Security: XXS in Post about addictive-community

[inrussiawithhate]

controllers/Thread.php

line 220 find: "post" => str_replace("'", "'", $_POST['post']),

replace with

"post" => str_replace("'", "'", htmlspecialchars($_POST['post'])),

line 354 find:

"poll_allow_multiple" => (isset($_POST['poll_allow_multiple'])) ? 1 : 0
);

replace with

"poll_allow_multiple" => (isset(htmlspecialchars($_POST['poll_allow_multiple']))) ? 1 : 0
);

line 364 find:

"post" => str_replace("'", "'", $_POST['post']),

replace with:

"post" => str_replace("'", "'", htmlspecialshars($_POST['post'])),

line 419 find:

"post" => $_REQUEST['post'],

replace with:

"post" => htmlspecialchars($_REQUEST['post']),

[arcestia]

Fatal error: Cannot use isset() on the result of a function call (you can use "null !== func()" instead) in /home/arcestia/public_html/controllers/Thread.php on line 354
@inrussiawithhate

[inrussiawithhate]

My error. It back as it was again tested whether there are XSS?

find:
"poll_allow_multiple" => (isset(htmlspecialchars($_POST['poll_allow_multiple']))) ? 1 : 0
);

replace with:

"poll_allow_multiple" => (isset($_POST['poll_allow_multiple'])) ? 1 : 0
);

[arcestia]

@brunnopleffken need to update in next version

[brunnopleffken]

Thanks for reporting! There’s no need to re-encode the information using PHP, as the built-in WYSIWYG editor already does that (in DB, you'll already see encoded information). So, we just need to sanitize the view, not the back-end.

The achieved result: