[jan] SECURITY: Fix XSS vulnerability with pathinfo component in toSt…

…ring().
horde · Jul 4, 2017 · ac55a61 · ac55a61
1 parent cc61cbd
commit ac55a61
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/framework/Url/lib/Horde/Url.php b/framework/Url/lib/Horde/Url.php
@@ -267,8 +267,12 @@ public function toString($raw = false, $full = true)
             : parse_url($this->url, PHP_URL_PATH);
 
         if (strlen($this->pathInfo)) {
-            $url = rtrim($url, '/');
-            $url .= '/' . $this->pathInfo;
+            $url = rtrim($url, '/') . '/';
+            if ($raw) {
+                $url .= $this->pathInfo;
+            } else {
+                $url .= implode('/', array_map('rawurlencode', explode('/', $this->pathInfo)));
+            }
         }
 
         if ($params = $this->_getParameters()) {

diff --git a/framework/Url/package.xml b/framework/Url/package.xml
@@ -27,7 +27,7 @@
  </stability>
  <license uri="http://www.horde.org/licenses/lgpl21">LGPL-2.1</license>
  <notes>
-* 
+* [jan] SECURITY: Fix XSS vulnerability with pathinfo component in toString().
  </notes>
  <contents>
   <dir baseinstalldir="/" name="/">
@@ -417,7 +417,7 @@
    <date>2016-02-02</date>
    <license uri="http://www.horde.org/licenses/lgpl21">LGPL-2.1</license>
    <notes>
-* 
+* [jan] SECURITY: Fix XSS vulnerability with pathinfo component in toString().
    </notes>
   </release>
  </changelog>