Escape request and database values in forms and links.

Add form_value() in html.lib.php.

get_data.lib.php

@@ -1,11 +1,7 @@
 <?php
 require_once('open_db.lib.php');
 require_once(__DIR__ . '/lib/purify.inc.php');
-
+require_once(__DIR__ . '/html.lib.php');
-// Escape plain text for HTML (existing entities such as &hellip; are kept)
-function h($string) {
-  return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', FALSE);
-}
 
 function display_stories($id = NULL) {
   global $db, $is_admin, $editable, $action;

html.lib.php

@@ -0,0 +1,11 @@
+<?php
+// Escape plain text for HTML (existing entities such as &hellip; are kept)
+function h($string) {
+  return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', FALSE);
+}
+
+// Escape a raw value for an attribute or a textarea, so that it comes back unchanged
+function form_value($string) {
+  return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+}
+?>

navigation.lib.php

@@ -32,10 +32,10 @@ function sort_options($link) {
         array_push($options, $display);
       } else {
         $href = '<a href="'.$link.'?sort='.$sort_key.'&amp;order='.$order_key;
-        if (isset($_GET['queue']))  $href .= '&amp;queue='.$_GET['queue'];
+        if (isset($_GET['queue']))  $href .= '&amp;queue='.($queue ? 1 : 0);
         if (isset($_GET['search'])) $href .= '&amp;search='.urlencode((string)$search);
-        if (isset($_GET['start']))  $href .= '&amp;start='.$start;
+        if (isset($_GET['start']))  $href .= '&amp;start='.(int)$start;
-        if (isset($_GET['show']))   $href .= '&amp;show='.$show;
+        if (isset($_GET['show']))   $href .= '&amp;show='.(int)$show;
         $href .= '">'.$display.'</a>';
 
         array_push($options, $href);
@@ -69,13 +69,13 @@ function get_pager() {
   // Are there later stories? Go backwards to them
   $string .= '<span class="next">';
   if ($start > 0) {
-    $string .= "\n".'<a href="'.$link.'?start='.$next;
+    $string .= "\n".'<a href="'.$link.'?start='.(int)$next;
     if (isset($_GET['queue']))  $string .= '&amp;queue='.$queue_url;
     if (isset($_GET['search'])) $string .= '&amp;search='.urlencode((string)$search);
-    if (isset($_GET['show']))   $string .= '&amp;show='.$show;
+    if (isset($_GET['show']))   $string .= '&amp;show='.(int)$show;
     if (isset($_GET['sort']))   $string .= '&amp;sort='.$sort;
     if (isset($_GET['order']))  $string .= '&amp;order='.$order;
-    $articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
+    $articles = ($show == 1) ? "article" : ($nw ? $nw->toWords((int)$show) : (int)$show)." articles";
     $string .= '">&laquo; Next '.$articles.'</a>';
   }
   $string .= "</span>\n";
@@ -83,13 +83,13 @@ function get_pager() {
   // Are there earlier stories? Go forwards to them
   $string .= "\n".'<span class="prev">';
   if ($prev < get_count()) {
-    $string .= "\n".'<a href="'.$link.'?start='.$prev;
+    $string .= "\n".'<a href="'.$link.'?start='.(int)$prev;
     if (isset($_GET['queue']))  $string .= '&amp;queue='.$queue_url;
     if (isset($_GET['search'])) $string .= '&amp;search='.urlencode((string)$search);
-    if (isset($_GET['show']))   $string .= '&amp;show='.$show;
+    if (isset($_GET['show']))   $string .= '&amp;show='.(int)$show;
     if (isset($_GET['sort']))   $string .= '&amp;sort='.$sort;
     if (isset($_GET['order']))  $string .= '&amp;order='.$order;
-    $articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
+    $articles = ($show == 1) ? "article" : ($nw ? $nw->toWords((int)$show) : (int)$show)." articles";
     $string .= '">Previous '.$articles.' &raquo;</a>';
   }
   $string .= "</span>\n";

publish/addeditor.php

@@ -46,10 +46,10 @@ if (!isset($_SESSION['editor'])) {
 <H1>add editor</H1>
 
 <?php if ($added) { ?>
-  <p>Added editor <?= $username ?></p>
+  <p>Added editor <?= form_value($username) ?></p>
 <?php } else { ?>
 
-<form action="https://xxx.org.za<?= $_SERVER['REQUEST_URI'] ?>" method="post">
+<form action="<?= form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']) ?>" method="post">
   <div class="grid">
 
     <label for="username">Username: </label>

publish/choose.inc.php

@@ -16,7 +16,7 @@ if ($queue) { ?>
 <p>To view articles in the queue, <a href="edit?queue=1">click here</a>.</p>
 <div class="input" style="text-align: justify">
         <form action="" method="get">
-  <input name="search" type="text" class="input" id="search" maxlength="40" value="<?= $_GET['search'] ?? '' ?>" />
+  <input name="search" type="text" class="input" id="search" maxlength="40" value="<?= form_value(get_search_args()) ?>" />
   <input name="queue" type="hidden" value="0" />
   <button type="submit" id="choose" name="action" value="choose" class="inputbutton">Search</button>
 </form>

publish/login.php

@@ -79,7 +79,7 @@ if ($denied)
   echo "<p><strong>Access denied. Please try again.</strong></p>\n";
 ?>
 
-<form action="<?php echo "https://xxx.org.za".$_SERVER['REQUEST_URI']; ?>" method="post">
+<form action="<?php echo form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']); ?>" method="post">
   <div class="grid">
 
     <label for="username">Username: </label>

publish/preview.inc.php

@@ -1,5 +1,5 @@
 <?php
-$result = get_post_data(TRUE, TRUE);
+$result = get_post_data(TRUE);
 extract($result[0], EXTR_OVERWRITE);
 
 if (isset($_POST['g-recaptcha-response'])) {

publish/write.inc.php

@@ -3,7 +3,7 @@ $id     = get_id();
 $search = get_search_args();
 
 if ($action == 'preview')
-  $result = get_post_data(TRUE, TRUE);
+  $result = get_post_data(TRUE);
 else if ($action && is_numeric($id))
   $result = get_query($id);
 if (isset($result) && is_array($result))
@@ -26,19 +26,19 @@ if (count($validate) !== 0) {
 
 <label<?= isset($validate['title']) ? ' class="red"' : '' ?> for="title">Title:</label>
 <div class="rightcolumn">
-<input type="text" id="title" name="title" maxlength="150" value="<?= isset($title) ? $title : '' ?>" />
+<input type="text" id="title" name="title" maxlength="150" value="<?= isset($title) ? form_value($title) : '' ?>" />
 <span class="required">&nbsp;*</span>
 </div>
 
 <label<?= isset($validate['author']) ? ' class="red"' : '' ?> for="author">Author:</label>
 <div class="rightcolumn">
-<input type="text" name="author" id="author" value="<?= isset($author) ? $author : '' ?>" maxlength="150" />
+<input type="text" name="author" id="author" value="<?= isset($author) ? form_value($author) : '' ?>" maxlength="150" />
 <span class="required">&nbsp;*</span>
 </div>
 
 <label<?= isset($validate['email']) ? ' class="red"' : '' ?> for="email">Email address:</label>
 <div class="rightcolumn">
-<input type="text" name="email" id="email" maxlength="150" value="<?= isset($email) ? $email : ''?>" />
+<input type="text" name="email" id="email" maxlength="150" value="<?= isset($email) ? form_value($email) : '' ?>" />
 </div>
 
 <div class="leftcolumn"></div>
@@ -52,7 +52,7 @@ if (count($validate) !== 0) {
 <div class="textarea rightcolumn">
   <div id="textparent">
     <textarea name="story" id="story" rows="20" cols="50"><?php 
-echo (isset($story) ? $story : '')
+echo (isset($story) ? form_value($story) : '')
   ?></textarea>
     <div class="note">(To get line-breaks&mdash;as in poetry&mdash;instead of paragraph breaks, hit shift-enter instead of enter.)</div>
   </div>
@@ -62,7 +62,7 @@ if (isset($file_src) || isset($img)) {
   if (isset($file_src)) {
     echo '  <input type="hidden" id="uploaded" name="uploaded" value="pending" />';
   } else {
-    echo '  <input type="hidden" id="uploaded" name="uploaded" value="'.$id.'" />';
+    echo '  <input type="hidden" id="uploaded" name="uploaded" value="'.(int)$id.'" />';
   }
   echo '    <div class="in-note">If you are happy with the image above, click Submit. Otherwise, upload a new image:</div>';
 } else {
@@ -89,16 +89,16 @@ if (isset($file_src) || isset($img)) {
 <?php  if ($is_admin) { ?>
   <label<?php isset($validate['comments']) ? ' class="red"' : '' ?> for="comments">Comments:</label>
   <div class="rightcolumn">
-    <input type="text" name="comments" id="comments" maxlength="150" value="<?= isset($comments) ? $comments : '' ?>" />
+    <input type="text" name="comments" id="comments" maxlength="150" value="<?= isset($comments) ? form_value($comments) : '' ?>" />
   </div>
-  <input type="hidden" id="editor" name="editor" value="<?= $username ?>" />
+  <input type="hidden" id="editor" name="editor" value="<?= form_value($username) ?>" />
 <?php } else { ?>
   <input type="hidden" id="editor" name="editor" value="original author" />
 <?php } ?>
 
 <div style="display: none;">
-<input type="hidden" id="date" name="date" value="<?= isset($date) ? $date : '' ?>" />
+<input type="hidden" id="date" name="date" value="<?= isset($date) ? form_value($date) : '' ?>" />
-<input type="hidden" id="id" name="id" value="<?= isset($id) ? $id : '' ?>" />
+<input type="hidden" id="id" name="id" value="<?= isset($id) ? form_value($id) : '' ?>" />
 </div>
 
 <?php

session.lib.php

@@ -1,5 +1,6 @@
 <?php
 require_once(realpath(dirname(__FILE__) . '/open_db.lib.php'));
+require_once(__DIR__ . '/html.lib.php');
 
 $is_admin = FALSE;