adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

prevent possible XSS attack via form helper selects and unescaped output.

Browse source
This commit is contained in:
euromark 2013-12-04 01:51:39 +01:00
parent aae0f762dd
commit 587a04ab84
2 changed files with 31 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
lib/Cake/Test/Case/View/Helper/FormHelperTest.php
View file

@ -4634,6 +4634,34 @@ class FormHelperTest extends CakeTestCase {
'/select'
);
$this->assertTags($result, $expected);
$result = $this->Form->select(
'Model.multi_field',
array('a>b' => 'first', 'a<b' => 'second', 'a"b' => 'third'),
array('multiple' => true)
);
$expected = array(
'input' => array(
'type' => 'hidden', 'name' => 'data[Model][multi_field]', 'value' => '',
'id' => 'ModelMultiField_'
),
array('select' => array('name' => 'data[Model][multi_field][]',
'multiple' => 'multiple', 'id' => 'ModelMultiField'
)),
array('option' => array('value' => 'a&gt;b')),
'first',
'/option',
array('option' => array('value' => 'a&lt;b')),
'second',
'/option',
array('option' => array(
'value' => 'a&quot;b'
)),
'third',
'/option',
'/select'
);
$this->assertTags($result, $expected);
}
/**

3
lib/Cake/View/Helper/FormHelper.php
View file

@ -2733,6 +2733,9 @@ class FormHelper extends AppHelper {
$item = $this->Html->useTag('checkboxmultiple', $name, $htmlOptions);
$select[] = $this->Html->div($attributes['class'], $item . $label);
} else {
if ($attributes['escape']) {
$name = h($name);
}
$select[] = $this->Html->useTag('selectoption', $name, $htmlOptions, $title);
}
}