MDL-17789 prevent potential XSS problems through PHP_SELF

2009-01-06 12:31:20 +00:00
parent f1e715ff88
commit f98cfb53d1
1 changed files with 8 additions and 0 deletions
@@ -408,7 +408,15 @@ global $SCRIPT;
        }
        if (!empty($_SERVER['PATH_TRANSLATED'])) {
            $_SERVER['PATH_TRANSLATED'] = stripslashes($_SERVER['PATH_TRANSLATED']);
+    }
+
+/// neutralise nasty chars in PHP_SELF
+    if (isset($_SERVER['PHP_SELF'])) {
+        $phppos = strpos($_SERVER['PHP_SELF'], '.php');
+        if ($phppos !== false) {
+            $_SERVER['PHP_SELF'] = substr($_SERVER['PHP_SELF'], 0, $phppos+4);
        }
+        unset($phppos);
    }

 /// initialise ME's