ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixes in PHP scripts for XSS minor security issues.

Browse Source 
git-svn-id: svn://192.168.202.10@3455 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-06-16 00:26:02 +00:00
parent d4bd530333
commit e87b6452f2
179 changed files with 200 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/vdc_email_display.php
+4 -2
View File
@@ -62,6 +62,8 @@ if (isset($_GET["REPLY"])) {$REPLY=$_GET["REPLY"];}
if (isset($_GET["agent_email"])) {$agent_email=$_GET["agent_email"];}
elseif (isset($_POST["agent_email"])) {$agent_email=$_POST["agent_email"];}
$PHP_SELF=$_SERVER['PHP_SELF'];
$PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
$attachment1=$_FILES["attachment1"];
$A1_orig = $_FILES['attachment1']['name'];
@@ -297,7 +299,7 @@ if ( ($lead_id) or (strlen($email_row_id)>0) )
if (mysqli_num_rows($att_rslt)>0) {
$EMAIL_form.="<tr bgcolor=white><td align='right' valign='top' width='150'>"._QXZ("Attachments:")."</td><td align='left' valign='top' width='*'><pre>";
while($att_row=mysqli_fetch_array($att_rslt)) {
$EMAIL_form.="<LI><a href='$_SERVER[PHP_SELF]?attachment_id=$att_row[attachment_id]&lead_id=$lead_id&user=$user&pass=$pass'>$att_row[filename]</a>\n";
$EMAIL_form.="<LI><a href='$PHP_SELF?attachment_id=$att_row[attachment_id]&lead_id=$lead_id&user=$user&pass=$pass'>$att_row[filename]</a>\n";
}
$EMAIL_form.="</pre></td></tr>";
}
@@ -397,7 +399,7 @@ if ( ($lead_id) or (strlen($email_row_id)>0) )
pre { white-space: pre-wrap; }
</style>
<body>
<form action='<?php echo $_SERVER['PHP_SELF']; ?>' method='post' name="email_display_form" id="email_display_form" onSubmit="if (this.submitted) return false; this.submitted=true" enctype="multipart/form-data">
<form action='<?php echo $PHP_SELF ?>' method='post' name="email_display_form" id="email_display_form" onSubmit="if (this.submitted) return false; this.submitted=true" enctype="multipart/form-data">
<?php echo $EMAIL_form; ?>
</form>
</body>