Changeset 26918

Timestamp:

Jan 23, 2014, 12:07:23 PM (10 years ago)

Author:

mistic100

Message:

fix XSS on website field (see bug:3029)

File:

• extensions/GuestBook/include/functions_comment.inc.php (modified) (1 diff)

extensions/GuestBook/include/functions_comment.inc.php

@@ -88 +88 @@
   
   // website
-  if (!empty($comm['website']) and !preg_match('/^(https?:\/\/)/i', $comm['website']))
-  {
-    $comm['website'] = 'http://'.$comm['website'];
-  }
-  if (!empty($comm['website']) and !url_check_format($comm['website']))
-  {
-    $page['errors'][] = l10n('invalid website address');
-    $comment_action='reject';
+  if (!empty($comm['website']))
+  {
+    $comm['website'] = strip_tags($comm['website']);
+    if (!preg_match('/^(https?:\/\/)/i', $comm['website']))
+    {
+      $comm['website'] = 'http://'.$comm['website'];
+    }
+    if (!url_check_format($comm['website']))
+    {
+      $page['errors'][] = l10n('invalid website address');
+      $comment_action='reject';
+    }
   }