danwin1210/le-chat-php
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix reflected XSS vulnerability

Browse Source
This commit is contained in:
Daniel Winzen
2020-05-02 19:42:34 +02:00
parent 1887d42a78
commit e149c9f97d
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
chat.php
View File

@ -368,7 +368,7 @@ function print_start($class='', $ref=0, $url=''){
function send_redirect($url){ function send_redirect($url){
global $I; global $I;
$url=htmlspecialchars_decode(rawurldecode($url)); $url=trim(htmlspecialchars_decode(rawurldecode($url)));
preg_match('~^(.*)://~u', $url, $match); preg_match('~^(.*)://~u', $url, $match);
$url=preg_replace('~^(.*)://~u', '', $url); $url=preg_replace('~^(.*)://~u', '', $url);
$escaped=htmlspecialchars($url); $escaped=htmlspecialchars($url);
@ -380,7 +380,11 @@ function send_redirect($url){
if(!isset($match[0])){ if(!isset($match[0])){
$match[0]=''; $match[0]='';
} }
echo "<p>$I[nonhttp] <a href=\"$match[0]$escaped\">$match[0]$escaped</a>.</p>"; if(preg_match('~^(javascript|blob|data):~', $url)){
echo "<p>$I[dangerousnonhttp] $match[0]$escaped</p>";
} else {
echo "<p>$I[nonhttp] <a href=\"$match[0]$escaped\">$match[0]$escaped</a>.</p>";
}
echo "<p>$I[httpredir] <a href=\"http://$escaped\">http://$escaped</a>.</p>"; echo "<p>$I[httpredir] <a href=\"http://$escaped\">http://$escaped</a>.</p>";
} }
print_end(); print_end();

1
lang_de.php
View File

@ -241,6 +241,7 @@ $T=[
'YellowGreen' => 'Gelbgrün', 'YellowGreen' => 'Gelbgrün',
'redirectto' => 'Leite weiter zu:', 'redirectto' => 'Leite weiter zu:',
'nonhttp' => 'Nicht-http Adresse angefordert:', 'nonhttp' => 'Nicht-http Adresse angefordert:',
'dangerousnonhttp' => 'Nicht-http Adresse angefordert. Kopieren Sie diesen Link und fügen ihn ein, falls Sie wirklich sicher sind.:',
'httpredir' => 'Wenn sie nicht funktioniert, probiere diese:', 'httpredir' => 'Wenn sie nicht funktioniert, probiere diese:',
'actions' => 'Aktionen', 'actions' => 'Aktionen',
'sesip' => 'IP-Adresse', 'sesip' => 'IP-Adresse',

1
lang_en.php
View File

@ -241,6 +241,7 @@ $I=[
'YellowGreen' => 'Yellow green', 'YellowGreen' => 'Yellow green',
'redirectto' => 'Redirecting to:', 'redirectto' => 'Redirecting to:',
'nonhttp' => 'Non-http link requested:', 'nonhttp' => 'Non-http link requested:',
'dangerousnonhttp' => 'Dangerous non-http link requested, copy paste this link if you are really sure:',
'httpredir' => 'If it\'s not working, try this one:', 'httpredir' => 'If it\'s not working, try this one:',
'actions' => 'Actions', 'actions' => 'Actions',
'sesip' => 'IP-Address', 'sesip' => 'IP-Address',