fix CVE-2015-7348

zTree · Nov 26, 2015 · b8fb655 · b8fb655
1 parent 74045a8
commit b8fb655
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 14 deletions.
diff --git a/demo/cn/asyncData/getNodes.php b/demo/cn/asyncData/getNodes.php
@@ -21,11 +21,9 @@
 if ($pName==null) $pName = "";
 else $pName = $pName.".";
 
-$pId = str_replace("%<%", "&lt;", $pId);
-$pId = str_replace("%>%", "&gt;", $pId);
+$pId = htmlspecialchars($pId);
 
-$pName = str_replace("%<%", "&lt;", $pName);
-$pName = str_replace("%>%", "&gt;", $pName);
+$pName = htmlspecialchars($pName);
 
 //for ($i=1; $i<9999; $i++) {
 //	for ($j=1; $j<999; $j++) {

diff --git a/demo/cn/asyncData/getNodesForBigData.php b/demo/cn/asyncData/getNodesForBigData.php
@@ -11,8 +11,7 @@
 if ($pId==null || $pId=="") $pId = "0";
 if ($pCount==null || $pCount=="") $pCount = "10";
 
-$pId = str_replace("%<%", "&lt;", $pId);
-$pId = str_replace("%>%", "&gt;", $pId);
+$pId = htmlspecialchars($pId);
 
 $max = (int)$pCount;
 for ($i=1; $i<=$max; $i++) {
@@ -24,4 +23,4 @@
 	}
 
 }
-?>]
+?>]
diff --git a/demo/en/asyncData/getNodes.php b/demo/en/asyncData/getNodes.php
@@ -21,11 +21,9 @@
 if ($pName==null) $pName = "";
 else $pName = $pName.".";
 
-$pId = str_replace("%<%", "&lt;", $pId);
-$pId = str_replace("%>%", "&gt;", $pId);
+$pId = htmlspecialchars($pId);
 
-$pName = str_replace("%<%", "&lt;", $pName);
-$pName = str_replace("%>%", "&gt;", $pName);
+$pName = htmlspecialchars($pName);
 
 //for ($i=1; $i<9999; $i++) {
 //	for ($j=1; $j<999; $j++) {

diff --git a/demo/en/asyncData/getNodesForBigData.php b/demo/en/asyncData/getNodesForBigData.php
@@ -11,8 +11,7 @@
 if ($pId==null || $pId=="") $pId = "0";
 if ($pCount==null || $pCount=="") $pCount = "10";
 
-$pId = str_replace("%<%", "&lt;", $pId);
-$pId = str_replace("%>%", "&gt;", $pId);
+$pId = htmlspecialchars($pId);
 
 $max = (int)$pCount;
 for ($i=1; $i<=$max; $i++) {
@@ -24,4 +23,4 @@
 	}
 
 }
-?>]
+?>]