Commit: 0533227a209e2cb48323585b2007f2d9ae6a6117 - xoopscubelegacy (git)

XOOPS Cube Legacy base repository

Commit MetaInfo

• Revision: 0533227a209e2cb48323585b2007f2d9ae6a6117 (tree)
• Zeit: 2009-04-02 16:00:30
• Autor: tom_g3x <tom_g3x@704c...>
• Commiter: tom_g3x

Log Message

marged XCL 2.1.16a(Security Release)

git-svn-id: https://xoopscube.svn.sourceforge.net/svnroot/xoopscube/Package_Legacy/trunk@108 704cf05f-ae62-4b0e-a484-234ee0250e75

Ändern Zusammenfassung

• modified: docs/CHANGES.txt
• modified: html/modules/legacy/actions/ImageListAction.class.php
• modified: html/modules/legacy/actions/MiscSmiliesAction.class.php
• modified: html/modules/legacy/admin/theme/admin_theme.html

Diff

--- a/docs/CHANGES.txt
+++ b/docs/CHANGES.txt
@@ -4,7 +4,6 @@ XOOPS Cube Legacy "Package_Legacy" & "XCube core" Changelog
 2009/03/?: Package Revision 2.1.7
 ----------------------------------------
 [Bug Fix - From Bug Tracker]
-- Fix Bug #2350320 - Possibility of script injection in ErrorHandler::show.
 - Fix Bug #2491813 - SmileEditAction include multi byte comment.
 - Fix Bug #2491817 - SmileEditAction cannnot delete old file.
 - Fix Bug #2591041 - Typo Legacy_PublicControllerStrategy.class.php.
@@ -49,6 +48,15 @@ XOOPS Cube Legacy "Package_Legacy" & "XCube core" Changelog
 - Tohokuaiki
 - Tom_G3X
 
+
+----------------------------------------
+2009/04/02: Package Revision 2.1.6a
+----------------------------------------
+[Bug Fix - From Bug Tracker]
+- Fix Bug IPA#74747784 / JPCERT#95042060 - XSS weakness
+- Fix Bug #2350320 - Possibility of script injection in ErrorHandler::show.
+
+
 ----------------------------------------
 2008/11/21: Package Revision 2.1.6
 ----------------------------------------

--- a/html/modules/legacy/actions/ImageListAction.class.php
+++ b/html/modules/legacy/actions/ImageListAction.class.php
@@ -92,7 +92,7 @@ class Legacy_ImageListAction extends Legacy_AbstractListAction
 		$render->setAttribute('hasUploadPerm', $hasUploadPerm);
 		$render->setAttribute("category", $this->mCategory);
 		
-		$render->setAttribute('target', xoops_getrequest('target'));
+        $render->setAttribute('target', htmlspecialchars(xoops_getrequest('target'), ENT_QUOTES));
 	}
 
 	function executeViewError(&$controller, &$xoopsUser, &$render)

--- a/html/modules/legacy/actions/MiscSmiliesAction.class.php
+++ b/html/modules/legacy/actions/MiscSmiliesAction.class.php
@@ -39,7 +39,10 @@ class Legacy_MiscSmiliesAction extends Legacy_AbstractListAction
 
 	function getDefaultView(&$controller, &$xoopsUser)
 	{
-		$this->mTargetName = xoops_getrequest('target');
+        $this->mTargetName = trim(xoops_getrequest('target'));
+        if ($this->mTargetName == '' || !preg_match('/^[a-zA-Z]\w*$/', $this->mTargetName)) {
+            return LEGACY_FRAME_VIEW_ERROR;
+        }
 		return parent::getDefaultView($controller, $xoopsUser);
 	}
 	
@@ -56,6 +59,11 @@ class Legacy_MiscSmiliesAction extends Legacy_AbstractListAction
 		$render->setAttribute("pageNavi", $this->mFilter->mNavi);
 		$render->setAttribute("targetName", $this->mTargetName);
 	}
+
+	function executeViewError(&$controller, &$xoopsUser, &$render)
+    {
+        $render->setTemplateName("legacy_dummy.html");
+    }
 }
 
 ?>

--- a/html/modules/legacy/admin/theme/admin_theme.html
+++ b/html/modules/legacy/admin/theme/admin_theme.html
@@ -12,7 +12,7 @@
 
 <script type="text/javascript">
 <!-- <![CDATA[
-var cid = <{if $smarty.get.fct == "preferences" && $smarty.get.mod > 0}><{$smarty.get.mod}><{else}><{$currentModule->mXoopsModule->get('mid')}><{/if}>;
+var cid = <{if $smarty.get.fct == "preferences" && $smarty.get.mod > 0}><{$smarty.get.mod|intval}><{else}><{$currentModule->mXoopsModule->get('mid')}><{/if}>;
 function ccToggle(id)
 {
 	if (!xoopsGetElementById('c' + id)) return;