Changeset 28913 for main/trunk/greenstone2/runtime-src/src/recpt/usersaction.cpp

Timestamp:

2014-03-18T20:22:59+13:00 (10 years ago)

Author:

ak19

Message:

6th commit for security of cgiargs. Looked over all occurrences of setmacro in *action.cpp files

File:

• main/trunk/greenstone2/runtime-src/src/recpt/usersaction.cpp (modified) (1 diff)

main/trunk/greenstone2/runtime-src/src/recpt/usersaction.cpp

@@ -268 +268 @@
   disp.setmacro ("usersargug", "users", args["umug"]);
   disp.setmacro ("usersargc", "users", args["umc"]);
+
+  disp.setmacro ("usersargunAttrsafe", "users", encodeForHTMLAttr(args["umun"]));
+  disp.setmacro ("usersargpwAttrsafe", "users", encodeForHTMLAttr(args["umpw"]));
+  disp.setmacro ("usersargusAttrsafe", "users", encodeForHTMLAttr(args["umus"])); // unused in users.dm or other macro files, but setting this attrsafe'd macro in parallel with the other usersarg* values here.
+  disp.setmacro ("usersargugAttrsafe", "users", encodeForHTMLAttr(args["umug"]));
+  disp.setmacro ("usersargcAttrsafe", "users", encodeForHTMLAttr(args["umc"]));
+
 }