return $data;
}
+function html_cleanup(&$parms)
+{
+ foreach($parms as $name => $value) {
+// $value = @html_entity_decode($value, ENT_QUOTES, $_SESSION['language']->encoding);
+ if (is_array($value))
+ html_cleanup($parms[$name]);
+ else
+ $parms[$name] = @htmlspecialchars($value, ENT_QUOTES, $_SESSION['language']->encoding);
+ }
+ reset($parms); // needed for direct key() usage later throughout the sources
+}
+
//============================================================================
//
//
if (!isset($_SESSION["wa_current_user"]))
$_SESSION["wa_current_user"] = new current_user();
+html_cleanup($_GET);
+html_cleanup($_POST);
+html_cleanup($_REQUEST);
+
// logout.php is the only page we should have always
// accessable regardless of access level and current login status.
if (strstr($_SERVER['PHP_SELF'], 'logout.php') == false){
{
// strip ajax marker from uri, to force synchronous page reload
$_SESSION['timeout'] = array( 'uri'=>preg_replace('/JsHttpRequest=(?:(\d+)-)?([^&]+)/s',
- '', @$_SERVER['REQUEST_URI']),
+ '', @htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, $_SESSION['language']->encoding)),
'post' => $_POST);
include($path_to_root . "/access/login.php");
// POST vars cleanup needed for direct reuse.
// We quote all values later with db_escape() before db update.
- $_POST = strip_quotes($_POST);
-
-// GET cleanup against XSS. (NB in FA those are mainly numeric transaction numbers)
- foreach($_GET as $name => $value) {
-// $value = @html_entity_decode($value, ENT_QUOTES, $_SESSION['language']->encoding);
- $_GET[$name] = @htmlspecialchars($value, ENT_QUOTES, $_SESSION['language']->encoding);
-
- }
- foreach($_POST as $name => $value) {
-// $value = @html_entity_decode($value, ENT_QUOTES, $_SESSION['language']->encoding);
- $_POST[$name] = @htmlspecialchars($value, ENT_QUOTES, $_SESSION['language']->encoding);
-
- }
+$_POST = strip_quotes($_POST);
?>
\ No newline at end of file