diff options
| -rw-r--r-- | phpBB/phpbb/session.php | 6 | ||||
| -rw-r--r-- | tests/security/extract_current_page_test.php | 23 |
2 files changed, 18 insertions, 11 deletions
diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php index 14b4c63207..a06ff9c594 100644 --- a/phpBB/phpbb/session.php +++ b/phpBB/phpbb/session.php @@ -43,7 +43,7 @@ class session // First of all, get the request uri... $script_name = $symfony_request->getScriptName(); - $args = explode('&', $symfony_request->getQueryString()); + $args = explode('&', $symfony_request->getQueryString()); // If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support... if (!$script_name) @@ -61,8 +61,8 @@ class session // Since some browser do not encode correctly we need to do this with some "special" characters... // " -> %22, ' => %27, < -> %3C, > -> %3E - $find = array('"', "'", '<', '>'); - $replace = array('%22', '%27', '%3C', '%3E'); + $find = array('"', "'", '<', '>', '"', '<', '>'); + $replace = array('%22', '%27', '%3C', '%3E', '%22', '%3C', '%3E'); foreach ($args as $key => $argument) { diff --git a/tests/security/extract_current_page_test.php b/tests/security/extract_current_page_test.php index 58dea68dc8..8e536ee461 100644 --- a/tests/security/extract_current_page_test.php +++ b/tests/security/extract_current_page_test.php @@ -37,16 +37,16 @@ class phpbb_security_extract_current_page_test extends phpbb_security_test_base )); $symfony_request->expects($this->any()) ->method('getScriptName') - ->will($this->returnValue($url)); + ->will($this->returnValue($this->sanitizer($url))); $symfony_request->expects($this->any()) ->method('getQueryString') - ->will($this->returnValue($query_string)); + ->will($this->returnValue($this->sanitizer($query_string))); $symfony_request->expects($this->any()) ->method('getBasePath') ->will($this->returnValue($server['REQUEST_URI'])); - $symfony_request->expects($this->any()) + $symfony_request->expects($this->sanitizer($this->any())) ->method('getPathInfo') - ->will($this->returnValue('/')); + ->will($this->returnValue($this->sanitizer('/'))); $result = \phpbb\session::extract_current_page('./'); $label = 'Running extract_current_page on ' . $query_string . ' with PHP_SELF filled.'; @@ -65,20 +65,27 @@ class phpbb_security_extract_current_page_test extends phpbb_security_test_base )); $symfony_request->expects($this->any()) ->method('getScriptName') - ->will($this->returnValue($url)); + ->will($this->returnValue($this->sanitizer($url))); $symfony_request->expects($this->any()) ->method('getQueryString') - ->will($this->returnValue($query_string)); + ->will($this->returnValue($this->sanitizer($query_string))); $symfony_request->expects($this->any()) ->method('getBasePath') - ->will($this->returnValue($server['REQUEST_URI'])); + ->will($this->returnValue($this->sanitizer($server['REQUEST_URI']))); $symfony_request->expects($this->any()) ->method('getPathInfo') - ->will($this->returnValue('/')); + ->will($this->returnValue($this->sanitizer('/'))); $result = \phpbb\session::extract_current_page('./'); $label = 'Running extract_current_page on ' . $query_string . ' with REQUEST_URI filled.'; $this->assertEquals($expected, $result['query_string'], $label); } + + protected function sanitizer($value) + { + $type_cast_helper = new \phpbb\request\type_cast_helper(); + $type_cast_helper->set_var($value, $value, gettype($value), true); + return $value; + } } |