diff options
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/standard/info.c | 36 |
2 files changed, 18 insertions, 19 deletions
@@ -1,6 +1,7 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Mar 2006, PHP 5.1.3RC2 +- Fixed XSS inside phpinfo() with long inputs. (Ilia) - Check 2nd parameter of tempnam() against path components. (Ilia) - Fixed Apache2 SAPIs header handler modifying header strings. (Mike) - Allowed 'auto_globals_jit' work together with 'register_argc_argv'. (Dmitry) diff --git a/ext/standard/info.c b/ext/standard/info.c index e99a6145d6..840d357c8b 100644 --- a/ext/standard/info.c +++ b/ext/standard/info.c @@ -58,6 +58,21 @@ ZEND_EXTERN_MODULE_GLOBALS(iconv) PHPAPI extern char *php_ini_opened_path; PHPAPI extern char *php_ini_scanned_files; + +static int php_info_write_wrapper(const char *str, uint str_length) +{ + TSRMLS_FETCH(); + + int new_len, written; + char *elem_esc = php_escape_html_entities((char *)str, str_length, &new_len, 0, ENT_QUOTES, NULL TSRMLS_CC); + + written = php_body_write(elem_esc, new_len TSRMLS_CC); + + efree(elem_esc); + + return written; +} + /* {{{ _display_module_info */ @@ -135,30 +150,13 @@ static void php_print_gpcse_array(char *name, uint name_length TSRMLS_DC) PUTS(" => "); } if (Z_TYPE_PP(tmp) == IS_ARRAY) { - zval *tmp3; - - MAKE_STD_ZVAL(tmp3); - if (!sapi_module.phpinfo_as_text) { PUTS("<pre>"); - } - php_start_ob_buffer(NULL, 4096, 1 TSRMLS_CC); - - zend_print_zval_r(*tmp, 0 TSRMLS_CC); - - php_ob_get_buffer(tmp3 TSRMLS_CC); - php_end_ob_buffer(0, 0 TSRMLS_CC); - - if (!sapi_module.phpinfo_as_text) { - elem_esc = php_info_html_esc(Z_STRVAL_P(tmp3) TSRMLS_CC); - PUTS(elem_esc); - efree(elem_esc); + zend_print_zval_ex((zend_write_func_t) php_info_write_wrapper, *tmp, 0 TSRMLS_CC); PUTS("</pre>"); } else { - PUTS(Z_STRVAL_P(tmp3)); + zend_print_zval_r(*tmp, 0 TSRMLS_CC); } - zval_ptr_dtor(&tmp3); - } else if (Z_TYPE_PP(tmp) != IS_STRING) { tmp2 = **tmp; zval_copy_ctor(&tmp2); |