mbirth/LuckyCoinkydink
1
0
Fork 0
Code Issues Pull Requests Activity

* [Security] Reject %0D/%0A in exit tracking and other places

Browse Source 
(Issue #434)
This commit is contained in:
Garvin Hicking 2017-01-03 09:21:25 +01:00
parent edfc8bcff1
commit a48708021c
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/NEWS
View File

@ -14,6 +14,9 @@ Version 2.1 ()
* [Security] For multi-deletion of entries, secure the HTTP referrer
output to prevent XSS (Issue #435)
* [Security] Reject %0D/%0A in exit tracking and other places
(Issue #434)
* Disabled Selenium test files unless enabled

2
include/functions.inc.php
View File

@ -1023,7 +1023,7 @@ function serendipity_discover_rss($name, $ext) {
* @return boolean Return true on success, false on failure
*/
function serendipity_isResponseClean($d) {
return (strpos($d, "\r") === false && strpos($d, "\n") === false);
return (strpos($d, "\r") === false && strpos($d, "\n") === false && stripos($d, "%0A") === false && stripos($d, "%0D") === false);
}
/**