☆ A M B ☆
☆ A M B ☆
htmlentities($string, ENT_QUOTES, 'UTF-8');
☆ A M B ☆
$post = str_replace(array('[',']'),array('[',']'),$post);
☆ A M B ☆
array('& #91;','& #93;'),$post)
public function sanitizeRequest() {
$modxtags = array_values($this->modx->sanitizePatterns);
modX :: sanitize($_GET, $modxtags, 0);
if ($this->modx->getOption('allow_tags_in_post',null,true)) {
modX :: sanitize($_POST);
} else {
modX :: sanitize($_POST, $modxtags);
}
modX :: sanitize($_COOKIE, $modxtags);
modX :: sanitize($_REQUEST, $modxtags);
$rAlias = $this->modx->getOption('request_param_alias', null, 'q');
if (isset ($_GET[$rAlias])) {
$_GET[$rAlias] = preg_replace("/[^A-Za-z0-9_\-\.\/]/", "", $_GET[$rAlias]);
}
} public static function sanitize(array &$target, array $patterns= array(), $depth= 3, $nesting= 10) {
while (list($key, $value)= each($target)) {
if (is_array($value) && $depth > 0) {
modX :: sanitize($value, $patterns, $depth-1);
} elseif (is_string($value)) {
if (!empty($patterns)) {
foreach ($patterns as $pattern) {
$nesting = ((integer) $nesting ? (integer) $nesting : 10);
$iteration = 1;
while ($iteration <= $nesting && preg_match($pattern, $value)) {
$value= preg_replace($pattern, '', $value);
$iteration++;
}
}
}
if (get_magic_quotes_gpc()) {
$target[$key]= stripslashes($value);
} else {
$target[$key]= $value;
}
}
}
return $target;
}
☆ A M B ☆
So if you run $modx->sanitizeRequest() anywhere in your Snippet/Plugin, then you should be able to read out the $_POST/$_GET arrays without fear?
Is there a System Setting that controls whether that gets done automatically? I remember looking through the modRequest class and I think that gets run inside the handleRequest() function, but that probably only matters inside CMPs, no?
public function handleRequest() {
$this->loadErrorHandler();
$this->sanitizeRequest();
/* ... */
☆ A M B ☆
Hmmm... does that prevent against the normal litany of clever XSS workarounds? E.g. http://wiremask.eu/?p=tutorials&id=10
In the past I've copied some of the XSS filtering functions from CodeIgniter, and that's been pretty effective, but it's a slog.