diff options
| author | Nils Adermann <naderman@naderman.de> | 2014-11-16 16:50:15 +0100 |
|---|---|---|
| committer | Nils Adermann <naderman@naderman.de> | 2014-11-16 16:50:15 +0100 |
| commit | 4ffdb129388d72cdcc790f1c3713e3770d8aeca9 (patch) | |
| tree | 21782b0a29593cc789b8e206eb0624aaf3febdd0 /phpBB/phpbb/path_helper.php | |
| parent | e27b69f42a4d23ceb2f19050366a3f7d91887c69 (diff) | |
| parent | 0dfe1d0d8b007ec7b7cae0715cfb2e5f4e33bad4 (diff) | |
| download | forums-4ffdb129388d72cdcc790f1c3713e3770d8aeca9.tar forums-4ffdb129388d72cdcc790f1c3713e3770d8aeca9.tar.gz forums-4ffdb129388d72cdcc790f1c3713e3770d8aeca9.tar.bz2 forums-4ffdb129388d72cdcc790f1c3713e3770d8aeca9.tar.xz forums-4ffdb129388d72cdcc790f1c3713e3770d8aeca9.zip | |
Merge remote-tracking branch 'github-nicofuma/ticket/13280' into develop-ascraeus
* github-nicofuma/ticket/13280:
[ticket/13280] Output escaping for the symfony request object
[ticket/13280] Add new tests
[ticket/13280] Make the tests failing
[ticket/13280] Revert "Merge pull request #3107 from marc1706/ticket/13280"
Diffstat (limited to 'phpBB/phpbb/path_helper.php')
| -rw-r--r-- | phpBB/phpbb/path_helper.php | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/phpBB/phpbb/path_helper.php b/phpBB/phpbb/path_helper.php index 936564d8b6..4a446a5d9d 100644 --- a/phpBB/phpbb/path_helper.php +++ b/phpBB/phpbb/path_helper.php @@ -154,6 +154,7 @@ class path_helper return $this->web_root_path; } + // We do not need to escape $path_info, $request_uri and $script_name because we can not find their content in the result. // Path info (e.g. /foo/bar) $path_info = $this->filesystem->clean_path($this->symfony_request->getPathInfo()); @@ -203,9 +204,12 @@ class path_helper */ if ($this->request->is_ajax() && $this->symfony_request->get('_referer')) { + // We need to escape $absolute_board_url because it can be partially concatenated to the result. + $absolute_board_url = $this->request->escape($this->symfony_request->getSchemeAndHttpHost() . $this->symfony_request->getBasePath(), true); + $referer_web_root_path = $this->get_web_root_path_from_ajax_referer( $this->symfony_request->get('_referer'), - $this->symfony_request->getSchemeAndHttpHost() . $this->symfony_request->getBasePath() + $absolute_board_url ); return $this->web_root_path = $this->phpbb_root_path . $referer_web_root_path; } |