Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possible XSS vulnerability in Codeigniter #23

Open
enferas opened this issue Dec 25, 2022 · 1 comment
Open

Possible XSS vulnerability in Codeigniter #23

enferas opened this issue Dec 25, 2022 · 1 comment

Comments

@enferas
Copy link

enferas commented Dec 25, 2022

Hello,

I would like to report for possible XSS vulnerability with date_begin and date_end.

In file cron-manager-master\examples\codeigniter\application\controllers\TasksController.php

public function tasksReport()
    {
        $date_begin = isset($_GET['date_begin']) ? $_GET['date_begin'] : date('Y-m-d', strtotime('-6 day'));
        $date_end = isset($_GET['date_end']) ? $_GET['date_end'] : date('Y-m-d');

        $this->load->view('tasks/report', array(
            'report' => Task::getReport($date_begin, $date_end),
            'date_begin' => $date_begin,
            'date_end' => $date_end,
        ));
    }

In file cron-manager-master\examples\codeigniter\application\views\tasks\report.php

    <div class="form-group">
        <label for="date_begin" class="control-label">Date begin</label>
        <input type="date" value="<?= $date_begin ?>" name="date_begin" id="date_begin" class="form-control">
    </div>
    <div class="form-group">
        <label for="date_end" class="control-label">Date end</label>
        <input type="date" value="<?= $date_end ?>" name="date_end" id="date_end" class="form-control">
    </div>
@MUlt1mate
Copy link
Owner

Hello @enferas. Thanks for reaching out. Sorry about very late response, I was genuinely going to make changes, but I don't have time for this project. The changes in code looks pretty straightforward, but I don't use PHP anymore, so it's more complicated for me to just set up the environment. If you make a PR with changes I'll be happy to merge it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants