tonyair
/
silverstripe-cms
mirror of https://github.com/silverstripe/silverstripe-cms
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

SECURITY Using JSON instead of serialize() to stringify user data in PageCommentsInterface

This commit is contained in:
Ingo Schommer 2011-09-08 17:56:47 +02:00
parent b5ea2f68fe
commit d15e8509b0
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
code/sitefeatures/PageCommentInterface.php
View File

@ -222,7 +222,7 @@ class PageCommentInterface extends RequestHandler {
foreach($fields as $field) {
if(!$field instanceof HiddenField) $visibleFields[] = $field->Name();
}
$form->loadDataFrom(unserialize($cookie), false, $visibleFields);
$form->loadDataFrom(Convert::json2array($cookie), false, $visibleFields);
}
return $form;
@ -272,7 +272,7 @@ class PageCommentInterface extends RequestHandler {
*/
class PageCommentInterface_Form extends Form {
function postcomment($data) {
Cookie::set("PageCommentInterface_Data", serialize($data));
Cookie::set("PageCommentInterface_Data", Convert::raw2json($data));
// Spam filtering
if(SSAkismet::isEnabled()) {
@ -333,7 +333,7 @@ class PageCommentInterface_Form extends Form {
$comment->write();
unset($data['Comment']);
Cookie::set("PageCommentInterface_Data", serialize($data));
Cookie::set("PageCommentInterface_Data", Convert::raw2json($data));
$moderationMsg = _t('PageCommentInterface_Form.AWAITINGMODERATION', "Your comment has been submitted and is now awaiting moderation.");