From 19e509d997494f7c5c3688de844f2f1ba7c85696 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Thu, 7 Jun 2018 22:45:07 +0200 Subject: escape query string (cherry picked from commit b3928f3d2a7c4c77df5ceba6fc29cbfcbe067dff) --- boot.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'boot.php') diff --git a/boot.php b/boot.php index 2bcea4436..719f6dde4 100755 --- a/boot.php +++ b/boot.php @@ -875,13 +875,13 @@ class App { set_include_path("include/self::$hostname" . PATH_SEPARATOR . get_include_path()); if((x($_SERVER,'QUERY_STRING')) && substr($_SERVER['QUERY_STRING'], 0, 2) === "q=") { - self::$query_string = substr($_SERVER['QUERY_STRING'], 2); + self::$query_string = escape_tags(substr($_SERVER['QUERY_STRING'], 2)); // removing trailing / - maybe a nginx problem if (substr(self::$query_string, 0, 1) == "/") self::$query_string = substr(self::$query_string, 1); } if(x($_GET,'q')) - self::$cmd = trim($_GET['q'],'/\\'); + self::$cmd = escape_tags(trim($_GET['q'],'/\\')); // unix style "homedir" -- cgit v1.2.3