tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Escape request and database values in forms and links.

Browse Source 
Add form_value() in html.lib.php.
This commit is contained in:
tim
2026-09-25 21:36:27 +02:00
parent 00e1829f8b
commit f6bdf10228
9 changed files with 37 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
get_data.lib.php
+1 -5
View File
@@ -1,11 +1,7 @@
<?php
require_once('open_db.lib.php');
require_once(__DIR__ . '/lib/purify.inc.php');
// Escape plain text for HTML (existing entities such as &hellip; are kept)
function h($string) {
return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', FALSE);
}
require_once(__DIR__ . '/html.lib.php');
function display_stories($id = NULL) {
global $db, $is_admin, $editable, $action;
html.lib.php
+11
View File
@@ -0,0 +1,11 @@
<?php
// Escape plain text for HTML (existing entities such as &hellip; are kept)
function h($string) {
return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', FALSE);
}
// Escape a raw value for an attribute or a textarea, so that it comes back unchanged
function form_value($string) {
return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
?>
navigation.lib.php
+9 -9
View File
@@ -32,10 +32,10 @@ function sort_options($link) {
array_push($options, $display);
} else {
$href = '<a href="'.$link.'?sort='.$sort_key.'&amp;order='.$order_key;
if (isset($_GET['queue'])) $href .= '&amp;queue='.$_GET['queue'];
if (isset($_GET['queue'])) $href .= '&amp;queue='.($queue ? 1 : 0);
if (isset($_GET['search'])) $href .= '&amp;search='.urlencode((string)$search);
if (isset($_GET['start'])) $href .= '&amp;start='.$start;
if (isset($_GET['show'])) $href .= '&amp;show='.$show;
if (isset($_GET['start'])) $href .= '&amp;start='.(int)$start;
if (isset($_GET['show'])) $href .= '&amp;show='.(int)$show;
$href .= '">'.$display.'</a>';
array_push($options, $href);
@@ -69,13 +69,13 @@ function get_pager() {
// Are there later stories? Go backwards to them
$string .= '<span class="next">';
if ($start > 0) {
$string .= "\n".'<a href="'.$link.'?start='.$next;
$string .= "\n".'<a href="'.$link.'?start='.(int)$next;
if (isset($_GET['queue'])) $string .= '&amp;queue='.$queue_url;
if (isset($_GET['search'])) $string .= '&amp;search='.urlencode((string)$search);
if (isset($_GET['show'])) $string .= '&amp;show='.$show;
if (isset($_GET['show'])) $string .= '&amp;show='.(int)$show;
if (isset($_GET['sort'])) $string .= '&amp;sort='.$sort;
if (isset($_GET['order'])) $string .= '&amp;order='.$order;
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords((int)$show) : (int)$show)." articles";
$string .= '">&laquo; Next '.$articles.'</a>';
}
$string .= "</span>\n";
@@ -83,13 +83,13 @@ function get_pager() {
// Are there earlier stories? Go forwards to them
$string .= "\n".'<span class="prev">';
if ($prev < get_count()) {
$string .= "\n".'<a href="'.$link.'?start='.$prev;
$string .= "\n".'<a href="'.$link.'?start='.(int)$prev;
if (isset($_GET['queue'])) $string .= '&amp;queue='.$queue_url;
if (isset($_GET['search'])) $string .= '&amp;search='.urlencode((string)$search);
if (isset($_GET['show'])) $string .= '&amp;show='.$show;
if (isset($_GET['show'])) $string .= '&amp;show='.(int)$show;
if (isset($_GET['sort'])) $string .= '&amp;sort='.$sort;
if (isset($_GET['order'])) $string .= '&amp;order='.$order;
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
$articles = ($show == 1) ? "article" : ($nw ? $nw->toWords((int)$show) : (int)$show)." articles";
$string .= '">Previous '.$articles.' &raquo;</a>';
}
$string .= "</span>\n";
publish/addeditor.php
+2 -2
View File
@@ -46,10 +46,10 @@ if (!isset($_SESSION['editor'])) {
<H1>add editor</H1>
<?php if ($added) { ?>
<p>Added editor <?= $username ?></p>
<p>Added editor <?= form_value($username) ?></p>
<?php } else { ?>
<form action="https://xxx.org.za<?= $_SERVER['REQUEST_URI'] ?>" method="post">
<form action="<?= form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']) ?>" method="post">
<div class="grid">
<label for="username">Username: </label>
publish/choose.inc.php
+1 -1
View File
@@ -16,7 +16,7 @@ if ($queue) { ?>
<p>To view articles in the queue, <a href="edit?queue=1">click here</a>.</p>
<div class="input" style="text-align: justify">
<form action="" method="get">
<input name="search" type="text" class="input" id="search" maxlength="40" value="<?= $_GET['search'] ?? '' ?>" />
<input name="search" type="text" class="input" id="search" maxlength="40" value="<?= form_value(get_search_args()) ?>" />
<input name="queue" type="hidden" value="0" />
<button type="submit" id="choose" name="action" value="choose" class="inputbutton">Search</button>
</form>
publish/login.php
+1 -1
View File
@@ -79,7 +79,7 @@ if ($denied)
echo "<p><strong>Access denied. Please try again.</strong></p>\n";
?>
<form action="<?php echo "https://xxx.org.za".$_SERVER['REQUEST_URI']; ?>" method="post">
<form action="<?php echo form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']); ?>" method="post">
<div class="grid">
<label for="username">Username: </label>
publish/preview.inc.php
+1 -1
View File
@@ -1,5 +1,5 @@
<?php
$result = get_post_data(TRUE, TRUE);
$result = get_post_data(TRUE);
extract($result[0], EXTR_OVERWRITE);
if (isset($_POST['g-recaptcha-response'])) {
publish/write.inc.php
+10 -10
View File
@@ -3,7 +3,7 @@ $id = get_id();
$search = get_search_args();
if ($action == 'preview')
$result = get_post_data(TRUE, TRUE);
$result = get_post_data(TRUE);
else if ($action && is_numeric($id))
$result = get_query($id);
if (isset($result) && is_array($result))
@@ -26,19 +26,19 @@ if (count($validate) !== 0) {
<label<?= isset($validate['title']) ? ' class="red"' : '' ?> for="title">Title:</label>
<div class="rightcolumn">
<input type="text" id="title" name="title" maxlength="150" value="<?= isset($title) ? $title : '' ?>" />
<input type="text" id="title" name="title" maxlength="150" value="<?= isset($title) ? form_value($title) : '' ?>" />
<span class="required">&nbsp;*</span>
</div>
<label<?= isset($validate['author']) ? ' class="red"' : '' ?> for="author">Author:</label>
<div class="rightcolumn">
<input type="text" name="author" id="author" value="<?= isset($author) ? $author : '' ?>" maxlength="150" />
<input type="text" name="author" id="author" value="<?= isset($author) ? form_value($author) : '' ?>" maxlength="150" />
<span class="required">&nbsp;*</span>
</div>
<label<?= isset($validate['email']) ? ' class="red"' : '' ?> for="email">Email address:</label>
<div class="rightcolumn">
<input type="text" name="email" id="email" maxlength="150" value="<?= isset($email) ? $email : ''?>" />
<input type="text" name="email" id="email" maxlength="150" value="<?= isset($email) ? form_value($email) : '' ?>" />
</div>
<div class="leftcolumn"></div>
@@ -52,7 +52,7 @@ if (count($validate) !== 0) {
<div class="textarea rightcolumn">
<div id="textparent">
<textarea name="story" id="story" rows="20" cols="50"><?php
echo (isset($story) ? $story : '')
echo (isset($story) ? form_value($story) : '')
?></textarea>
<div class="note">(To get line-breaks&mdash;as in poetry&mdash;instead of paragraph breaks, hit shift-enter instead of enter.)</div>
</div>
@@ -62,7 +62,7 @@ if (isset($file_src) || isset($img)) {
if (isset($file_src)) {
echo ' <input type="hidden" id="uploaded" name="uploaded" value="pending" />';
} else {
echo ' <input type="hidden" id="uploaded" name="uploaded" value="'.$id.'" />';
echo ' <input type="hidden" id="uploaded" name="uploaded" value="'.(int)$id.'" />';
}
echo ' <div class="in-note">If you are happy with the image above, click Submit. Otherwise, upload a new image:</div>';
} else {
@@ -89,16 +89,16 @@ if (isset($file_src) || isset($img)) {
<?php if ($is_admin) { ?>
<label<?php isset($validate['comments']) ? ' class="red"' : '' ?> for="comments">Comments:</label>
<div class="rightcolumn">
<input type="text" name="comments" id="comments" maxlength="150" value="<?= isset($comments) ? $comments : '' ?>" />
<input type="text" name="comments" id="comments" maxlength="150" value="<?= isset($comments) ? form_value($comments) : '' ?>" />
</div>
<input type="hidden" id="editor" name="editor" value="<?= $username ?>" />
<input type="hidden" id="editor" name="editor" value="<?= form_value($username) ?>" />
<?php } else { ?>
<input type="hidden" id="editor" name="editor" value="original author" />
<?php } ?>
<div style="display: none;">
<input type="hidden" id="date" name="date" value="<?= isset($date) ? $date : '' ?>" />
<input type="hidden" id="id" name="id" value="<?= isset($id) ? $id : '' ?>" />
<input type="hidden" id="date" name="date" value="<?= isset($date) ? form_value($date) : '' ?>" />
<input type="hidden" id="id" name="id" value="<?= isset($id) ? form_value($id) : '' ?>" />
</div>
<?php
session.lib.php
+1
View File
@@ -1,5 +1,6 @@
<?php
require_once(realpath(dirname(__FILE__) . '/open_db.lib.php'));
require_once(__DIR__ . '/html.lib.php');
$is_admin = FALSE;