mbirth/LuckyCoinkydink
1
0
Fork 0
Code Issues Pull Requests Activity

Move around searchTerm escaping, document.

Browse Source
This commit is contained in:
Garvin Hicking 2014-12-19 09:55:34 +01:00
parent 3010116e97
commit c8e147874b
3 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
docs/NEWS
View File

@ -1,8 +1,11 @@
#
Version 2.0-rc1 (includes beta4/5/6) (December 11th, 2014)
Version 2.0-rc1 (includes beta4/5/6) (December 19th, 2014)
------------------------------------------------------------------------
* entryproperties plugin will not automatically disable nl2br
markup, when the WYSIWYG editor is used to create en entry
* Fix for syndication subtome onclick handler
* Fix problematic preview stylesheet reference

5
include/compat.inc.php
View File

@ -280,11 +280,6 @@ if (empty($_SERVER['REQUEST_URI'])) {
$_SERVER['REQUEST_URI'] = $_SERVER['SCRIPT_NAME'] . '?' . (!empty($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '');
}
// Some security issues
if (isset($serendipity['GET']['searchTerm'])) {
$serendipity['GET']['searchTerm'] = serendipity_specialchars(strip_tags($serendipity['GET']['searchTerm']));
}
/**
* Translate values coming from the Database into native PHP variables to detect boolean values.
*

5
serendipity_config.inc.php
View File

@ -432,6 +432,11 @@ if (!isset($serendipity['GET']['adminAction'])) {
$serendipity['GET']['adminAction'] = (isset($serendipity['POST']['adminAction']) ? $serendipity['POST']['adminAction'] : '');
}
// Make sure this variable is always properly sanitized. Previously in compat.inc.php, but there LANG_CHARSET was not defined.
if (isset($serendipity['GET']['searchTerm'])) {
$serendipity['GET']['searchTerm'] = serendipity_specialchars(strip_tags($serendipity['GET']['searchTerm']));
}
// Some stuff...
if (!isset($_SESSION['serendipityAuthedUser'])) {
$_SESSION['serendipityAuthedUser'] = false;