Skip to content
This repository has been archived by the owner on Mar 30, 2021. It is now read-only.

Prevent XSS #35

Merged
merged 3 commits into from Apr 20, 2012
Merged

Prevent XSS #35

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0031970
Prevent XSS
tijsverkoyen Mar 12, 2012
e6b1ea2
Multicheckboxes and radiobuttons could have ids with spaces in them.
tijsverkoyen Mar 30, 2012
72f852a
Synced from Fork
tijsverkoyen Apr 20, 2012
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion spoon/form/multi_checkbox.php
View file
Open in desktop
Expand Up @@ -385,7 +385,7 @@ public function setValues(array $values, $defaultClass = 'inputCheckbox')
if(!isset($this->variables[$value['value']]['id']))
{
if(isset($this->attributes[$value['value']]['id'])) $this->variables[$value['value']]['id'] = $this->attributes[$value['value']]['id'];
else $this->variables[$value['value']]['id'] = SpoonFilter::toCamelCase($this->name . '_' . $value['value'], '_', true);
else $this->variables[$value['value']]['id'] = SpoonFilter::toCamelCase($this->name . '_' . str_replace(' ', '_', $value['value']), '_', true);
}

// add some custom vars
Expand Down
2 changes: 1 addition & 1 deletion spoon/form/radiobutton.php
View file
Open in desktop
Expand Up @@ -373,7 +373,7 @@ public function setValues(array $values, $defaultClass = 'inputRadio')
if(!isset($this->variables[$value['value']]['id']))
{
if(isset($this->attributes[$value['value']]['id'])) $this->variables[$value['value']]['id'] = $this->attributes[$value['value']]['id'];
else $this->variables[$value['value']]['id'] = SpoonFilter::toCamelCase($this->name . '_' . $value['value'], '_', true);
else $this->variables[$value['value']]['id'] = SpoonFilter::toCamelCase($this->name . '_' . str_replace(' ', '_', $value['value']), '_', true);
}

// add some custom vars
Expand Down
2 changes: 1 addition & 1 deletion spoon/rest/client.php
View file
Open in desktop
Expand Up @@ -124,7 +124,7 @@ public function execute($url, array $parameters = null, $method = 'GET', array $
}

// specific when using POST
if($method == 'POST')
if($method == 'POST' || $method == 'DELETE')
{
$options[CURLOPT_POST] = true;
$options[CURLOPT_POSTFIELDS] = $parameters;
Expand Down
3 changes: 3 additions & 0 deletions spoon/session/session.php
View file
Open in desktop
Expand Up @@ -34,6 +34,9 @@ class SpoonSession
*/
public static function delete()
{
// start session if needed
if(!session_id()) self::start();

// loop all arguments
foreach(func_get_args() as $argument)
{
Expand Down
4 changes: 2 additions & 2 deletions spoon/template/compiler.php
View file
Open in desktop
Expand Up @@ -365,7 +365,7 @@ protected function parseForms($content)
<?php echo $this->forms[\'' . $name . '\']->getField(\'form\')->parse();
if($this->forms[\'' . $name . '\']->getUseToken())
{
?><input type="hidden" name="form_token" id="<?php echo $this->forms[\'' . $name . '\']->getField(\'form_token\')->getAttribute(\'id\'); ?>" value="<?php echo $this->forms[\'' . $name . '\']->getField(\'form_token\')->getValue(); ?>" />
?><input type="hidden" name="form_token" id="<?php echo $this->forms[\'' . $name . '\']->getField(\'form_token\')->getAttribute(\'id\'); ?>" value="<?php echo htmlspecialchars($this->forms[\'' . $name . '\']->getField(\'form_token\')->getValue()); ?>" />
<?php } ?>';
}

Expand All @@ -379,7 +379,7 @@ protected function parseForms($content)
<?php echo $this->forms[\'' . $name . '\']->getField(\'form\')->parse();
if($this->forms[\'' . $name . '\']->getUseToken())
{
?><input type="hidden" name="form_token" id="<?php echo $this->forms[\'' . $name . '\']->getField(\'form_token\')->getAttribute(\'id\'); ?>" value="<?php echo $this->forms[\'' . $name . '\']->getField(\'form_token\')->getValue(); ?>" />
?><input type="hidden" name="form_token" id="<?php echo $this->forms[\'' . $name . '\']->getField(\'form_token\')->getAttribute(\'id\'); ?>" value="<?php echo htmlentities($this->forms[\'' . $name . '\']->getField(\'form_token\')->getValue()); ?>" />
<?php } ?>';
}

Expand Down