library-mirrors/jquery
1
0
Fork 0
mirror of https://github.com/jquery/jquery.git synced 2024-10-05 11:34:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix #12554. Sanitize data from POST. Close gh-908.

Browse Source
This commit is contained in:
Markus Staab 2012-09-09 22:00:53 -04:00 committed by Dave Methvin
parent 5fb258b895
commit b62e552291
2 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
AUTHORS.txt
View File

@ -131,4 +131,5 @@ Chris Faulkner <thefaulkner@gmail.com>
Elijah Manor <elijah.manor@gmail.com>
Daniel Chatfield <chatfielddaniel@googlemail.com>
Nikita Govorov <nikita.govorov@gmail.com>
Mike Pennisi <mike@mikepennisi.com>
Mike Pennisi <mike@mikepennisi.com>
Markus Staab <markus.staab@redaxo.de>

15
test/polluted.php
View File

@ -42,11 +42,22 @@
if( count($_POST) ) {
$includes = array();
foreach( $_POST as $name => $ver ){
if ( empty( $libraries[ $name ] )) {
echo "unsupported library ". $name;
exit;
}
$url = $libraries[ $name ][ "url" ];
if( $name == "YUI" && $ver[0] == "2" ) {
$url = str_replace( "/yui", "/yuiloader", $url, $count = 2 );
$url = str_replace( "/yui", "/yuiloader", $url);
}
$include = "<script src='$baseURL".str_replace("XYZ", $ver, $url, $count = 1)."'></script>\n";
if ( empty( $libraries[ $name ][ "versions" ][ $ver ] )) {
echo "library ". $name ." not supported in version ". $ver;
exit;
}
$include = "<script src='$baseURL".str_replace("XYZ", $ver, $url)."'></script>\n";
if( $lib == "prototype" ) { // prototype must be included first
array_unshift( $includes, $include );
} else {