Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

xss: XSS To LFI Vulnerability #4869

Merged
merged 1 commit into from Apr 24, 2019
Merged

xss: XSS To LFI Vulnerability #4869

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
8 changes: 4 additions & 4 deletions include/class.import.php
View file
Open in desktop
Expand Up @@ -39,7 +39,7 @@ function __construct($stream) {
rewind($this->stream);
}
else {
throw new ImportError(__('Unable to parse submitted csv: ').print_r($stream, true));
throw new ImportError(__('Unable to parse submitted csv: ').print_r(Format::htmlchars($stream), true));
}
}

Expand All @@ -59,7 +59,7 @@ function importCsv($all_fields=array(), $defaults=array()) {
throw new ImportError(__('Whoops. Perhaps you meant to send some CSV records'));

$headers = array();
foreach ($data as $h) {
foreach (Format::htmlchars($data) as $h) {
$h = trim($h);
$found = false;
foreach ($all_fields as $f) {
Expand All @@ -68,7 +68,7 @@ function importCsv($all_fields=array(), $defaults=array()) {
$found = true;
if (!$f->get('name'))
throw new ImportError(sprintf(__(
'%s: Field must have `variable` set to be imported'), $h));
'%s: Field must have `variable` set to be imported'), Format::htmlchars($h)));
$headers[$f->get('name')] = $f->get('label');
break;
}
Expand All @@ -85,7 +85,7 @@ function importCsv($all_fields=array(), $defaults=array()) {
}
else {
throw new ImportError(sprintf(
__('%s: Unable to map header to the object field'), $h));
__('%s: Unable to map header to the object field'), Format::htmlchars($h)));
}
}
}
Expand Down
4 changes: 2 additions & 2 deletions include/class.staff.php
View file
Open in desktop
Expand Up @@ -946,8 +946,8 @@ static function importCsv($stream, $defaults=array(), $callback=false) {
}
else {
throw new ImportError(sprintf(__('Unable to import (%s): %s'),
$data['username'],
print_r($errors, true)
Format::htmlchars($data['username']),
print_r(Format::htmlchars($errors), true)
));
}
$imported++;
Expand Down
2 changes: 1 addition & 1 deletion include/class.user.php
View file
Open in desktop
Expand Up @@ -456,7 +456,7 @@ static function importCsv($stream, $defaults=array()) {
throw new ImportError('Both `name` and `email` fields are required');
if (!($user = static::fromVars($data, true, true)))
throw new ImportError(sprintf(__('Unable to import user: %s'),
print_r($data, true)));
print_r(Format::htmlchars($data), true)));
$imported++;
}
db_autocommit(true);
Expand Down