Skip to content

Commit fe28c31

Browse files
committed
Skill: Fix XSS when showing selected skill
1 parent 3511252 commit fe28c31

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

main/admin/skills_wheel.php

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use Symfony\Component\HttpFoundation\Request as HttpRequest;
5+
46
$cidReset = true;
57

68
require_once __DIR__.'/../inc/global.inc.php';
@@ -10,6 +12,8 @@
1012
api_protect_admin_script(false, true);
1113
Skill::isAllowed();
1214

15+
$httpRequest = HttpRequest::createFromGlobals();
16+
1317
//Adds the JS needed to use the jqgrid
1418
$htmlHeadXtra[] = api_get_js('d3/d3.v3.5.4.min.js');
1519
$htmlHeadXtra[] = api_get_js('d3/colorbrewer.js');
@@ -24,8 +28,9 @@
2428

2529
$skill_condition = '';
2630
if (isset($_GET['skill_id'])) {
27-
$skill_condition = '&skill_id='.intval($_GET['skill_id']);
28-
$tpl->assign('skill_id_to_load', $_GET['skill_id']);
31+
$skillId = $httpRequest->query->getInt('skill_id');
32+
$skill_condition = "&skill_id=$skillId";
33+
$tpl->assign('skill_id_to_load', $skillId);
2934
}
3035

3136
$url = api_get_path(WEB_AJAX_PATH)."skill.ajax.php?a=get_skills_tree_json&load_user=$load_user";

0 commit comments

Comments
 (0)