[svn r10866] Fixing an XSS problem

http://projects.dokeos.com/?do=details&id=1164
19 years ago · 0b9bd4462c
parent 27d8ec4556
commit 0b9bd4462c
1 changed files with 18 additions and 17 deletions
--- a/main/tracking/personnalLog.php
+++ b/main/tracking/personnalLog.php
@ -63,7 +63,8 @@ td {border-bottom: thin dashed gray;}
 	Constants and variables
 -----------------------------------------------------------
 */
-$view = $_REQUEST['view'];
+//Remove all characters different than 0 and 1 from $view parameter
+$view = preg_replace('/[^01]/','',$_REQUEST['view']);

 $TABLECOURSUSER			= Database::get_main_table(TABLE_MAIN_COURSE_USER);
 $TABLETRACK_ACCESS 		= $_configuration['statistics_database']."`.`track_e_access";