<![CDATA[ Removing tags variable from Reflect URL - My Forums]]> https://forums.modx.com/thread/?thread=42791 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url?page=2#dis-post-500929 Quote from: mrhaw at Jun 20, 2010, 06:37 PM
Good catch of xss there! smiley

Fix: Line 201 in tagging.extender.inc.php
$getTags = !empty($_GET[$dittoID.'tags']) ? strip_tags(trim($_GET[$dittoID.'tags'])) : false;


This should be added to JIRA for Ditto. Done.

Way better $modx->stripTags()
https://github.com/mrhaw/evolution/commit/0fc2ccb08e2472cb57f405a20c518a6fc06c2b5c
https://github.com/modxcms/evolution/pull/279]]> mrhaw Jun 19, 2014, 03:24 PM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url?page=2#dis-post-500929 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247388 hotdiggity Jun 21, 2010, 07:16 AM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247388 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247387

Fix: Line 201 in tagging.extender.inc.php
$getTags = !empty($_GET[$dittoID.'tags']) ? strip_tags(trim($_GET[$dittoID.'tags'])) : false;


This should be added to JIRA for Ditto. Done.
]]> mrhaw Jun 20, 2010, 01:37 PM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247387 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247386 Quote from: mrhaw at May 11, 2010, 08:59 PM

Yes! Using regex I’d think.
I did it without phx, but with an additional snippet

<? php // snippet 'Leftmenu';
$tmp=$modx->runSnippet('Reflect', array(
'targetID' => 3,
'config'=>'wordpress' ,
'path'=>'3' ,
'tplContainer'=>'reflect_tpl',
'dittoSnippetParameters'=>'parents:3',
'id'=>'wp_',
'getDocuments'=>'1'
));
// echo $tmp; // Reflect's result 

$tmp = preg_replace ('/(&)?(wp_)?tags=[^&"]*(&)?(start=0&)?/is','',$tmp);
// clear url string wp_tags=xxx (from ditto) tags=xxx, start=0 (taglinks)  

echo $tmp;
//  [!Reflect? &config=`wordpress` &targetID=`3` &path=`3` &tplContainer=`reflect_tpl` &dittoSnippetParameters=`parents:3` &wp_tags=`` &id=`wp_` &getDocuments=`1`!]
?>


But two moments:

1. Similar pages: Ditto and Reflect add to URL links all $_GET parameters (it is one way to make "double pages":
_http://domain.tld/ditto_page?day=... &blabla=5 - this page make a lot reflect’s links with "...&blabla=5"

2. XSS: page _http://domain.tld/ditto_page?tags=<a href=http://modxcms.com>modxcms</a> when use [+tags+] in content display link to any page

Any solutions?

ps. Sorry for my English...]]> esche Jun 20, 2010, 09:50 AM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247386 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247385 mrhaw May 11, 2010, 03:59 PM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247385 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247384 hotdiggity May 10, 2010, 09:53 PM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247384 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247383 hotdiggity May 10, 2010, 08:30 PM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247383 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247382 Here is one approach http://modxcms.com/forums/index.php/topic,37590.0.html

You need to edit the code to not preserve current url vars... as it uses Ditto
changing it will most likely break other functions!]]> mrhaw May 10, 2010, 08:17 PM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247382 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247381 hotdiggity May 10, 2010, 06:27 PM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247381 <![CDATA[Re: Removing tags variable from Reflect URL]]> https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247380 hotdiggity May 07, 2010, 12:40 AM https://forums.modx.com/thread/42791/removing-tags-variable-from-reflect-url#dis-post-247380