aboutsummaryrefslogtreecommitdiff
path: root/mod/file
diff options
context:
space:
mode:
authorCash Costello <cash.costello@gmail.com>2011-07-04 09:15:11 -0700
committerCash Costello <cash.costello@gmail.com>2011-07-04 09:15:11 -0700
commit440c94c74f929344c5b755e2607c8426d4de08b3 (patch)
treeaa042845b8e241fdba5b9bd8ebeab66631437b4a /mod/file
parentde111da23258cd2b513c8f4ab84712ee50272b23 (diff)
parent3beedd84a7dbcf7a17a75248473302320653d231 (diff)
downloadelgg-440c94c74f929344c5b755e2607c8426d4de08b3.tar.gz
elgg-440c94c74f929344c5b755e2607c8426d4de08b3.tar.bz2
Merge pull request #53 from cash/reflected_xss_fixes
Fixes #3544 Reflected xss fixes
Diffstat (limited to 'mod/file')
-rw-r--r--mod/file/pages/file/search.php20
1 files changed, 10 insertions, 10 deletions
diff --git a/mod/file/pages/file/search.php b/mod/file/pages/file/search.php
index cffe67e0c..2242d1d7e 100644
--- a/mod/file/pages/file/search.php
+++ b/mod/file/pages/file/search.php
@@ -5,7 +5,7 @@
* @package ElggFile
*/
-$page_owner_guid = get_input('page_owner', null);
+$page_owner_guid = (int)get_input('page_owner', 0);
if ($page_owner_guid) {
elgg_set_page_owner_guid($page_owner_guid);
}
@@ -15,10 +15,10 @@ group_gatekeeper();
// Get input
$md_type = 'simpletype';
-$tag = get_input('tag');
+// avoid reflected XSS attacks by only allowing alnum characters
+$file_type = preg_replace('[\W]', '', get_input('tag'));
$listtype = get_input('listtype');
-$friends = get_input('friends', false);
-
+$friends = (bool)get_input('friends', false);
// breadcrumbs
elgg_push_breadcrumb(elgg_echo('file'), "file/all");
@@ -32,8 +32,8 @@ if ($owner) {
if ($friends && $owner) {
elgg_push_breadcrumb(elgg_echo('friends'), "file/friends/$owner->username");
}
-if ($tag) {
- elgg_push_breadcrumb(elgg_echo("file:type:$tag"));
+if ($file_type) {
+ elgg_push_breadcrumb(elgg_echo("file:type:$file_type"));
} else {
elgg_push_breadcrumb(elgg_echo('all'));
}
@@ -41,10 +41,10 @@ if ($tag) {
// title
if (!$owner) {
// world files
- $title = elgg_echo('all') . ' ' . elgg_echo("file:type:$tag");
+ $title = elgg_echo('all') . ' ' . elgg_echo("file:type:$file_type");
} else {
$friend_string = $friends ? elgg_echo('file:title:friends') : '';
- $type_string = elgg_echo("file:type:$tag");
+ $type_string = elgg_echo("file:type:$file_type");
$title = elgg_echo('file:list:title', array($owner->name, $friend_string, $type_string));
}
@@ -76,9 +76,9 @@ $params = array(
'full_view' => false,
);
-if ($tag) {
+if ($file_type) {
$params['metadata_name'] = $md_type;
- $params['metadata_value'] = $tag;
+ $params['metadata_value'] = $file_type;
$content = elgg_list_entities_from_metadata($params);
} else {
$content = elgg_list_entities($params);