Uploaded image for project: 'Observium'
  1. Observium
  2. OBS-1152

Security fixes + other small fixes

Details

    Description

      Attached patch escapes some more output show to user. Fixes XSS exploits.
      Also added a wrapper function (escape()) for the htmlspecialchars (long and boring to type..). Let me know if another name may be more suitable for the function. I did not change all the htmlspecialchars yet, waste of time if this does not get commited

      Other changes;
      Changed $_POST/GET into $vars in multiple files in html/
      Removed mres for place it was not needed or was redundant.
      Fixed a typo in generic_definition.inc.php
      Check if bill name is set when adding bill, if not don't add an empty entry to DB

      Attachments

        Activity

          [OBS-1152] Security fixes + other small fixes
          landy Mike Stupalov added a comment -

          Commited in r6207.

          Note, some changes not compatible with patch, you can get svn errors.

          landy Mike Stupalov added a comment - Commited in r6207. Note, some changes not compatible with patch, you can get svn errors.
          kentbjoh Kent Johannessen added a comment -

          another update.. damn this is hard. time to sleep i think

          kentbjoh Kent Johannessen added a comment - another update.. damn this is hard. time to sleep i think
          kentbjoh Kent Johannessen added a comment -

          see updated - went with escape_html()

          kentbjoh Kent Johannessen added a comment - see updated - went with escape_html()
          adama Adam Armstrong added a comment -

          can you give escape() a more specific name? escape_web() or escape_html() or something.

          adama Adam Armstrong added a comment - can you give escape() a more specific name? escape_web() or escape_html() or something.
          kentbjoh Kent Johannessen added a comment -

          small update

          kentbjoh Kent Johannessen added a comment - small update
          kentbjoh Kent Johannessen added a comment -

          updated patch. removed php version check in escape function
          fixed some other stuff

          kentbjoh Kent Johannessen added a comment - updated patch. removed php version check in escape function fixed some other stuff
          kentbjoh Kent Johannessen added a comment -

          I see that, but the main reason of the wrapper is less typing, and in the future it's easier to change just one function instead of several places in many files

          kentbjoh Kent Johannessen added a comment - I see that, but the main reason of the wrapper is less typing, and in the future it's easier to change just one function instead of several places in many files
          landy Mike Stupalov added a comment -

          This escape() function absolutely superfluous, there is absolutely no need to check the version of php, just always explicitly specify the encoding.

          landy Mike Stupalov added a comment - This escape() function absolutely superfluous, there is absolutely no need to check the version of php, just always explicitly specify the encoding.

          People

            landy Mike Stupalov
            kentbjoh Kent Johannessen
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: