[2][$key]))
if (preg_match($disallowed_attributes, strtolower($value)) || (!preg_match('/([\'`"]).*\\1/', $matches[2][$key]) && preg_match('/[^0-9a-zA-Z\\x2D\\x2E\\\x3A\\x5F]+/', $matches[2][$key])))
{
continue;
}

2
phpBB/posting.php

@ -627,7 +627,7 @@ if( $refresh || isset($HTTP_POST_VARS['del_poll_option']) || $error_msg != '' )
}
else if ( !empty($option_text) )
{
$poll_options[$option_id] = htmlspecialchars(trim(stripslashes($option_text)));
$poll_options[intval($option_id)] = htmlspecialchars(trim(stripslashes($option_text)));
}
}
}