aboutsummaryrefslogtreecommitdiff
path: root/engine
diff options
context:
space:
mode:
Diffstat (limited to 'engine')
-rw-r--r--engine/lib/elgglib.php11
1 files changed, 10 insertions, 1 deletions
diff --git a/engine/lib/elgglib.php b/engine/lib/elgglib.php
index 77cc0d3a1..8bb7ff39e 100644
--- a/engine/lib/elgglib.php
+++ b/engine/lib/elgglib.php
@@ -249,6 +249,11 @@ function elgg_view($view, $vars = array(), $bypass = false, $debug = false, $vie
$viewtype = elgg_get_viewtype();
}
+ // Viewtypes can only be alphanumeric
+ if (preg_match('[\W]', $viewtype)) {
+ return '';
+ }
+
// Set up any extensions to the requested view
if (isset($CONFIG->views->extensions[$view])) {
$viewlist = $CONFIG->views->extensions[$view];
@@ -2396,7 +2401,11 @@ function full_url() {
$s = empty($_SERVER["HTTPS"]) ? '' : ($_SERVER["HTTPS"] == "on") ? "s" : "";
$protocol = substr(strtolower($_SERVER["SERVER_PROTOCOL"]), 0, strpos(strtolower($_SERVER["SERVER_PROTOCOL"]), "/")) . $s;
$port = ($_SERVER["SERVER_PORT"] == "80" || $_SERVER["SERVER_PORT"] == "443") ? "" : (":".$_SERVER["SERVER_PORT"]);
- return $protocol . "://" . $_SERVER['SERVER_NAME'] . $port . $_SERVER['REQUEST_URI'];
+
+ $quotes = array('\'', '"');
+ $encoded = array('%27', '%22');
+
+ return $protocol . "://" . $_SERVER['SERVER_NAME'] . $port . str_replace($quotes, $encoded, $_SERVER['REQUEST_URI']);
}
/**