From: kmorimatsu Date: Sat, 5 Mar 2011 21:26:34 +0000 (+0000) Subject: Security fix against XSS attack to createaccount.php on registerglobals=ON environment. X-Git-Tag: release-3-64~46 X-Git-Url: http://git.sourceforge.jp/view?p=nucleus-jp%2Fnucleus-jp-ancient.git;a=commitdiff_plain;h=fff20738f0726dee1a6c18ae9f6b2fed7fbfc0ae Security fix against XSS attack to createaccount.php on registerglobals=ON environment. git-svn-id: https://svn.sourceforge.jp/svnroot/nucleus-jp/nucleus-jp/trunk@1149 1ca29b6e-896d-4ea0-84a5-967f57386b96 --- diff --git a/utf8/createaccount.php b/utf8/createaccount.php index afae4e3..00af4a1 100644 --- a/utf8/createaccount.php +++ b/utf8/createaccount.php @@ -22,45 +22,32 @@ require_once "./config.php"; //include $DIR_LIBS."ACTION.php"; include_libs('ACTION.php',false,false); -if (isset ($_POST['showform'])&&$_POST['showform']==1) { - $showform = 1; -} -else { - $showform = 0; -} +sendContentType('text/html', 'createaccount', _CHARSET); + ?> > - - - <?php echo _CREATE_ACCOUNT_TITLE ?> - - - + + + <?php echo _CREATE_ACCOUNT_TITLE; ?> + + +

' . htmlspecialchars($a->createAccount()) . '

'; - if (isset($_POST['name'])) - $name = 'value="' . htmlspecialchars($_POST['name']) . '" '; - if (isset($_POST['realname'])) - $realname = 'value="' . htmlspecialchars($_POST['realname']) . '" '; - if (isset($_POST['email'])) - $email = 'value="' . htmlspecialchars($_POST['email']) . '" '; - if (isset($_POST['url'])) - $url = 'value="' . htmlspecialchars($_POST['url']) . '" '; -// $showform = 1; -// } else { -// $showform = 0; - echo $message; + $message = $a->createAccount(); + + echo ''.$message.'

'; } ?>
@@ -69,46 +56,37 @@ if ($CONF['AllowMemberCreate']==1) {
- /> +


- /> +


- /> +


- /> +
- 'createaccount.php', - 'prelabel' => '', - 'postlabel' => '
', - 'prefield' => '', - 'postfield' => '

' - ); - $manager->notify('RegistrationFormExtraFields', $data); + $manager->notify('RegistrationFormExtraFields', array('type' => 'createaccount.php', 'prelabel' => '', 'postlabel' => '
', 'prefield' => '', 'postfield' => '

')); // add a Captcha challenge or something else $manager->notify('FormExtra', array('type' => 'membermailform-notloggedin')); -?> -
-
- - -
+ ?> +
+
+ + + +