mirror of
https://github.com/phpbb/phpbb.git
synced 2025-07-08 02:43:04 +02:00
Merge remote-tracking branch 'github-security/ticket/security-164-alt' into prep-release-3.1.1
* github-security/ticket/security-164-alt: [ticket/security-164] Correctly format page_name [ticket/security-164] Sanitize all global variables in symfony_request class
This commit is contained in:
@ -87,7 +87,7 @@ class session
|
||||
$symfony_request_path = $phpbb_filesystem->clean_path($symfony_request->getPathInfo());
|
||||
if ($symfony_request_path !== '/')
|
||||
{
|
||||
$page_name .= $symfony_request_path;
|
||||
$page_name .= str_replace('%2F', '/', urlencode($symfony_request_path));
|
||||
}
|
||||
|
||||
// current directory within the phpBB root (for example: adm)
|
||||
|
@ -38,6 +38,9 @@ class symfony_request extends Request
|
||||
|
||||
array_walk_recursive($get_parameters, $sanitizer);
|
||||
array_walk_recursive($post_parameters, $sanitizer);
|
||||
array_walk_recursive($server_parameters, $sanitizer);
|
||||
array_walk_recursive($files_parameters, $sanitizer);
|
||||
array_walk_recursive($cookie_parameters, $sanitizer);
|
||||
|
||||
parent::__construct($get_parameters, $post_parameters, array(), $cookie_parameters, $files_parameters, $server_parameters);
|
||||
}
|
||||
|
Reference in New Issue
Block a user