[gentoo-commits] gentoo-x86 commit in sys-cluster/ganglia-web/files: CVE-2013-6395-fix-xss.patch

[Justin Bronder (jsbronder)]

jsbronder    13/12/23 16:54:37

  Added:                CVE-2013-6395-fix-xss.patch
  Log:
  Add patch to fix CVE-2013-6395 (#492580).
  
  (Portage version: 2.2.7/cvs/Linux x86_64, signed Manifest commit with key 4D7043C9)

Revision  Changes    Path
1.1                  sys-cluster/ganglia-web/files/CVE-2013-6395-fix-xss.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-cluster/ganglia-web/files/CVE-2013-6395-fix-xss.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-cluster/ganglia-web/files/CVE-2013-6395-fix-xss.patch?rev=1.1&content-type=text/plain

Index: CVE-2013-6395-fix-xss.patch
===================================================================
From a014c9542710ad50fd1a7fd1eb39b44261edf3a2 Mon Sep 17 00:00:00 2001
From: Justin Bronder <jsbronder@×××××.com>
Date: Mon, 23 Dec 2013 11:39:03 -0500
Subject: [PATCH] CVE-2013-6395 fix xss

https://bugs.gentoo.org/show_bug.cgi?id=492580
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6395
---
 header.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/header.php b/header.php
index d0a30c2..e1cb0e8 100755
--- a/header.php
+++ b/header.php
@@ -485,7 +485,7 @@ $data->assign("custom_time", $custom_time);
 /////////////////////////////////////////////////////////////////////////
 if ( $context == "cluster" ) {
   if ( isset($user['host_regex']) && $user['host_regex'] != "" )
-    $set_host_regex_value="value='" . $user['host_regex'] . "'";
+    $set_host_regex_value="value='" . htmlentities($user['host_regex'], ENT_QUOTES) . "'";
   else
     $set_host_regex_value="";
 
-- 
1.8.3.2