[#MDL-12793] PARAM_HOST incorrect cleaning - Moodle Tracker

Affected Branches:
MOODLE_16_STABLE, MOODLE_17_STABLE, MOODLE_18_STABLE, MOODLE_19_STABLE
Fixed Branches:
MOODLE_16_STABLE, MOODLE_17_STABLE, MOODLE_18_STABLE, MOODLE_19_STABLE

incorrect use of preg_replace:

case PARAM_HOST: // allow FQDN or IPv4 dotted quad
preg_replace('/[^\.\d\w-]/','', $param ); // only allowed chars
....

Ascending order - Click to sort in descending order

Hide

Permalink

Petr Škoda (skodak) added a comment - 02/Jan/08 2:51 AM

fixed in cvs

Show

Petr Škoda (skodak) added a comment - 02/Jan/08 2:51 AM fixed in cvs

Hide

Permalink

Petr Škoda (skodak) added a comment - 19/Jan/08 2:03 AM

downgrading - no dangerous characters should be able to get through

Show

Petr Škoda (skodak) added a comment - 19/Jan/08 2:03 AM downgrading - no dangerous characters should be able to get through

Vote (0)

Watch (0)