Changeset 1433

Timestamp:

12/07/09 13:35:05 (2 years ago)

Author:

benoitg

Message:

Security fix: Fix #674

Location:

trunk/wifidog-auth/wifidog

Files:

• classes/NodeList.php (modified) (1 diff)
• include/language.php (modified) (1 diff)

trunk/wifidog-auth/wifidog/classes/NodeList.php

@@ -78 +78 @@
             require_once(NODE_LIST_CLASSES_DIR . "/NodeList" . $nodeListType . ".php");
         } else {
-            throw new Exception(_("The node list type '$nodeListType' is not supported!"));
+            throw new Exception(sprintf(_("The node list type '%s' is not supported!"), htmlspecialchars($nodeListType)));
         }
 

trunk/wifidog-auth/wifidog/include/language.php

@@ -50 +50 @@
         $session = Session::getObject();
             //echo "Setting to $_REQUEST[wifidog_language]<br/>";
-        $session->set(SESS_LANGUAGE_VAR, $_REQUEST['wifidog_language']);
+        $AVAIL_LOCALE_ARRAY = LocaleList::getAvailableLanguageArray();
+        /* Try to guess the lang */
+        if (!empty($AVAIL_LOCALE_ARRAY[$_REQUEST['wifidog_language']])) {
+            $session->set(SESS_LANGUAGE_VAR, $_REQUEST['wifidog_language']);
+        }
+        else {
+            throw new Exception(htmlspecialchars($_REQUEST['wifidog_language'])." is not a valid locale");
+        }
 }