Public/elog
1
0
Fork 0
mirror of https://gitea.psi.ch/ELOG/elog.git synced 2026-09-08 17:13:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed CR/LF from redirection to avoid XSS

Browse Source 
SVN revision: 2218
This commit is contained in:
Stefan Ritt 2009-06-25 09:56:11 +00:00
parent 6af8e2c68c
commit e2d1784826
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/elogd.c
View File

@ -6750,11 +6750,19 @@ void compose_base_url(LOGBOOK * lbs, char *base_url, int size, BOOL email_notify
/*------------------------------------------------------------------*/
void set_location(LOGBOOK * lbs, char *rel_path)
void set_location(LOGBOOK * lbs, char *rp)
{
char str[NAME_LENGTH], group[NAME_LENGTH], list[NAME_LENGTH], *p;
char str[NAME_LENGTH], group[NAME_LENGTH], list[NAME_LENGTH], *p,
rel_path[NAME_LENGTH];
int i;
/* remove any CR/LF from path */
strlcpy(rel_path, rp, sizeof(rel_path));
if (strchr(rel_path, '\r'))
*strchr(rel_path, '\r') = 0;
if (strchr(rel_path, '\n'))
*strchr(rel_path, '\n') = 0;
if (getcfg(lbs->name, "Relative redirect", str, sizeof(str)) && atoi(str) == 1) {
if (rel_path[0])