Fixed possible XSS vulnerabilities reported by Omar Kurt

Geeklog-Core · Feb 13, 2019 · 0af852c · 0af852c
1 parent 550975f
commit 0af852c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/public_html/profiles.php b/public_html/profiles.php
@@ -2,7 +2,7 @@
 
 /* Reminder: always indent with 4 spaces (no tabs). */
 // +---------------------------------------------------------------------------+
-// | Geeklog 2.1                                                               |
+// | Geeklog 2.2                                                               |
 // +---------------------------------------------------------------------------+
 // | profiles.php                                                              |
 // |                                                                           |
@@ -542,7 +542,7 @@ function mailstoryform($sid, $cc = false, $to = '', $toemail = '', $from = '',
         break;
 
     case 'emailstory':
-        $sid = Geeklog\Input::get('sid');
+        $sid = Geeklog\Input::fGet('sid');
 
         if (empty($sid)) {
             COM_redirect($_CONF['site_url'] . '/index.php');

diff --git a/system/classes/language.class.php b/system/classes/language.class.php
@@ -8,7 +8,7 @@
 // |                                                                           |
 // | Geeklog language administration page.                                     |
 // +---------------------------------------------------------------------------+
-// | Copyright (C) 2016      by the following authors:                         |
+// | Copyright (C) 2019      by the following authors:                         |
 // |                                                                           |
 // | Authors: Kenji ITO         - mystralkk AT gmail DOT come                  |
 // +---------------------------------------------------------------------------+
@@ -338,7 +338,7 @@ public static function adminSave()
         $varName = \Geeklog\Input::fPost('var_name', '');
         $language = \Geeklog\Input::fPost('language', '');
         $name = \Geeklog\Input::fPost('name', '');
-        $value = \Geeklog\Input::post('value', '');
+        $value = \Geeklog\Input::fPost('value', '');
 
         if (($id >= 0) && !empty($varName) && !empty($language) && !empty($name)) {
             $varName = DB_escapeString($varName);