Minahito
minah****@users*****
2005年 8月 25日 (木) 12:16:50 JST
Index: xoops2jp/html/include/common.php
diff -u xoops2jp/html/include/common.php:1.6 xoops2jp/html/include/common.php:1.6.2.1
--- xoops2jp/html/include/common.php:1.6 Wed Aug 3 21:39:11 2005
+++ xoops2jp/html/include/common.php Thu Aug 25 12:16:50 2005
@@ -1,5 +1,5 @@
<?php
-// $Id: common.php,v 1.6 2005/08/03 12:39:11 onokazu Exp $
+// $Id: common.php,v 1.6.2.1 2005/08/25 03:16:50 minahito Exp $
// ------------------------------------------------------------------------ //
// XOOPS - PHP Content Management System //
// Copyright (c) 2000 XOOPS.org //
@@ -163,6 +163,10 @@
if ( isset( $_SERVER[ 'QUERY_STRING' ] ) ) {
$_SERVER[ 'REQUEST_URI' ] .= '?' . $_SERVER[ 'QUERY_STRING' ];
}
+
+ // Guard for XSS string of PHP_SELF
+ if(preg_match("/[\<\>\"\'\(\)]/",$_SERVER['REQUEST_URI']))
+ die();
}
$xoopsRequestUri = $_SERVER[ 'REQUEST_URI' ]; // Deprecated (use the corrected $_SERVER variable now)
/**#@-*/