Public/elog
1
0
Fork 0
mirror of https://gitea.psi.ch/ELOG/elog.git synced 2026-09-08 17:13:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged in p27-lanl/elog-xss (pull request #3)

Browse Source 
Fixed XSS vulnerability with show_change_pwd_page
This commit is contained in:
Stefan Ritt 2016-06-21 22:14:39 +02:00
commit 64cdce35a3
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/elogd.c
View File

@ -9005,8 +9005,10 @@ void show_change_pwd_page(LOGBOOK * lbs)
rsprintf("<table class=\"dlgframe\" cellspacing=0 align=center>"); rsprintf("<table class=\"dlgframe\" cellspacing=0 align=center>");
if (wrong_pwd == 1) { if (wrong_pwd == 1) {
if (error_str[0]) if (error_str[0]) {
rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", error_str); strencode2(str, error_str, sizeof(str));
rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", str);
}
else else
rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", loc("Wrong password")); rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", loc("Wrong password"));
} }
@ -9015,8 +9017,10 @@ void show_change_pwd_page(LOGBOOK * lbs)
rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n",
loc("New passwords do not match, please retype")); loc("New passwords do not match, please retype"));
if (wrong_pwd == 3) if (wrong_pwd == 3) {
rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", error_str); strencode2(str, error_str, sizeof(str));
rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", str);
}
rsprintf("<tr><td colspan=2 class=\"dlgtitle\">\n"); rsprintf("<tr><td colspan=2 class=\"dlgtitle\">\n");
@ -21102,8 +21106,9 @@ void show_elog_list(LOGBOOK * lbs, int past_n, int last_n, int page_n, BOOL defa
rsprintf("<table width=\"100%%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\n"); rsprintf("<table width=\"100%%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\n");
if (isparam("last")) { if (isparam("last")) {
rsprintf("<tr><td nowrap width=\"10%%\" class=\"attribname\">%s:</td>", loc("Restrict seach to last")); rsprintf("<tr><td nowrap width=\"10%%\" class=\"attribname\">%s:</td>", loc("Restrict search to last"));
rsprintf("<td class=\"attribvalue\">%s %s</td></tr>", getparam("last"), loc("days")); strencode2(str, getparam("last"), sizeof(str));
rsprintf("<td class=\"attribvalue\">%s %s</td></tr>", str, loc("days"));
} }
if (isparam("ma") || isparam("ya") || isparam("da") || isparam("ha") || isparam("na") if (isparam("ma") || isparam("ya") || isparam("da") || isparam("ha") || isparam("na")