[fix]セキュリティ対策のため名前と死因欄はHTML特殊文字をエスケープする

diff --git a/score/killer_ranking.php b/score/killer_ranking.php
index 5d2674d..196c809 100644 (file)
--- a/score/killer_ranking.php
+++ b/score/killer_ranking.php
@@ -6,6 +6,7 @@ ini_set('error_log', 'errors/'.pathinfo(__FILE__, PATHINFO_FILENAME).'.log');
 
 ini_set('zlib.output_compression', 'On');
 
+require_once "common.inc";
 require_once "db_common.inc";
 require_once "web_template.inc";
 
@@ -39,11 +40,12 @@ EOM
 fwrite($fp, "<tboby>\n");
 foreach ($killers as $k) {
     //$freeze = $k['killer_count_freeze'] > 0 ? "(".$k['killer_count_freeze'].")" : "";
+    $killer_name = h($k['killer_name']);
     fwrite($fp, <<<EOM
 <tr>
 <td class="number">{$k['killer_count_total']}</td>
 <td class="number">{$k['killer_count_freeze']}</td>
-<td>{$k['killer_name']}</td>
+<td>$killer_name</td>
 </tr>
 
 EOM

diff --git a/score/score_ranking.php b/score/score_ranking.php
index f69f994..7ad8434 100644 (file)
--- a/score/score_ranking.php
+++ b/score/score_ranking.php
@@ -4,6 +4,7 @@
 ini_set('log_errors', 'On');
 ini_set('error_log', 'errors/'.pathinfo(__FILE__, PATHINFO_FILENAME).'.log');
 
+require_once "common.inc";
 require_once "db_common.inc";
 require_once "dump_file.inc";
 require_once "web_template.inc";
@@ -119,10 +120,9 @@ EOM
         $realms = isset($score['realms_name']) ? "(".$score['realms_name'].")" : "";
         $dumpfile = new DumpFile($score['score_id']);
 
+        $name = h("{$score['personality_name']}{$score['name']}");
         if ($dumpfile->exists('dumps', 'txt')) {
-            $name = "<a href=\"show_dump.php?score_id={$score['score_id']}\">{$score['personality_name']}{$score['name']}</a>";
-        } else {
-            $name = "{$score['personality_name']}{$score['name']}";
+            $name = "<a href=\"show_dump.php?score_id={$score['score_id']}\">{$name}</a>";
         }
         fwrite($fp, <<<EOM
 <tr>
@@ -136,12 +136,13 @@ EOM
 
 EOM
         );
+        $death_reason = h($score['death_reason']);
         if ($dumpfile->exists('screens', 'html')) {
-            fwrite($fp, "<td><a href=\"show_screen.php?score_id={$score['score_id']}\">{$score['death_reason']}</a>");
+            fwrite($fp, "<td><a href=\"show_screen.php?score_id={$score['score_id']}\">{$death_reason}</a>");
         } else {
-            fwrite($fp, "<td>{$score['death_reason']}");
+            fwrite($fp, "<td>{$death_reason}");
         }
-        fwrite($fp, "<br>({$depth}{$score['version']})</td>\n".
+        fwrite($fp, "<br>({$depth}".h($score['version']).")</td>\n".
                "</tr>\n");
     }
     fwrite($fp, "</tbody>\n");