fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-07 02:31:40 +09:00
Code Issues Projects Releases Packages Wiki Activity

fixed XSS security in integration search

Browse source 
git-svn-id: http://xe-core.googlecode.com/svn/branches/1.5.0@9839 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
devjin 2011-11-17 08:32:55 +00:00
parent 75d660bf1a
commit 0dbd9091b0
6 changed files with 36 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

3
modules/integration_search/integration_search.view.php
View file

@ -98,6 +98,9 @@
} else {
$this->setTemplateFile("no_keywords");
}
$security = new Security();
$security->encodeHTML('is_keyword', 'search_target', 'where', 'page');
}
}
?>

8
modules/integration_search/skins/default/document.html
View file

@ -37,17 +37,17 @@
<!--@if($where == 'document' && $output->page_navigation)-->
<div class="pagination a1">
<a href="{getUrl('page','')}" class="prevEnd">{$lang->first_page}</a>
<a href="{getAutoEncodedUrl('page','')}" class="prevEnd">{$lang->first_page}</a>
<!--@while($page_no = $output->page_navigation->getNextPage())-->
<!--@if($page == $page_no)-->
<strong>{$page_no}</strong>
<!--@else-->
<a href="{getUrl('page',$page_no)}">{$page_no}</a>
<a href="{getAutoEncodedUrl('page',$page_no)}">{$page_no}</a>
<!--@end-->
<!--@end-->
<a href="{getUrl('page',$output->page_navigation->last_page)}" <!--@if(!$last_division)-->class="nextEnd"<!--@end-->>{$lang->last_page}</a>
<a href="{getAutoEncodedUrl('page',$output->page_navigation->last_page)}" <!--@if(!$last_division)-->class="nextEnd"<!--@end-->>{$lang->last_page}</a>
<!--@if($last_division)-->
<a href="{getUrl('page',1,'document_srl','','search_target',$search_target,'is_keyword',$is_keyword,'division',$last_division,'last_division','')}" class="nextEnd">{$lang->cmd_search_next}</a>
<a href="{getAutoEncodedUrl('page',1,'document_srl','','search_target',$search_target,'is_keyword',$is_keyword,'division',$last_division,'last_division','')}" class="nextEnd">{$lang->cmd_search_next}</a>
<!--@end-->
</div>
<!--@end-->

14
modules/integration_search/skins/default/header.html
View file

@ -19,17 +19,17 @@
<input type="hidden" name="act" value="IS" />
<input type="hidden" name="where" value="{$where}" />
<input type="hidden" name="search_target" value="title_content" />
<input name="is_keyword" type="text" class="inputText" value="{htmlspecialchars($is_keyword)}"/>
<input name="is_keyword" type="text" class="inputText" value="{$is_keyword}"/>
<span class="button large strong black"><input type="submit" value="{$lang->cmd_search}" /></span>
</form>
</div>
<ul class="localNavigation">
<li <!--@if(!$where)-->class="on"<!--@end-->><a href="{getUrl('where','','page','','division','')}">{$lang->integration_search}</a></li>
<li <!--@if($where=='document')-->class="on"<!--@end-->><a href="{getUrl('where','document','page',1,'division','')}">{$lang->document}</a></li>
<li <!--@if($where=='comment')-->class="on"<!--@end-->><a href="{getUrl('where','comment','page',1,'division','')}">{$lang->comment}</a></li>
<li <!--@if($where=='trackback')-->class="on"<!--@end-->><a href="{getUrl('where','trackback','page',1,'division','')}">{$lang->trackback}</a></li>
<li <!--@if($where=='multimedia')-->class="on"<!--@end-->><a href="{getUrl('where','multimedia','page',1,'division','')}">{$lang->multimedia}</a></li>
<li <!--@if($where=='file')-->class="on"<!--@end-->><a href="{getUrl('where','file','page',1,'division','')}">{$lang->file}</a></li>
<li <!--@if(!$where)-->class="on"<!--@end-->><a href="{getAutoEncodedUrl('where','','page','','division','')}">{$lang->integration_search}</a></li>
<li <!--@if($where=='document')-->class="on"<!--@end-->><a href="{getAutoEncodedUrl('where','document','page',1,'division','')}">{$lang->document}</a></li>
<li <!--@if($where=='comment')-->class="on"<!--@end-->><a href="{getAutoEncodedUrl('where','comment','page',1,'division','')}">{$lang->comment}</a></li>
<li <!--@if($where=='trackback')-->class="on"<!--@end-->><a href="{getAutoEncodedUrl('where','trackback','page',1,'division','')}">{$lang->trackback}</a></li>
<li <!--@if($where=='multimedia')-->class="on"<!--@end-->><a href="{getAutoEncodedUrl('where','multimedia','page',1,'division','')}">{$lang->multimedia}</a></li>
<li <!--@if($where=='file')-->class="on"<!--@end-->><a href="{getAutoEncodedUrl('where','file','page',1,'division','')}">{$lang->file}</a></li>
</ul>
<!--@end-->

10
modules/integration_search/skins/default/index.html
View file

@ -3,30 +3,30 @@
{@ $output = $search_result['document'] }
<!--#include("document.html")-->
<!--@if(count($output->data))-->
<div class="isMore"><a href="{getUrl('where','document','page',1)}">more</a></div>
<div class="isMore"><a href="{getAutoEncodedUrl('where','document','page',1)}">more</a></div>
<!--@end-->
{@ $output = $search_result['comment'] }
<!--#include("comment.html")-->
<!--@if(count($output->data))-->
<div class="isMore"><a href="{getUrl('where','comment','page',1)}">more</a></div>
<div class="isMore"><a href="{getAutoEncodedUrl('where','comment','page',1)}">more</a></div>
<!--@end-->
{@ $output = $search_result['trackback'] }
{@ $search_target = 'title'; }
<!--#include("trackback.html")-->
<!--@if(count($output->data))-->
<div class="isMore"><a href="{getUrl('where','trackback','page',1)}">more</a></div>
<div class="isMore"><a href="{getAutoEncodedUrl('where','trackback','page',1)}">more</a></div>
<!--@end-->
{@ $output = $search_result['multimedia'] }
<!--#include("multimedia.html")-->
<!--@if(count($output->data))-->
<div class="isMore"><a href="{getUrl('where','multimedia','page',1)}">more</a></div>
<div class="isMore"><a href="{getAutoEncodedUrl('where','multimedia','page',1)}">more</a></div>
<!--@end-->
{@ $output = $search_result['file'] }
<!--#include("file.html")-->
<!--@if(count($output->data))-->
<div class="isMore"><a href="{getUrl('where','file','page',1)}">more</a></div>
<div class="isMore"><a href="{getAutoEncodedUrl('where','file','page',1)}">more</a></div>
<!--@end-->