View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0007545 | mantisbt | administration | public | 2006-10-30 06:21 | 2007-05-08 03:42 |
| Reporter | cybot | Assigned To | zakman | ||
| Priority | normal | Severity | tweak | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Product Version | 1.1.0a1 | ||||
| Fixed in Version | 1.1.0a3 | ||||
| Summary | 0007545: config values are not escaped | ||||
| Description | html special chars are not escaped in config vlaues when printed out in adm_config_report.php | ||||
| Additional Information | patch attached it took me some time ... 'wired' coding standards ... | ||||
| Tags | No tags attached. | ||||
| Attached Files | mantisbt_adm_config_report.php.patch (597 bytes)
Index: adm_config_report.php =================================================================== RCS file: /cvsroot/mantisbt/mantisbt/adm_config_report.php,v retrieving revision 1.5 diff -u -r1.5 adm_config_report.php --- adm_config_report.php 12 Sep 2006 03:38:57 -0000 1.5 +++ adm_config_report.php 30 Oct 2006 11:08:39 -0000 @@ -41,7 +41,7 @@ return; case CONFIG_TYPE_STRING: $t_value = config_eval( $p_value ); - echo "'$t_value'"; + echo htmlspecialchars( "'$t_value'" ); return; case CONFIG_TYPE_COMPLEX: $t_value = unserialize( $p_value ); | ||||
