From 310dd4a21428b4df8c71839ae139c82b253f35c5 Mon Sep 17 00:00:00 2001
From: Rasmus Lerdorf <rasmus@php.net>
Date: Sun, 8 May 2005 17:24:38 +0000
Subject: [PATCH] Fix request_uri XSS on phpinfo() page

---
 ext/standard/info.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/ext/standard/info.c b/ext/standard/info.c
index c5485e7557b..bc278b5f302 100644
--- a/ext/standard/info.c
+++ b/ext/standard/info.c
@@ -406,7 +406,9 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)
 		if (expose_php && !sapi_module.phpinfo_as_text) {
 			PUTS("<a href=\"http://www.php.net/\"><img border=\"0\" src=\"");
 			if (SG(request_info).request_uri) {
-				PUTS(SG(request_info).request_uri);
+				char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
+				PUTS(elem_esc);
+				efree(elem_esc);
 			}
 			PUTS("?=");
 			logo_guid = php_logo_guid();
@@ -592,7 +594,9 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)
 		if (expose_php && !sapi_module.phpinfo_as_text) {
 			PUTS("<a href=\"http://www.zend.com/\"><img border=\"0\" src=\"");
 			if (SG(request_info).request_uri) {
-				PUTS(SG(request_info).request_uri);
+				char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
+				PUTS(elem_esc);
+				efree(elem_esc);
 			}
 			PUTS("?="ZEND_LOGO_GUID"\" alt=\"Zend logo\" /></a>\n");
 		}
@@ -611,7 +615,9 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)
 		php_info_print_hr();
 		PUTS("<h1><a href=\"");
 		if (SG(request_info).request_uri) {
-			PUTS(SG(request_info).request_uri);
+			char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
+			PUTS(elem_esc);
+			efree(elem_esc);
 		}
 		PUTS("?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000\">");
 		PUTS("PHP Credits");