Browse Source

Fix XSS vulnerability (#134)

master
aklerza 9 months ago
committed by GitHub
parent
commit
2d59cd8384
No known key found for this signature in database GPG Key ID: B5690EEEBB952194
  1. 3
      bibtexbrowser.php

3
bibtexbrowser.php

@ -296,7 +296,8 @@ function default_message() {
You may browse:<br/>
<?php
foreach (glob("*.bib") as $bibfile) {
$url="?bib=".$bibfile; echo '<a href="'.$url.'" rel="nofollow">'.$bibfile.'</a><br/>';
$url="?bib=".urlencode($bibfile);
echo '<a href="'.htmlspecialchars($url, ENT_QUOTES, 'UTF-8').'" rel="nofollow">'.htmlspecialchars($bibfile, ENT_QUOTES, 'UTF-8').'</a><br/>';
}
echo "</div>";
}

Loading…
Cancel
Save