ZaneYork
/
zoneminder
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix name/protocol XSS in controlcaps.php. Fixes #2445 (#2479)

This commit is contained in:
Matt N 2019-01-25 05:35:07 -08:00 committed by Isaac Connor
parent fd6179d7c8
commit 8c5687ca30
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
web/includes/functions.php
View File

@ -450,6 +450,9 @@ function makeLink( $url, $label, $condition=1, $options='' ) {
return( $string ); return( $string );
} }
/**
* $label must be already escaped. It can't be done here since it sometimes contains HTML tags.
*/
function makePopupLink( $url, $winName, $winSize, $label, $condition=1, $options='' ) { function makePopupLink( $url, $winName, $winSize, $label, $condition=1, $options='' ) {
// Avoid double-encoding since some consumers incorrectly pass a pre-escaped URL. // Avoid double-encoding since some consumers incorrectly pass a pre-escaped URL.
$string = '<a class="popup-link" href="' . htmlspecialchars($url, ENT_COMPAT | ENT_HTML401, ini_get("default_charset"), false) . '"'; $string = '<a class="popup-link" href="' . htmlspecialchars($url, ENT_COMPAT | ENT_HTML401, ini_get("default_charset"), false) . '"';

4
web/skins/classic/views/controlcaps.php
View File

@ -63,9 +63,9 @@ foreach( $controls as $control )
{ {
?> ?>
<tr> <tr>
<td class="colName"><?php echo makePopupLink( '?view=controlcap&cid='.$control['Id'], 'zmControlCap', 'controlcap', $control['Name'], canView( 'Control' ) ) ?></td> <td class="colName"><?php echo makePopupLink( '?view=controlcap&cid='.$control['Id'], 'zmControlCap', 'controlcap', validHtmlStr($control['Name']), canView( 'Control' ) ) ?></td>
<td class="colType"><?php echo $control['Type'] ?></td> <td class="colType"><?php echo $control['Type'] ?></td>
<td class="colProtocol"><?php echo $control['Protocol'] ?></td> <td class="colProtocol"><?php echo validHtmlStr($control['Protocol']) ?></td>
<td class="colCanMove"><?php echo $control['CanMove']?translate('Yes'):translate('No') ?></td> <td class="colCanMove"><?php echo $control['CanMove']?translate('Yes'):translate('No') ?></td>
<td class="colCanZoom"><?php echo $control['CanZoom']?translate('Yes'):translate('No') ?></td> <td class="colCanZoom"><?php echo $control['CanZoom']?translate('Yes'):translate('No') ?></td>
<td class="colCanFocus"><?php echo $control['CanFocus']?translate('Yes'):translate('No') ?></td> <td class="colCanFocus"><?php echo $control['CanFocus']?translate('Yes'):translate('No') ?></td>