diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2017-08-22 19:12:30 +0000 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2017-08-22 19:13:09 +0000 |
| commit | 2a7e0c300ac71332790060bc7b2595db5500ce7c (patch) | |
| tree | c960e92ad01e72535b74ca8872ca80253aec5ff7 /community/phpldapadmin/CVE-2017-11107.patch | |
| parent | ed4928be16220a4713c4a6ae89593c5e37b62f03 (diff) | |
| download | aports-2a7e0c300ac71332790060bc7b2595db5500ce7c.tar.bz2 aports-2a7e0c300ac71332790060bc7b2595db5500ce7c.tar.xz | |
main/phpldapadmin: secfix for CVE-2017-11107
fixes #7510
Diffstat (limited to 'community/phpldapadmin/CVE-2017-11107.patch')
| -rw-r--r-- | community/phpldapadmin/CVE-2017-11107.patch | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/community/phpldapadmin/CVE-2017-11107.patch b/community/phpldapadmin/CVE-2017-11107.patch new file mode 100644 index 0000000000..f161d0e46a --- /dev/null +++ b/community/phpldapadmin/CVE-2017-11107.patch @@ -0,0 +1,31 @@ +Description: Fix multiple Cross-Site Scripting vulnerabilities in file htdocs/entry_chooser.php. +Author: Ismail Belkacim <xd4rker@gmail.com> +Bug-Ubuntu: https://bugs.launchpad.net/bugs/1701731 +--- +This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ +Index: phpldapadmin-1.2.2/htdocs/entry_chooser.php +=================================================================== +--- phpldapadmin-1.2.2.orig/htdocs/entry_chooser.php ++++ phpldapadmin-1.2.2/htdocs/entry_chooser.php +@@ -15,9 +15,9 @@ $www['page'] = new page(); + + $request = array(); + $request['container'] = get_request('container','GET'); +-$request['form'] = get_request('form','GET'); +-$request['element'] = get_request('element','GET'); +-$request['rdn'] = get_request('rdn','GET'); ++$request['form'] = htmlspecialchars(addslashes(get_request('form','GET'))); ++$request['element'] = htmlspecialchars(addslashes(get_request('element','GET'))); ++$request['rdn'] = htmlspecialchars(addslashes(get_request('rdn','GET'))); + + echo '<div class="popup">'; + printf('<h3 class="subtitle">%s</h3>',_('Entry Chooser')); +@@ -33,7 +33,7 @@ echo '</script>'; + echo '<table class="forminput" width="100%" border="0">'; + if ($request['container']) { + printf('<tr><td class="heading" colspan="3">%s:</td><td>%s</td></tr>',_('Server'),$app['server']->getName()); +- printf('<tr><td class="heading" colspan="3">%s:</td><td>%s</td></tr>',_('Looking in'),$request['container']); ++ printf('<tr><td class="heading" colspan="3">%s:</td><td>%s</td></tr>',_('Looking in'),htmlspecialchars($request['container'])); + echo '<tr><td class="blank" colspan="4"> </td></tr>'; + } + |