Changeset 2757 for trunk/comments.php

Timestamp:

Oct 16, 2008, 2:38:26 AM (16 years ago)

Author:

rvelices

Message:

merge 2755 and 2756 from branch 2.0 to trunk

• 2755 fix vulnerability ​http://www.milw0rm.com/exploits/6755
• 2756 security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)

File:

• trunk/comments.php (modified) (2 diffs)

trunk/comments.php

@@ -66 +66 @@
 $page['sort_by'] = 'date';
 // if the form was submitted, it overloads default behaviour
-if (isset($_GET['sort_by']))
+if (isset($_GET['sort_by']) and isset($sort_by[$_GET['sort_by']]) )
 {
   $page['sort_by'] = $_GET['sort_by'];
@@ -75 +75 @@
 $page['sort_order'] = 'DESC';
 // if the form was submitted, it overloads default behaviour
-if (isset($_GET['sort_order']))
+if (isset($_GET['sort_order']) and isset($sort_order[$_GET['sort_order']]))
 {
   $page['sort_order'] = $_GET['sort_order'];