[geeklog-cvs] geeklog: Fernando Munoz reported a possible XSS in the query for...

[geeklog-cvs at lists.geeklog.net]

details:   http://project.geeklog.net/cgi-bin/hgweb.cgi/rev/e8be41d4f5d1
changeset: 6877:e8be41d4f5d1
user:      Dirk Haun <dirk at haun-online.de>
date:      Mon Mar 30 19:56:28 2009 +0200
description:
Fernando Munoz reported a possible XSS in the query form on most admin panels (bug #0000841).

diffstat:

5 files changed, 19 insertions(+), 5 deletions(-)
public_html/admin/install/index.php |    2 +-
public_html/docs/changes.html       |    5 +++++
public_html/docs/history            |    9 +++++++++
public_html/siteconfig.php.dist     |    2 +-
system/lib-admin.php                |    6 +++---

diffs (86 lines):

diff -r f8fe2b0d0c69 -r e8be41d4f5d1 public_html/admin/install/index.php
--- a/public_html/admin/install/index.php	Sun Feb 08 18:28:01 2009 +0100
+++ b/public_html/admin/install/index.php	Mon Mar 30 19:56:28 2009 +0200
@@ -48,7 +48,7 @@
     define("LB", "\n");
 }
 if (!defined('VERSION')) {
-    define('VERSION', '1.5.2');
+    define('VERSION', '1.5.2sr1');
 }
 if (!defined('XHTML')) {
     define('XHTML', ' /');
diff -r f8fe2b0d0c69 -r e8be41d4f5d1 public_html/docs/changes.html
--- a/public_html/docs/changes.html	Sun Feb 08 18:28:01 2009 +0100
+++ b/public_html/docs/changes.html	Mon Mar 30 19:56:28 2009 +0200
@@ -15,6 +15,11 @@
 and / or obvious changes. For a detailed list of changes, please consult the
 <a href="history">ChangeLog</a>. The file <tt>docs/changed-files</tt> has a list
 of files that have been changed since the last release.</p>
+
+<h2><a name="changes152sr1">Geeklog 1.5.2sr1</a></h2>
+
+<p>Fernando Muñoz reported a possible <a href="http://en.wikipedia.org/wiki/XSS" title="Click to look up 'XSS' on Wikipedia" style="text-decoration: none; color: black; border-bottom: 1px dotted black;">XSS</a> in the query form on most admin panels that we are fixing with this release.</p>
+
 
 <h2><a name="changes152">Geeklog 1.5.2</a></h2>
 
diff -r f8fe2b0d0c69 -r e8be41d4f5d1 public_html/docs/history
--- a/public_html/docs/history	Sun Feb 08 18:28:01 2009 +0100
+++ b/public_html/docs/history	Mon Mar 30 19:56:28 2009 +0200
@@ -1,4 +1,13 @@
 Geeklog History/Changes:
+
+Mar 30, 2009 (1.5.2sr1)
+------------
+
+This release addresses the following security issue:
+
+Fernando Munoz reported a possible XSS in the query form on most admin panels
+that we are fixing with this release (bug #0000841).
+
 
 Feb 8, 2009 (1.5.2)
 -----------
diff -r f8fe2b0d0c69 -r e8be41d4f5d1 public_html/siteconfig.php.dist
--- a/public_html/siteconfig.php.dist	Sun Feb 08 18:28:01 2009 +0100
+++ b/public_html/siteconfig.php.dist	Mon Mar 30 19:56:28 2009 +0200
@@ -38,7 +38,7 @@
   define('LB',"\n");
 }
 if (!defined('VERSION')) {
-  define('VERSION', '1.5.2');
+  define('VERSION', '1.5.2sr1');
 }
 
 ?>
diff -r f8fe2b0d0c69 -r e8be41d4f5d1 system/lib-admin.php
--- a/system/lib-admin.php	Sun Feb 08 18:28:01 2009 +0100
+++ b/system/lib-admin.php	Mon Mar 30 19:56:28 2009 +0200
@@ -221,7 +221,7 @@
 
     $query = '';
     if (isset ($_REQUEST['q'])) { # get query (text-search)
-        $query = $_REQUEST['q'];
+        $query = strip_tags(COM_stripslashes($_REQUEST['q']));
     }
 
     $query_limit = "";
@@ -317,7 +317,7 @@
         $admin_templates->set_var('lang_search', $LANG_ADMIN['search']);
         $admin_templates->set_var('lang_submit', $LANG_ADMIN['submit']);
         $admin_templates->set_var('lang_limit_results', $LANG_ADMIN['limit_results']);
-        $admin_templates->set_var('last_query', COM_applyFilter($query));
+        $admin_templates->set_var('last_query', htmlspecialchars($query));
         $admin_templates->set_var('filter', $filter);
     }
 
@@ -398,7 +398,7 @@
                 $th_subtags .= '&' . $component . 'listpage=' . $page;
             }
             if (!empty ($query)) {
-                $th_subtags .= '&q=' . $query;
+                $th_subtags .= '&q=' . urlencode($query);
             }
             if (!empty ($query_limit)) {
                 $th_subtags .= '&query_limit=' . $query_limit;