Fix XSS vulnerabilities

git-svn-id: svn://sql.mit.edu/sql@191 a142d4bd-2cfb-0310-9673-cb33a7e74f58

diff --git a/lib/proc.lib.php b/lib/proc.lib.php
index 865d49805ed95cb059a75f9911015cb1d4e6f4ee..2a07094d49ca807f2ae7d35736244611a1c93b75 100644 (file)
--- a/lib/proc.lib.php
+++ b/lib/proc.lib.php
@@ -27,7 +27,7 @@ class proc {
                                $err1[] = 'Database already exists.';
                        }
                } else {
-                       $msg1[] = 'Database `'.$dbname.'` created.';
+                       $msg1[] = 'Database `'.htmlentities($dbname).'` created.';
                }
                $i_newdb = $dbname;
                return array($msg1, $err1);
@@ -37,7 +37,7 @@ class proc {
                $dropdbs = array_keys($i_drop);
                foreach($dropdbs as $dbname) {
                        if ($User->delDB($dbname)) {
-                               $msg1[] = 'Database `'.$dbname.'` dropped.';
+                               $msg1[] = 'Database `'.htmlentities($dbname).'` dropped.';
                        } else {
                                $err1[] = mysql_error();
                        }

diff --git a/tpl/main.php b/tpl/main.php
index aa02cefc31649ad9af3bb123c088a7c243a2b7e6..89b0432de92fe5ce0030d1d053130558d8e0ac60 100644 (file)
--- a/tpl/main.php
+++ b/tpl/main.php
@@ -6,7 +6,7 @@ if (isset($i_dropask)) {
        $dropdbs = array_keys($i_dropask);
        echo '<form method="post" action="', $URI,'">';
        foreach($dropdbs as $dbname) {
-               $msg1[] = 'Are you sure you want to drop `'.$dbname.'`? <input style="position:absolute; right:20px;" type="submit" name="drop['.$dbname.']" value="Yes">';
+               $msg1[] = 'Are you sure you want to drop `'.htmlentities($dbname).'`? <input style="position:absolute; right:20px;" type="submit" name="drop['.htmlentities($dbname).']" value="Yes">';
        }
        echo '</form>';
 }
@@ -35,7 +35,7 @@ if (isset($i_dropask)) {
                else $percentage = 0;
                echo printBar($percentage, $db['Name'], str_replace(' ', '&nbsp;', sprintSize($db['nBytes'])));
                echo '</td><td>';
-               echo '<input type="submit" name="dropask[',$db['Name'],']" value="drop">';
+               echo '<input type="submit" name="dropask[',htmlentities($db['Name']),']" value="drop">';
                echo '</td></tr>';
        }
        if ($total>0) {