xss in config > general > system on user agent display

orthagh · trasher · commit d45ae18626b8 · 2020-05-05T14:11:11.000+02:00
diff --git a/inc/config.class.php b/inc/config.class.php
@@ -1836,7 +1836,7 @@ function showSystemInformations() {
       echo wordwrap($msg."\n", $width, "\n\t");
 
       if (isset($_SERVER["HTTP_USER_AGENT"])) {
-         echo "\t" . $_SERVER["HTTP_USER_AGENT"] . "\n";
+         echo "\t" . Toolbox::clean_cross_side_scripting_deep($_SERVER["HTTP_USER_AGENT"]) . "\n";
       }
 
       foreach ($DB->getInfo() as $key => $val) {

Original file line number	Diff line number	Diff line change
`@@ -1836,7 +1836,7 @@ function showSystemInformations() {`
`1836`	`1836`	`echo wordwrap($msg."\n", $width, "\n\t");`
`1837`	`1837`
`1838`	`1838`	`if (isset($_SERVER["HTTP_USER_AGENT"])) {`
`1839`		`- echo "\t" . $_SERVER["HTTP_USER_AGENT"] . "\n";`
	`1839`	`+ echo "\t" . Toolbox::clean_cross_side_scripting_deep($_SERVER["HTTP_USER_AGENT"]) . "\n";`
`1840`	`1840`	`}`
`1841`	`1841`
`1842`	`1842`	`foreach ($DB->getInfo() as $key => $val) {`