Getsimple : exotic char causes website crash
Par Mathieu le vendredi 15 mars 2013, 08:29 - Hacks - Lien permanent
Input sanitizing while editing pages is not efficient in GetSimple, incorrect char such as NULL or EOT corrupt XML files and crashes the CMS :
Here is a patch :
Warning: simplexml_load_string(): Entity: line 106: parser error : CData section not finished
Here is a patch :
--- admin/inc/basic.php
+++ admin/inc/basic.php
@@ -654,8 +654,15 @@
} else {
$text = htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
}
- $text = str_replace(chr(12), '', $text);
- $text = str_replace(chr(3), ' ', $text);
+ $badchars = array();
+ for ($code = 0; $code < 32; $code++) {
+ $badchars[] = chr($code);
+ }
+ unset($badchars[13]);
+ unset($badchars[10]);
+ $text = str_replace($badchars, '', $text);
+ //$text = str_replace(chr(12), '', $text);
+ //$text = str_replace(chr(3), ' ', $text);
return $text;
}Note that it does not fixes the corrupted XML files, it prevents the corrupted files to appear.