Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 197203727417a03d87053a47e5aa5175a76e3e0b

 program/lib/washtml.php

@@ -168,7 +168,7 @@
                || ($src = $this->config['cid_map'][$this->config['base_url'].$match[2]])) {
              $value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')';
            }
            else if (preg_match('/^(http|https|ftp):.*$/i', $match[2], $url)) {
            else if (preg_match('!^(https?:)?//[a-z0-9/._+-]+$!i', $match[2], $url)) {
              if ($this->config['allow_remote'])
                $value .= ' url('.htmlspecialchars($url[0], ENT_QUOTES).')';
              else
@@ -243,7 +243,7 @@
      case XML_ELEMENT_NODE: //Check element
        $tagName = strtolower($node->tagName);
        if ($callback = $this->handlers[$tagName]) {
          $dump .= call_user_func($callback, $tagName, $this->wash_attribs($node), $this->dumpHtml($node));
          $dump .= call_user_func($callback, $tagName, $this->wash_attribs($node), $this->dumpHtml($node), $this);
        }
        else if (isset($this->_html_elements[$tagName])) {
          $content = $this->dumpHtml($node);
@@ -301,6 +301,14 @@
    return $this->dumpHtml($node);
  }

  /**
   * Getter for config parameters
   */
  public function get_config($prop)
  {
      return $this->config[$prop];
  }

}

?>