Wikka: Wikka Mod 026

Wikka Mod 026

Type: Bug Fix

Credit:

Joe Delaney∞
http://www.rci.rutgers.edu/~jpd/wakka/SomeChanges∞ (archived)

Double Double-quote insecurity

It was possible to insert xhtml or other escaped code using double double-quotes. This has been stopped by changing
formatters/wakka.php line to use htmlspecialchars.

More changes along this line might be necessary, with htmlspecialchars() being used or (url encoding) any time text is passed straight through the formatter (urls into a link, for example).

Change:
return $matches[1];
to
return htmlspecialchars($matches[1]);

formatters/wakka.php

// escaped text
else if (preg_match("/^\"\"(.*)\"\"$/s", $thing, $matches))
{
return htmlspecialchars($matches[1]);
}

Wikka : Mod026bDoubleDoubleQuoteInsecurity

Wikka Mod 026

Credit:

Double Double-quote insecurity