Merge pull request #14 from fiammybe/fix-print-xss

fiammybe · web-flow · commit 30656ba8ad15 · 2021-07-23T14:10:31.000+02:00
Sanitize  topic print
diff --git a/print.php b/print.php
@@ -95,8 +95,14 @@
 }
 else
 {
-	$post_data = unserialize(base64_decode($_POST["post_data"]));
+    $post_data = unserialize(base64_decode($_POST["post_data"]));
+	if (is_array($post_data)) {
+  		foreach ($post_data as $k => $v) {
+     		$post_data[$k] = $myTs->codeSanitizer($v);
+  		}
+    }
 	$isPost = 1;
+
 }
  
 header('Content-Type: text/html; charset='._CHARSET);
@@ -111,7 +117,7 @@
 	echo "<meta name='AUTHOR' content='" . htmlspecialchars($icmsConfig['sitename'], ENT_QUOTES) . "' />\n";
 	echo "<meta name='COPYRIGHT' content='Copyright (c) ".date('Y')." by " . htmlspecialchars($icmsConfig['sitename'], ENT_QUOTES) . "' />\n";
 	echo "<meta name='DESCRIPTION' content='" . htmlspecialchars($icmsConfig['slogan'], ENT_QUOTES) . "' />\n";
-	echo "<meta name='GENERATOR' content='" . XOOPS_VERSION . "' />\n\n\n";
+	echo "<meta name='GENERATOR' content='" . ICMS_VERSION_NAME . "' />\n\n\n";
 	echo "<body bgcolor='#ffffff' text='#000000' onload='window.print()'>
 		<div style='width: 750px; border: 1px solid #000; padding: 20px;'>
 		<div style='text-align: center; display: block; margin: 0 0 6px 0;'>
@@ -161,4 +167,4 @@
 		</div>
 		<br />";
 	echo "<br /></body></html>";
-}
+}
