tonyair/silverstripe-reports
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-reports synced 2024-09-16 14:36:15 +02:00
Code Issues Projects Releases Wiki Activity

SECURITY Using JSON instead of serialize() to stringify user data in PageCommentsInterface

Browse Source
This commit is contained in:
Ingo Schommer 2011-09-08 17:56:47 +02:00
parent b5ea2f68fe
commit d15e8509b0
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
code/sitefeatures/PageCommentInterface.php
View File

@ -222,7 +222,7 @@ class PageCommentInterface extends RequestHandler {
foreach($fields as $field) { foreach($fields as $field) {
if(!$field instanceof HiddenField) $visibleFields[] = $field->Name(); if(!$field instanceof HiddenField) $visibleFields[] = $field->Name();
} }
$form->loadDataFrom(unserialize($cookie), false, $visibleFields); $form->loadDataFrom(Convert::json2array($cookie), false, $visibleFields);
} }
return $form; return $form;
@ -272,7 +272,7 @@ class PageCommentInterface extends RequestHandler {
*/ */
class PageCommentInterface_Form extends Form { class PageCommentInterface_Form extends Form {
function postcomment($data) { function postcomment($data) {
Cookie::set("PageCommentInterface_Data", serialize($data)); Cookie::set("PageCommentInterface_Data", Convert::raw2json($data));
// Spam filtering // Spam filtering
if(SSAkismet::isEnabled()) { if(SSAkismet::isEnabled()) {
@ -333,7 +333,7 @@ class PageCommentInterface_Form extends Form {
$comment->write(); $comment->write();
unset($data['Comment']); unset($data['Comment']);
Cookie::set("PageCommentInterface_Data", serialize($data)); Cookie::set("PageCommentInterface_Data", Convert::raw2json($data));
$moderationMsg = _t('PageCommentInterface_Form.AWAITINGMODERATION', "Your comment has been submitted and is now awaiting moderation."); $moderationMsg = _t('PageCommentInterface_Form.AWAITINGMODERATION', "Your comment has been submitted and is now awaiting moderation.");