[Pkg-owncloud-commits] [owncloud] 22/73: Use SCRIPT_NAME instead of PHP_SELF which won't send the PATH_INFO, this prevents XSS in old browsers. Thanks to Nico Golde.

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to annotated tag v4.0.10
in repository owncloud.

commit 45003593e12326ed2ac2f7330a6e3f1a42c6ca03
Author: Lukas Reschke <lukas at statuscode.ch>
Date:   Sat Aug 18 09:24:35 2012 +0200

    Use SCRIPT_NAME instead of PHP_SELF which won't send the PATH_INFO, this prevents XSS in old browsers. Thanks to Nico Golde.
---
 apps/files/index.php |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/files/index.php b/apps/files/index.php
index 60a3836..077187f 100644
--- a/apps/files/index.php
+++ b/apps/files/index.php
@@ -39,7 +39,7 @@ OCP\App::setActiveNavigationEntry( 'files_index' );
 $dir = isset( $_GET['dir'] ) ? stripslashes($_GET['dir']) : '';
 // Redirect if directory does not exist
 if(!OC_Filesystem::is_dir($dir.'/')) {
-	header('Location: '.$_SERVER['PHP_SELF'].'');
+	header('Location: '.$_SERVER['SCRIPT_NAME'].'');
 }
 
 $files = array();

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git