From e540f8f862339dbb2c24a9680cb5d93d6447eafd Mon Sep 17 00:00:00 2001
From: =?utf8?q?Roland=20H=C3=A4der?= <roland@mxchange.org>
Date: Wed, 30 Jun 2010 04:14:49 +0000
Subject: [PATCH] Possible fix for bad escaping of single-quotes
---
inc/libs/security_functions.php | 7 +------
inc/template-functions.php | 5 ++++-
2 files changed, 5 insertions(+), 7 deletions(-)
diff --git a/inc/libs/security_functions.php b/inc/libs/security_functions.php
index c57d1e4c6e..7fc8a5ec11 100644
--- a/inc/libs/security_functions.php
+++ b/inc/libs/security_functions.php
@@ -151,17 +151,12 @@ if (!isset($_POST)) {
$_POST = $GLOBALS['_POST'];
} // END - if
-// Include IP-Filter here
-//include("/usr/share/php/ipfilter.php");
-
// Generate arrays which holds the relevante chars to replace
$GLOBALS['security_chars'] = array(
// The chars we are looking for...
- 'from' => array('{', '}', '/', '.', "'", '$', '(', ')', '{--', '--}', '{?', '?}', '%', ';', '[', ']', ':', '--'),
+ 'from' => array('/', '.', "'", '$', '(', ')', '{--', '--}', '{?', '?}', '%', ';', '[', ']', ':', '--'),
// ... and we will replace to.
'to' => array(
- '{OPEN_ANCHOR2}',
- '{CLOSE_ANCHOR2}',
'{SLASH}',
'{DOT}',
'{QUOT}',
diff --git a/inc/template-functions.php b/inc/template-functions.php
index 768cf677c4..e29ca2856e 100644
--- a/inc/template-functions.php
+++ b/inc/template-functions.php
@@ -242,7 +242,7 @@ function doFinalCompilation ($code, $insertComments = true) {
// Compile it
//* DEBUG: */ debugOutput('<pre>'.encodeEntities($code).'</pre>');
$eval = '$newContent = "' . str_replace('{DQUOTE}', '"', compileCode(escapeQuotes($code))) . '";';
- //* DEBUG: */ if ($insertComments) die('<pre>'.linenumberCode($eval).'</pre>');
+ //* DEBUG: */ if (!$insertComments) print('<pre>'.linenumberCode($eval).'</pre>');
eval($eval);
//* DEBUG: */ die('<pre>'.encodeEntities($newContent).'</pre>');
@@ -1450,6 +1450,9 @@ function escapeQuotes ($str, $single = false) {
// Escape all (including null)
$str = addslashes($str);
} else {
+ // Remove escaping of single quotes
+ $str = str_replace("\'", "'", $str);
+
// Escape only double-quotes but prevent double-quoting
$str = str_replace("\\\\", "\\", str_replace('"', "\\\"", $str));
}
--
2.39.5