In gui/include/ispcp-lib.php:
if ($_REQUEST && !defined('OVERRIDE_PURIFIER')) {
$config = HTMLPurifier_Config::createDefault();
$config->set('HTML', 'TidyLevel', 'none'); // XSS cleaning
$purifier = new HTMLPurifier($config);
//$purifier = HTMLPurifier::getInstance();
foreach ($_GET as $i) {
$i = $purifier->purify($i);
}
foreach ($_POST as $i) {
$i = $purifier->purify($i);
}
foreach ($_REQUEST as $i) {
$i = $purifier->purify($i);
}
}
HTMLpurifier->purify does not take a reference as input and even it was $i could not be a valid reference to data that supposed to be cleaned, so even after purifying the argument it is not clear the value of $_GET/_POST/_REQUEST
test like this:
$_POST['test']='<script>alert(1)</script>';
foreach ($_POST as $key=>$i) {
echo "before: $i<br>\n";
$i = $purifier->purify($i);
echo "after: $i<br>\n";
echo "POST after: $_POST[$key]<br>\n";
}
Maybe this code should look like:
foreach ($_GET as $key=>$i) {
$_GET[$key] = $purifier->purify($i);
}
foreach ($_POST as $key=>$i) {
$_GET[$key] = $purifier->purify($i);
}
foreach ($_COOKIE as $key=>$i) {//$_REQUEST as it contains a mix of GET, POST and COOKIE data
$_COOKIE[$key] = $purifier->purify($i);
}
