Additional fix for XSS

shannah · Dec 27, 2018 · 725ac06 · 725ac06
1 parent 76239a9
commit 725ac06
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/Dataface/Application.php b/Dataface/Application.php
@@ -1023,7 +1023,7 @@ function Dataface_Application($conf = null){
 
 
 		if ( isset( $query['--msg'] ) ) {
-			$query['--msg'] = strip_tags($query['--msg']);
+			$query['--msg'] = htmlspecialchars($query['--msg']);
 			if ( preg_match('/^@@$/', $query['--msg']) ){
 
 				if ( @$_SESSION['--msg'] ){
@@ -1040,7 +1040,7 @@ function Dataface_Application($conf = null){
 
 
 		if ( isset($query['--error']) and trim($query['--error']) ){
-			$query['--error'] = preg_replace('#<[^>]*>#','', $query['--error']);
+			$query['--error'] = htmlspecialchars($query['--error']);
 			$this->addError(PEAR::raiseError($query['--error']));
 		}
 

diff --git a/version.txt b/version.txt
@@ -1 +1 @@
-2.2.1 4806
+2.2.2 4807