Show
Ignore:
Timestamp:
08/04/06 23:54:03 (7 years ago)
Author:
gregmac
Message:

Prevent possible XSS vulnerability

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • modules/branches/2.1/irc/page.irc.php

    r2221 r2222  
    123123<applet name="PJirc" codebase="modules/irc/pjirc/" code="IRCApplet.class" archive="irc.jar,pixx.jar" width="640" height="400"> 
    124124<param name="CABINETS" value="irc.cab,securedirc.cab,pixx.cab"> 
    125 <param name="nick" value="<?php echo (!empty($_GET['nick']) ? $_GET['nick'] : 'FreePBX????') ?>"> 
     125<?php 
     126if (isset($_GET['nick'])) { 
     127  // prevent XSS and other issues 
     128  $nick = preg_replace('/[^a-zA-Z0-9_\-!]/','',$_GET['nick']); 
     129} else { 
     130  $nick = ''; 
     131} 
     132?> 
     133<param name="nick" value="<?php echo (!empty($nick) ? $nick : 'FreePBX????') ?>"> 
    126134<param name="alternatenick" value="FreePBXU????"> 
    127135<param name="host" value="irc.freenode.net">