diff options
| author | Michael Tänzer <neo@nhng.de> | 2014-04-11 17:42:01 +0200 |
|---|---|---|
| committer | Michael Tänzer <neo@nhng.de> | 2014-04-11 17:42:01 +0200 |
| commit | bf0cbaf8c06acac73cd525d692b61ed1ac4cac47 (patch) | |
| tree | a7296fd06c32063cfbdde2013a28ffd10b5310e1 /pages/account | |
| parent | 6b98864419055ef5b3b2a899384f4a14eadf1960 (diff) | |
| download | cacert-devel-bf0cbaf8c06acac73cd525d692b61ed1ac4cac47.tar.gz cacert-devel-bf0cbaf8c06acac73cd525d692b61ed1ac4cac47.tar.xz cacert-devel-bf0cbaf8c06acac73cd525d692b61ed1ac4cac47.zip | |
bug 1138: Sanitize ticket number against XSS
Signed-off-by: Michael Tänzer <neo@nhng.de>
Diffstat (limited to 'pages/account')
| -rw-r--r-- | pages/account/43.php | 60 | ||||
| -rw-r--r-- | pages/account/44.php | 2 |
2 files changed, 31 insertions, 31 deletions
diff --git a/pages/account/43.php b/pages/account/43.php index 9e35671..c69ecb6 100644 --- a/pages/account/43.php +++ b/pages/account/43.php @@ -156,7 +156,7 @@ if(intval($_REQUEST['userid']) > 0) { </tr> <tr> <td class="DataTD"><?=_('Ticket no')?>:</td> - <td class="DataTD"><input type="text" name="ticketno" value="<?=$ticketno?>"/></td> + <td class="DataTD"><input type="text" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/></td> </tr> <tr> <td colspan="2" class="DataTDError"><?=$ticketmsg?></td><?php $_SESSION['ticketmsg']='' ?> @@ -233,7 +233,7 @@ if(intval($_REQUEST['userid']) > 0) { </select> <input type="text" name="year" value="<?=$year?>" size="4"> <input type="submit" value="Go"> - <input type="hidden" name="ticketno" value="<?=$ticketno?>"/> + <input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/> </form> </nobr> </td> @@ -250,70 +250,70 @@ if(intval($_REQUEST['userid']) > 0) { </tr> <tr> <td class="DataTD"><?=_("Is Assurer")?>:</td> - <td class="DataTD"><a href="account.php?id=43&assurer=<?=intval($row['id'])?>&csrf=<?=make_csrf('admsetassuret')?>&ticketno=<?=$ticketno?>"><?=$row['assurer']?></a></td> + <td class="DataTD"><a href="account.php?id=43&assurer=<?=intval($row['id'])?>&csrf=<?=make_csrf('admsetassuret')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['assurer']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Blocked Assurer")?>:</td> - <td class="DataTD"><a href="account.php?id=43&assurer_blocked=<?=intval($row['id'])?>&ticketno=<?=$ticketno?>"><?=$row['assurer_blocked']?></a></td> + <td class="DataTD"><a href="account.php?id=43&assurer_blocked=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['assurer_blocked']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Account Locking")?>:</td> - <td class="DataTD"><a href="account.php?id=43&locked=<?=$row['id']?>&csrf=<?=make_csrf('admactlock')?>&ticketno=<?=$ticketno?>"><?=$row['locked']?></a></td> + <td class="DataTD"><a href="account.php?id=43&locked=<?=$row['id']?>&csrf=<?=make_csrf('admactlock')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['locked']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Code Signing")?>:</td> - <td class="DataTD"><a href="account.php?id=43&codesign=<?=$row['id']?>&csrf=<?=make_csrf('admcodesign')?>&ticketno=<?=$ticketno?>"><?=$row['codesign']?></a></td> + <td class="DataTD"><a href="account.php?id=43&codesign=<?=$row['id']?>&csrf=<?=make_csrf('admcodesign')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['codesign']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Org Assurer")?>:</td> - <td class="DataTD"><a href="account.php?id=43&orgadmin=<?=$row['id']?>&csrf=<?=make_csrf('admorgadmin')?>&ticketno=<?=$ticketno?>"><?=$row['orgadmin']?></a></td> + <td class="DataTD"><a href="account.php?id=43&orgadmin=<?=$row['id']?>&csrf=<?=make_csrf('admorgadmin')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['orgadmin']?></a></td> </tr> <tr> <td class="DataTD"><?=_("TTP Admin")?>:</td> - <td class="DataTD"><a href="account.php?id=43&ttpadmin=<?=$row['id']?>&csrf=<?=make_csrf('admttpadmin')?>&ticketno=<?=$ticketno?>"><?=$row['ttpadmin']?></a></td> + <td class="DataTD"><a href="account.php?id=43&ttpadmin=<?=$row['id']?>&csrf=<?=make_csrf('admttpadmin')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['ttpadmin']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Location Admin")?>:</td> - <td class="DataTD"><a href="account.php?id=43&locadmin=<?=$row['id']?>&ticketno=<?=$ticketno?>"><?=$row['locadmin']?></a></td> + <td class="DataTD"><a href="account.php?id=43&locadmin=<?=$row['id']?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['locadmin']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Admin")?>:</td> - <td class="DataTD"><a href="account.php?id=43&admin=<?=$row['id']?>&csrf=<?=make_csrf('admsetadmin')?>&ticketno=<?=$ticketno?>"><?=$row['admin']?></a></td> + <td class="DataTD"><a href="account.php?id=43&admin=<?=$row['id']?>&csrf=<?=make_csrf('admsetadmin')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['admin']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Ad Admin")?>:</td> - <td class="DataTD"><a href="account.php?id=43&adadmin=<?=$row['id']?>&ticketno=<?=$ticketno?>"><?=$row['adadmin']?></a> (0 = none, 1 = submit, 2 = approve)</td> + <td class="DataTD"><a href="account.php?id=43&adadmin=<?=$row['id']?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['adadmin']?></a> (0 = none, 1 = submit, 2 = approve)</td> </tr> <!-- presently not needed <tr> <td class="DataTD"><?=_("Tverify Account")?>:</td> - <td class="DataTD"><a href="account.php?id=43&tverify=<?=$row['id']?>&ticketno=<?=$ticketno?>"><?=$row['tverify']?></a></td> + <td class="DataTD"><a href="account.php?id=43&tverify=<?=$row['id']?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['tverify']?></a></td> </tr> --> <tr> <td class="DataTD"><?=_("General Announcements")?>:</td> - <td class="DataTD"><a href="account.php?id=43&general=<?=$row['id']?>&ticketno=<?=$ticketno?>"><?=$alerts['general']?></a></td> + <td class="DataTD"><a href="account.php?id=43&general=<?=$row['id']?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$alerts['general']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Country Announcements")?>:</td> - <td class="DataTD"><a href="account.php?id=43&country=<?=$row['id']?>&ticketno=<?=$ticketno?>"><?=$alerts['country']?></a></td> + <td class="DataTD"><a href="account.php?id=43&country=<?=$row['id']?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$alerts['country']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Regional Announcements")?>:</td> - <td class="DataTD"><a href="account.php?id=43&regional=<?=$row['id']?>&ticketno=<?=$ticketno?>"><?=$alerts['regional']?></a></td> + <td class="DataTD"><a href="account.php?id=43&regional=<?=$row['id']?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$alerts['regional']?></a></td> </tr> <tr> <td class="DataTD"><?=_("Within 200km Announcements")?>:</td> - <td class="DataTD"><a href="account.php?id=43&radius=<?=$row['id']?>&ticketno=<?=$ticketno?>"><?=$alerts['radius']?></a></td> + <td class="DataTD"><a href="account.php?id=43&radius=<?=$row['id']?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$alerts['radius']?></a></td> </tr> <? //change password, view secret questions and delete account section ?> <tr> <td class="DataTD"><?=_("Change Password")?>:</td> - <td class="DataTD"><a href="account.php?id=44&userid=<?=$row['id']?>&ticketno=<?=$ticketno?>"><?=_("Change Password")?></a></td> + <td class="DataTD"><a href="account.php?id=44&userid=<?=$row['id']?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Change Password")?></a></td> </tr> <tr> <td class="DataTD"><?=_("Delete Account")?>:</td> - <td class="DataTD"><a href="account.php?id=50&userid=<?=$row['id']?>&csrf=<?=make_csrf('admdelaccount')?>&ticketno=<?=$ticketno?>"><?=_("Delete Account")?></a></td> + <td class="DataTD"><a href="account.php?id=50&userid=<?=$row['id']?>&csrf=<?=make_csrf('admdelaccount')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Delete Account")?></a></td> </tr> <? // This is intensionally a $_GET for audit purposes. DO NOT CHANGE!!! @@ -324,7 +324,7 @@ if(intval($_REQUEST['userid']) > 0) { <td class="DataTD" colspan="2"><?=_("Writing to the admin log failed. Can't continue.")?></td> </tr> <tr> - <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=$row['id']?>&showlostpw=yes&ticketno=<?=$ticketno?>"><?=_("Show Lost Password Details")?></a></td> + <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=$row['id']?>&showlostpw=yes&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td> </tr> <? } else { @@ -377,13 +377,13 @@ if(intval($_REQUEST['userid']) > 0) { <td class="DataTD" colspan="2"><?=_('No access granted. Ticket number is missing')?></td> </tr> <tr> - <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=$row['id']?>&showlostpw=yes&ticketno=<?=$ticketno?>"><?=_("Show Lost Password Details")?></a></td> + <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=$row['id']?>&showlostpw=yes&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td> </tr> <? } else { ?> <tr> - <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=$row['id']?>&showlostpw=yes&ticketno=<?=$ticketno?>"><?=_("Show Lost Password Details")?></a></td> + <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=$row['id']?>&showlostpw=yes&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td> </tr> <? } @@ -397,7 +397,7 @@ if(intval($_REQUEST['userid']) > 0) { // show account history ?> <tr> - <td class="DataTD" colspan="2"><a href="account.php?id=59&oldid=43&userid=<?=intval($row['id'])?>&ticketno=<?=$ticketno?>"><?=_('Show account history')?></a></td> + <td class="DataTD" colspan="2"><a href="account.php?id=59&oldid=43&userid=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_('Show account history')?></a></td> </tr> </table> <br/> @@ -425,7 +425,7 @@ if(intval($_REQUEST['userid']) > 0) { <? } - // list of domains domains + // list of domains $dres=get_domains(intval($row['id'])); if(mysql_num_rows($dres) > 0) { ?> @@ -942,7 +942,7 @@ if(intval($_REQUEST['userid']) > 0) { <input type="hidden" name="oldid" value="43"> <input type="hidden" name="userid" value="<?=intval($userid)?>"> <input type="submit" value="<?=_('revoke certificates')?>"> - <input type="hidden" name="ticketno" value="<?=$ticketno?>"/> + <input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/> </form> </td> </tr> @@ -952,14 +952,14 @@ if(intval($_REQUEST['userid']) > 0) { <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> <tr> <td class="DataTD"> - <a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredto&ticketno=<?=$ticketno?>"><?=_("Show Assurances the user got")?></a> - (<a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredto15&ticketno=<?=$ticketno?>"><?=_("New calculation")?></a>) + <a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredto&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Assurances the user got")?></a> + (<a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredto15&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("New calculation")?></a>) </td> </tr> <tr> <td class="DataTD"> - <a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredby&ticketno=<?=$ticketno?>"><?=_("Show Assurances the user gave")?></a> - (<a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredby15&ticketno=<?=$ticketno?>"><?=_("New calculation")?></a>) + <a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredby&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Assurances the user gave")?></a> + (<a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredby15&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("New calculation")?></a>) </td> </tr> </table> @@ -999,7 +999,7 @@ if(intval($_REQUEST['userid']) > 0) { <td class="DataTD"><?=intval($drow['points'])?></td> <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td> <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td> - <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['to'])?>&assurance=<?=intval($drow['id'])?>&csrf=<?=make_csrf('admdelassurance')?>&ticketno=<?=$ticketno?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),$drow['id'])?>');"><?=_("Revoke")?></a></td> + <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['to'])?>&assurance=<?=intval($drow['id'])?>&csrf=<?=make_csrf('admdelassurance')?>&ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),$drow['id'])?>');"><?=_("Revoke")?></a></td> </tr> <? } @@ -1046,7 +1046,7 @@ if(intval($_REQUEST['userid']) > 0) { <td class="DataTD"><?=$drow['points']?></td> <td class="DataTD"><?=$drow['location']?></td> <td class="DataTD"><?=$drow['method']?></td> - <td class="DataTD"><a href="account.php?id=43&userid=<?=$drow['from']?>&assurance=<?=$drow['id']?>&csrf=<?=make_csrf('admdelassurance')?>&ticketno=<?=$ticketno?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),$drow['id'])?>');"><?=_("Revoke")?></a></td> + <td class="DataTD"><a href="account.php?id=43&userid=<?=$drow['from']?>&assurance=<?=$drow['id']?>&csrf=<?=make_csrf('admdelassurance')?>&ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),$drow['id'])?>');"><?=_("Revoke")?></a></td> </tr> <? } diff --git a/pages/account/44.php b/pages/account/44.php index dd0f376..a26ab0f 100644 --- a/pages/account/44.php +++ b/pages/account/44.php @@ -45,5 +45,5 @@ if (!valid_ticket_number($ticketno)) { </table> <input type="hidden" name="userid" value="<?=intval($_REQUEST['userid'])?>"> <input type="hidden" name="oldid" value="<?=$id?>"> -<input type="hidden" name="ticketno" value="<?=$ticketno?>"/> +<input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/> </form> |