mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-28 11:31:16 +00:00
better patch for the XSS search issue
Since the query string could be output when displaying the results too
This commit is contained in:
parent
d51876bc8e
commit
cf739b3568
@ -9,11 +9,12 @@
|
|||||||
$scope = ltrim ($scope);
|
$scope = ltrim ($scope);
|
||||||
if ($scope == "")
|
if ($scope == "")
|
||||||
$scope = "any";
|
$scope = "any";
|
||||||
|
$querystr = htmlspecialchars($query, ENT_QUOTES, 'UTF-8');
|
||||||
?>
|
?>
|
||||||
|
|
||||||
<form action="<?php echo $_SERVER['PHP_SELF'], "?query=", rawurlencode($query) ?>"
|
<form action="<?php echo $_SERVER['PHP_SELF'], "?query=", rawurlencode($query) ?>"
|
||||||
enctype="application/x-www-form-urlencoded" method="get">
|
enctype="application/x-www-form-urlencoded" method="get">
|
||||||
<input name="query" type="text" size="50" value="<?php echo htmlspecialchars($query, ENT_QUOTES, 'UTF-8')?>"/>
|
<input name="query" type="text" size="50" value="<?php echo $querystr ?>"/>
|
||||||
<select name="scope">
|
<select name="scope">
|
||||||
<option value="any">Search All</option>
|
<option value="any">Search All</option>
|
||||||
<option value="API" <?php if ($scope == 'API') print "selected='selected'"?>>Only the APIs</option>
|
<option value="API" <?php if ($scope == 'API') print "selected='selected'"?>>Only the APIs</option>
|
||||||
@ -200,7 +201,7 @@
|
|||||||
}
|
}
|
||||||
mysql_close($link);
|
mysql_close($link);
|
||||||
$nb = count($results);
|
$nb = count($results);
|
||||||
echo "<h3 align='center'>Found $nb results for query $query</h3>\n";
|
echo "<h3 align='center'>Found $nb results for query $querystr</h3>\n";
|
||||||
usort($results, "resSort");
|
usort($results, "resSort");
|
||||||
|
|
||||||
if ($nb > 0) {
|
if ($nb > 0) {
|
||||||
|
Loading…
Reference in New Issue
Block a user