From 9b112a56d0e3c93e062d1382527a27fc44518916 Mon Sep 17 00:00:00 2001
From: Lukas Fleischer <archlinux@cryptocrack.de>
Date: Fri, 11 Mar 2011 19:15:04 +0100
Subject: Fix XSS vulnerability in package search results and package details.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
---
 web/template/pkg_details.php        | 14 +++++++-------
 web/template/pkg_search_results.php |  6 +++---
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php
index 3b96791f..eac7b69b 100644
--- a/web/template/pkg_details.php
+++ b/web/template/pkg_details.php
@@ -29,7 +29,7 @@ else {
 if ($row["SubmitterUID"]) {
 	$submitter = username_from_id($row["SubmitterUID"]);
 	if ($SID) {
-		$submitter = '<a href="account.php?Action=AccountInfo&amp;ID=' . $row['SubmitterUID'] . '">' . $submitter . '</a>';
+		$submitter = '<a href="account.php?Action=AccountInfo&amp;ID=' . htmlspecialchars($row['SubmitterUID'], ENT_QUOTES) . '">' . htmlspecialchars($submitter) . '</a>';
 	}
 
 } else {
@@ -39,7 +39,7 @@ if ($row["SubmitterUID"]) {
 if ($row["MaintainerUID"]) {
 	$maintainer = username_from_id($row["MaintainerUID"]);
 	if ($SID) {
-		$maintainer = '<a href="account.php?Action=AccountInfo&amp;ID=' . $row['MaintainerUID'] . '">' . $maintainer . '</a>';
+		$maintainer = '<a href="account.php?Action=AccountInfo&amp;ID=' . htmlspecialchars($row['MaintainerUID'], ENT_QUOTES) . '">' . htmlspecialchars($maintainer) . '</a>';
 	}
 
 } else {
@@ -66,8 +66,8 @@ $out_of_date_time = ($row["OutOfDateTS"] == 0) ? $msg : gmdate("r", intval($row[
 	<div class="pgboxbody">
 
 	<p>
-	<span class='f2'><?php echo $row['Name'] . ' ' . $row['Version'] ?></span><br />
-	<span class='f3'><a href="<?php echo $row['URL'] . '">' . $row['URL'] ?></a></span><br />
+	<span class='f2'><?php echo htmlspecialchars($row['Name']) . ' ' . htmlspecialchars($row['Version']) ?></span><br />
+	<span class='f3'><a href="<?php echo htmlspecialchars($row['URL'], ENT_QUOTES) . '">' . $row['URL'] ?></a></span><br />
 	<span class='f3'><?php echo htmlspecialchars($row['Description'], ENT_QUOTES); ?></span>
 	</p>
 
@@ -79,7 +79,7 @@ $out_of_date_time = ($row["OutOfDateTS"] == 0) ? $msg : gmdate("r", intval($row[
 	<span class='f3'><?php echo $votes ?></span>
 	</p>
 
-	<p><span class='f3'><?php echo __('License') . ': ' . $license ?></span></p>
+	<p><span class='f3'><?php echo __('License') . ': ' . htmlspecialchars($license) ?></span></p>
 
 	<p>
 	<span class='f3'>
@@ -161,12 +161,12 @@ $out_of_date_time = ($row["OutOfDateTS"] == 0) ? $msg : gmdate("r", intval($row[
 
 			if (isset($parsed_url['scheme']) || isset($src[1])) {
 				# It is an external source
-				echo "<a href=\"" . (isset($src[1]) ? $src[1] : $src[0]) . "\">{$src[0]}</a><br />\n";
+				echo "<a href=\"" . htmlspecialchars((isset($src[1]) ? $src[1] : $src[0]), ENT_QUOTES) . "\">" . htmlspecialchars($src[0]) . "</a><br />\n";
 			}
 			else {
 				$src = $src[0];
 				# It is presumably an internal source
-				echo "<span class='f8'>$src</span>";
+				echo "<span class='f8'>" . htmlspecialchars($src) . "</span>";
 				echo "<br />\n";
 			}
 		}
diff --git a/web/template/pkg_search_results.php b/web/template/pkg_search_results.php
index 40ad029f..d32b6c4a 100644
--- a/web/template/pkg_search_results.php
+++ b/web/template/pkg_search_results.php
@@ -56,8 +56,8 @@ for ($i = 0; $row = mysql_fetch_assoc($result); $i++) {
 	<?php if ($SID): ?>
 	<td class='<?php print $c ?>'><input type='checkbox' name='IDs[<?php print $row["ID"] ?>]' value='1' /></td>
 	<?php endif; ?>
-	<td class='<?php print $c ?>'><span class='f5'><span class='blue'><?php print $row["Category"] ?></span></span></td>
-	<td class='<?php print $c ?>'><span class='f4'><a href='packages.php?ID=<?php print $row["ID"] ?>'><span class='black'><?php print $row["Name"] ?> <?php print $row["Version"] ?></span></a></span></td>
+	<td class='<?php print $c ?>'><span class='f5'><span class='blue'><?php print htmlspecialchars($row["Category"]) ?></span></span></td>
+	<td class='<?php print $c ?>'><span class='f4'><a href='packages.php?ID=<?php print $row["ID"] ?>'><span class='black'><?php print htmlspecialchars($row["Name"]) ?> <?php print htmlspecialchars($row["Version"]) ?></span></a></span></td>
 	<td class='<?php print $c ?>' style="text-align: right"><span class='f5'><span class='blue'><?php print $row["NumVotes"] ?></span></span></td>
 	<?php if ($SID): ?>
 	<td class='<?php print $c ?>'><span class='f5'><span class='blue'>
@@ -77,7 +77,7 @@ for ($i = 0; $row = mysql_fetch_assoc($result); $i++) {
 	<?php print htmlspecialchars($row['Description'], ENT_QUOTES); ?></span></span></td>
 	<td class='<?php print $c ?>'><span class='f5'><span class='blue'>
 	<?php if (isset($row["Maintainer"])): ?>
-	<a href='packages.php?K=<?php print $row['Maintainer'] ?>&amp;SeB=m'><?php print $row['Maintainer'] ?></a>
+	<a href='packages.php?K=<?php print htmlspecialchars($row['Maintainer'], ENT_QUOTES) ?>&amp;SeB=m'><?php print htmlspecialchars($row['Maintainer']) ?></a>
 	<?php else: ?>
 	<span style='color: blue; font-style: italic;'><?php print __("orphan") ?></span>
 	<?php endif; ?>
-- 
cgit v1.2.3-24-g4f1b