Fixed issue #07087: XSS security in statistics for admin

Dev: review #07085 : using included sanitize_helper function. Dev: maybe move sanitize_helper to Yii CFormatter http://www.yiiframework.com/doc/api/1.1/CFormatter
LimeSurvey · Dec 15, 2012 · 1b59e26 · 1b59e26 · Shnoulle · Dec 20, 2012
1 parent 15a59b1
commit 1b59e26
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/application/controllers/PrintanswersController.php b/application/controllers/PrintanswersController.php
@@ -199,7 +199,7 @@ function actionView($surveyid,$printableexport=FALSE)
                 }
                 else
                 {
-                    $printoutput .= "\t<tr class='printanswersquestion'><td>{$fname[0]} {$fname[1]}</td><td class='printanswersanswertext'>".htmlspecialchars($fname[2])."</td></tr>";
+                    $printoutput .= "\t<tr class='printanswersquestion'><td>{$fname[0]} {$fname[1]}</td><td class='printanswersanswertext'>".sanitize_html_string($fname[2])."</td></tr>";
                 }
             }
         }

diff --git a/application/views/admin/export/statistics_browse_view.php b/application/views/admin/export/statistics_browse_view.php
@@ -44,9 +44,9 @@
     </a>
 </div>
 <div class='statisticscolumndata'>
-    <?php echo stripslashes($row['value']) ?>
+    <?php echo sanitize_html_string($row['value']) ?>
 </div>
 <div style='clear: both'></div>
 <?php
 }
-?>
+?>