mbirth/LuckyCoinkydink
1
0
Fork 0
Code Issues Pull Requests Activity

[TASK] Prevents PHP warnings with type differences on $_REQUEST['serendipity'].

Browse Source 
refs #642

Backported from master branch.

Signed-off-by: Thomas Hochstein <thh@inter.net>
This commit is contained in:
Garvin Hicking 2019-10-07 17:03:33 +02:00 committed by Thomas Hochstein
parent f26a306026
commit 2b9616276f
2 changed files with 29 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docs/NEWS
View File

@ -1,6 +1,12 @@
Version 2.3.2-beta1 () Version 2.3.2-beta1 ()
------------------------------------------------------------------------ ------------------------------------------------------------------------
* Only populate $serendipity['GET'], $serendipity['POST'] and
$serendipity['COOKIE'] with references to $_GET['serendipity'],
$_POST['serendipity'], $_COOKIE['serendipity'] if they are
transmitted as an array. Else, an empty array is used.
Prevents PHP warnings (Issue 642) thanks to @hannob
* Escape category images to avoid backend XSS. * Escape category images to avoid backend XSS.
Thanks to @hannob! Thanks to @hannob!

14
include/compat.inc.php
View File

@ -373,9 +373,23 @@ if (ini_get('magic_quotes_gpc')) {
} }
// Merge get and post into the serendipity array // Merge get and post into the serendipity array
if (is_array($_GET['serendipity'])) {
$serendipity['GET'] = &$_GET['serendipity']; $serendipity['GET'] = &$_GET['serendipity'];
} else {
$serendipity['GET'] = array();
}
if (is_array($_POST['serendipity'])) {
$serendipity['POST'] = &$_POST['serendipity']; $serendipity['POST'] = &$_POST['serendipity'];
} else {
$serendipity['POST'] = array();
}
if (is_array($_COOKIE['serendipity'])) {
$serendipity['COOKIE'] = &$_COOKIE['serendipity']; $serendipity['COOKIE'] = &$_COOKIE['serendipity'];
} else {
$serendipity['COOKIE'] = array();
}
// Attempt to fix IIS compatibility // Attempt to fix IIS compatibility
if (empty($_SERVER['REQUEST_URI'])) { if (empty($_SERVER['REQUEST_URI'])) {