diff options
| author | Marc Alexander <admin@m-a-styles.de> | 2014-11-03 17:14:18 +0100 |
|---|---|---|
| committer | Marc Alexander <admin@m-a-styles.de> | 2014-11-03 17:27:01 +0100 |
| commit | 13b59af1ffd0af652ba0ce3bc3f2594fc448fdb5 (patch) | |
| tree | e9b81e6fce3e55ad107081e6450440bedcbd443c /phpBB/phpbb/symfony_request.php | |
| parent | 6fd092b5df6f96530fec8ba1aec426b6d59b822b (diff) | |
| download | forums-13b59af1ffd0af652ba0ce3bc3f2594fc448fdb5.tar forums-13b59af1ffd0af652ba0ce3bc3f2594fc448fdb5.tar.gz forums-13b59af1ffd0af652ba0ce3bc3f2594fc448fdb5.tar.bz2 forums-13b59af1ffd0af652ba0ce3bc3f2594fc448fdb5.tar.xz forums-13b59af1ffd0af652ba0ce3bc3f2594fc448fdb5.zip | |
[ticket/13280] Add additional sanitizer for ampersands in server superglobal
PHPBB3-13280
Diffstat (limited to 'phpBB/phpbb/symfony_request.php')
| -rw-r--r-- | phpBB/phpbb/symfony_request.php | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/phpBB/phpbb/symfony_request.php b/phpBB/phpbb/symfony_request.php index ad949a35f2..4d357a5c56 100644 --- a/phpBB/phpbb/symfony_request.php +++ b/phpBB/phpbb/symfony_request.php @@ -30,6 +30,11 @@ class symfony_request extends Request $type_cast_helper->set_var($value, $value, gettype($value), true); }; + // This function is meant for additional handling of server variables + $server_sanitizer = function(&$value, $key) { + $value = str_replace('&', '&', $value); + }; + $get_parameters = $phpbb_request->get_super_global(\phpbb\request\request_interface::GET); $post_parameters = $phpbb_request->get_super_global(\phpbb\request\request_interface::POST); $server_parameters = $phpbb_request->get_super_global(\phpbb\request\request_interface::SERVER); @@ -41,6 +46,7 @@ class symfony_request extends Request array_walk_recursive($server_parameters, $sanitizer); array_walk_recursive($files_parameters, $sanitizer); array_walk_recursive($cookie_parameters, $sanitizer); + array_walk_recursive($server_parameters, $server_sanitizer); parent::__construct($get_parameters, $post_parameters, array(), $cookie_parameters, $files_parameters, $server_parameters); } |