Fixed XSS

REQUEST_URI is not parsed by PHP - only by new browsers. Can be used for XSS with curl or for example file get contents. [url]?x="><h1>Hi</h1>
aerouk · Mar 1, 2017 · 2ac3cd4 · 2ac3cd4
1 parent b2071a9
commit 2ac3cd4
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/public/protected/templates/viewer.phtml b/public/protected/templates/viewer.phtml
@@ -13,7 +13,7 @@
         <meta name="twitter:site" content="<?php echo TWITTER_HANDLE; ?>" />
         <meta name="twitter:title" content="<?php echo $file . '.' . $type; ?>" />
         <meta name="twitter:image" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . $imgurl; ?>" />
-        <meta name="twitter:url" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']; ?>" />
+        <meta name="twitter:url" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . htmlspecialchars($_SERVER['REQUEST_URI']); ?>" />
 <?php } ?>
     </head>