Browse Source

[svn r11153] Escaping message for XSS attacks (using htmlentities()) - Fixes http://projects.dokeos.com/?do=details&id=1194

Yannick Warnier 18 years ago
parent
commit
1ce945eadf
1 changed files with 8 additions and 0 deletions
  1. 8 0
      main/inc/lib/display.lib.php

+ 8 - 0
main/inc/lib/display.lib.php

@@ -293,6 +293,8 @@ class Display {
 	*/
 	function display_normal_message($message)
 	{
+		//filter message
+		$message = htmlentities($message);
 		if (!headers_sent())
 		{
 			echo '
@@ -317,6 +319,8 @@ class Display {
 	*/
 	function display_warning_message($message)
 	{
+		//filter message
+		$message = htmlentities($message);
 		if (!headers_sent())
 		{
 			echo '
@@ -340,6 +344,8 @@ class Display {
 	*/
 	function display_confirmation_message($message)
 	{
+		//filter message
+		$message = htmlentities($message);
 		if (!headers_sent())
 		{
 			echo '
@@ -366,6 +372,8 @@ class Display {
 	*/
 	function display_error_message($message)
 	{
+		//filter message
+		$message = htmlentities($message);
 		if (!headers_sent())
 		{
 			echo '