Peter M. Groen / knowledgetree

Commit c1ccd41248939464f659534dc18201039f4fe1d6

Authored by andrew
1 parent 0c85bdab

Type: Functionality change 

Description:		Includes XSS attack prevention.
Behaviour before fix:	XSS attack could be performed on login.php.
Behaviour after fix:	XSS attacks seem unsuccessful after patch.
Credit:			Thanks to Jonathan E. Hawkins for pointing out this bug.


git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@2823 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 1 changed file with 40 additions and 0 deletions
lib/sanitize.inc 0 → 100644
  View file @c1ccd41
  1 +<?php
  2 +
  3 +/**
  4 + * $Id$
  5 + *
  6 + * This page is meant to provide functions to prevent XSS cracks.
  7 + *
  8 + * Copyright (c) 2003 Jam Warehouse http://www.jamwarehouse.com
  9 + *
  10 + * This program is free software; you can redistribute it and/or modify
  11 + * it under the terms of the GNU General Public License as published by
  12 + * the Free Software Foundation; either version 2 of the License, or
  13 + * (at your option) any later version.
  14 + *
  15 + * This program is distributed in the hope that it will be useful,
  16 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  18 + * GNU General Public License for more details.
  19 + *
  20 + * You should have received a copy of the GNU General Public License
  21 + * along with this program; if not, write to the Free Software
  22 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  23 + *
  24 + * @version $Revision$
  25 + * @author Andrew Glen-Young <andrew@jamwarehouse.com>, Jam Warehouse (Pty) Ltd, South Africa
  26 + */
  27 +
  28 +/**
  29 + * Accepts a web encoded string and outputs a "clean" string.
  30 + */
  31 +
  32 +function sanitize($string) {
  33 + // Remove '(' and ')'
  34 + $xss_array = array("(" => "#&40;", ")" => "#&41;");
  35 + // Remove all HTML tags.
  36 + $string = strtr(strip_tags(urldecode($string)), $xss_array);
  37 + return $string;
  38 +}
  39 +
  40 +?>
... ...