MDL-17789 prevent potential XSS problems through PHP_SELF; backported from HEAD

2009-01-06 13:10:00 +00:00
parent 581b14ecb7
commit ccd99f576a
1 changed files with 8 additions and 0 deletions
@@ -454,6 +454,14 @@ global $HTTPSPAGEREQUIRED;
        }
    }

+/// neutralise nasty chars in PHP_SELF
+    if (isset($_SERVER['PHP_SELF'])) {
+        $phppos = strpos($_SERVER['PHP_SELF'], '.php');
+        if ($phppos !== false) {
+            $_SERVER['PHP_SELF'] = substr($_SERVER['PHP_SELF'], 0, $phppos+4);
+        }
+        unset($phppos);
+    }

 /// The following code can emulate "register globals" if required.
 /// This hack is no longer being applied as of Moodle 1.6 unless you really