Changeset 1739

Timestamp:

11/27/06 19:58:53 (6 years ago)

Author:

nahuel

Message:

Correction de l'affichage des noms de fichiers/repertoires qui permettait d'executer du code Javascript dans le brouteur

File:

• alternc/trunk/bureau/admin/bro_main.php (modified) (12 diffs)

alternc/trunk/bureau/admin/bro_main.php

@@ -192 +192 @@
 echo "<td><a href=\"";
 echo "bro_editor.php?file=".urlencode($c[$i]["name"])."&amp;R=".urlencode($R);
-echo "\">".$c[$i]["name"]."</a></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."</a></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td>";
 echo "<td>".format_date('%3$d-%2$d-%1$d %4$d:%5$d',date("Y-m-d H:i:s",$c[$i]["date"]))."<br /></td>";
@@ -212 +212 @@
 echo "<td><b><a href=\"";
 echo "bro_main.php?R=".urlencode($R."/".$c[$i]["name"]);
-echo "\">".$c[$i]["name"]."/</a></b></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."/</a></b></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td>";
 echo "<td>".format_date('%3$d-%2$d-%1$d %4$d:%5$d',date("Y-m-d h:i:s",$c[$i]["date"]))."<br /></td>";
@@ -239 +239 @@
 echo "  <td width=\"28\"><input type=\"checkbox\" class=\"inc\" name=\"d[]\" value=\"".$c[$i]["name"]."\" /></td><td><a href=\"";
 echo "bro_editor.php?file=".urlencode($c[$i]["name"])."&amp;R=".urlencode($R);
-echo "\">".$c[$i]["name"]."</a></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."</a></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 $vu=$bro->viewurl($R,$c[$i]["name"]);
@@ -251 +251 @@
 echo "  <td width=\"28\"><input TYPE=checkbox class=\"inc\" name=\"d[]\" value=\"".$c[$i]["name"]."\"></td><td><b><a href=\"";
 echo "bro_main.php?R=".urlencode($R."/".$c[$i]["name"]);
-echo "\">".$c[$i]["name"]."/</a></b></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."/</a></b></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 echo "&nbsp;";
@@ -269 +269 @@
 echo "  <td width=\"28\"><input TYPE=checkbox class=\"inc\" name=\"d[]\" value=\"".$c[$i]["name"]."\"></td><td><a href=\"";
 echo "bro_editor.php?file=".urlencode($c[$i]["name"])."&amp;R=".urlencode($R);
-echo "\">".$c[$i]["name"]."</a></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."</a></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 $vu=$bro->viewurl($R,$c[$i]["name"]);
@@ -281 +281 @@
 echo "  <td width=\"28\"><input TYPE=checkbox class=\"inc\" name=\"d[]\" value=\"".$c[$i]["name"]."\"></td><td><b><a href=\"";
 echo "bro_main.php?R=".urlencode($R."/".$c[$i]["name"]);
-echo "\">".$c[$i]["name"]."/</a></b></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."/</a></b></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 echo "&nbsp;";
@@ -306 +306 @@
 echo "  <td width=\"28\"><input TYPE=checkbox class=\"inc\" name=\"d[]\" value=\"".$c[$i]["name"]."\"></td><td><a href=\"";
 echo "bro_editor.php?file=".urlencode($c[$i]["name"])."&amp;R=".urlencode($R);
-echo "\">".$c[$i]["name"]."</a></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."</a></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 $vu=$bro->viewurl($R,$c[$i]["name"]);
@@ -318 +318 @@
 echo "  <td width=\"28\"><input TYPE=checkbox class=\"inc\" name=\"d[]\" value=\"".$c[$i]["name"]."\"></td><td><b><a href=\"";
 echo "bro_main.php?R=".urlencode($R."/".$c[$i]["name"]);
-echo "\">".$c[$i]["name"]."/</a></b></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."/</a></b></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 echo "&nbsp;";
@@ -336 +336 @@
 echo "  <td width=\"28\"><input TYPE=checkbox class=\"inc\" name=\"d[]\" value=\"".$c[$i]["name"]."\"></td><td><a href=\"";
 echo "bro_editor.php?file=".urlencode($c[$i]["name"])."&amp;R=".urlencode($R);
-echo "\">".$c[$i]["name"]."</a></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."</a></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 $vu=$bro->viewurl($R,$c[$i]["name"]);
@@ -349 +349 @@
 echo "  <td width=\"28\"><input TYPE=checkbox class=\"inc\" name=\"d[]\" value=\"".$c[$i]["name"]."\"></td><td><b><a href=\"";
 echo "bro_main.php?R=".urlencode($R."/".$c[$i]["name"]);
-echo "\">".$c[$i]["name"]."/</a></b></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."/</a></b></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 echo "&nbsp;";
@@ -367 +367 @@
 echo "  <td width=\"28\"><input TYPE=checkbox class=\"inc\" name=\"d[]\" value=\"".$c[$i]["name"]."\"></td><td><a href=\"";
 echo "bro_editor.php?file=".urlencode($c[$i]["name"])."&amp;R=".urlencode($R);
-echo "\">".$c[$i]["name"]."</a></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."</a></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 $vu=$bro->viewurl($R,$c[$i]["name"]);
@@ -379 +379 @@
 echo "  <td width=\"28\"><input TYPE=checkbox class=\"inc\"  name=\"d[]\" value=\"".$c[$i]["name"]."\"></td><td><b><a href=\"";
 echo "bro_main.php?R=".urlencode($R."/".$c[$i]["name"]);
-echo "\">".$c[$i]["name"]."/</a></b></td>\n";
+echo "\">".htmlentities($c[$i]["name"])."/</a></b></td>\n";
 echo "  <td>".format_size($c[$i]["size"])."</td><td>";
 echo "&nbsp;";