Added by RCheesley over 15 years ago. Updated about 15 years ago.
Description
Created a dropdown list with >1yr <1 yr and when the field was selected, hitting submit kept saying it was not selected (it was a mandatory field). Assume the code isn't being sanitised properly.
Files
| 1908.patch (823 Bytes) 1908.patch | krileon, 18 August 2010 18:27 |
Updated by krileon over 15 years ago
Actions
#1
Confirmed, values are NOT escape before they are saved to database. Will investigate further as to why, they should be htmlspecialed before storing.
Updated by krileon over 15 years ago
Actions
#2
Reviewing source it is being htmlspecialed on frontend so no backend htmlspecial needed.
Updated by krileon over 15 years ago
Actions
#3
Applies to <TEXT, but >TEXT works fine.
Updated by krileon over 15 years ago
Actions
#4
cbGetParam was missing _MOS_ALLOWRAW preventing raw input from being obtained (further sensitization is done below to ensure it's safe)
Updated by krileon over 15 years ago
Actions
#5
Updated by krileon over 15 years ago
Actions
#6
Updated by beat about 15 years ago
Actions
#7
Fixed in r1248 as suggested by patch, but also added strict to the in_array checks for valid entries, to avoid any lowering of security by the patch.
Thank you, Kyle.
Updated by beat about 15 years ago
Actions
#8
Fixed regression in r1268:
Notice: Use of undefined constant strict - assumed 'strict' in D:\xampp\htdocs\cb\j15\components\com_comprofiler\plugin\user\plug_cbcore\cb.core.php on line 723
[19.11.10 18:27:17] Kyle: as for activity plugin, it already works? what's broken about it?