fm/zrd-bibtexbrowser
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #16 from arnehaber/clean_xss_fix

Browse Source 
Fixes a potential cross site scripting (XSS) issue
This commit is contained in:
Martin Monperrus
2014-05-05 12:29:16 +02:00
parent 8473ccb50f fc7f5c77fb
commit 63aef9c2ed
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bibtexbrowser.php
+3 -2
View File
@@ -243,10 +243,11 @@ function _zetDB($bibtex_filenames) {
$ext = pathinfo($bib, PATHINFO_EXTENSION); $ext = pathinfo($bib, PATHINFO_EXTENSION);
// this is a security protection // this is a security protection
if (BIBTEXBROWSER_LOCAL_BIB_ONLY && (!file_exists($bib) || strcasecmp($ext, 'bib') != 0)) { if (BIBTEXBROWSER_LOCAL_BIB_ONLY && (!file_exists($bib) || strcasecmp($ext, 'bib') != 0)) {
// to automate dectection of faulty links with tools such as webcheck // to automate dectection of faulty links with tools such as webcheck
header('HTTP/1.1 404 Not found'); header('HTTP/1.1 404 Not found');
die('<b>the bib file '.$bib.' does not exist !</b>'); // escape $bib to prevent XSS
$escapedBib = htmlEntities($bib, ENT_QUOTES);
die('<b>the bib file '.$escapedBib.' does not exist !</b>');
} }
} // end for each } // end for each