security/core#14 Validate "context" inputs
authorSean Madsen <sean@seanmadsen.com>
Sun, 22 Apr 2018 21:50:47 +0000 (17:50 -0400)
committerTim Otten <totten@civicrm.org>
Wed, 18 Jul 2018 21:55:05 +0000 (14:55 -0700)
commitedc80cda6bfef2572d515c4c139d83f7556e632a
tree826016c005d0c617ebe9d36ab2aff4b800aee038
parentd92edefc480455c404ab2c3da6b3c81e803be865
security/core#14 Validate "context" inputs

When "context" is passed as a GET parameter, ensure that its values is
a valid "Alphanumeric" type. This helps prevent XSS when the "context"
value finds its way into templates that lack HTML output encoding.

Replace...

    CRM_Utils_Request::retrieve\((['"])context\1,(\s*)(['"])String\3

...with...

    CRM_Utils_Request::retrieve\($1context$1,$3Alphanumeric$3

Also search for the following and manually fix:

    \$_GET\[(['"])context\1\]
    \$_POST\[(['"])context\1\]
    \$_REQUEST\[(['"])context\1\]
67 files changed:
CRM/Activity/Form/Activity.php
CRM/Activity/Form/ActivityView.php
CRM/Activity/Form/Search.php
CRM/Activity/Page/Tab.php
CRM/Batch/Page/AJAX.php
CRM/Campaign/Form/Campaign.php
CRM/Campaign/Form/Petition.php
CRM/Campaign/Form/Search.php
CRM/Campaign/Form/Survey/Main.php
CRM/Case/Form/Activity.php
CRM/Case/Form/Activity/OpenCase.php
CRM/Case/Form/CaseView.php
CRM/Case/Form/EditClient.php
CRM/Case/Form/Search.php
CRM/Case/Page/CaseDetails.php
CRM/Case/Page/Tab.php
CRM/Contact/Form/Contact.php
CRM/Contact/Form/GroupContact.php
CRM/Contact/Form/Search.php
CRM/Contact/Form/Task/Delete.php
CRM/Contact/Form/Task/Email.php
CRM/Contact/Form/Task/Map.php
CRM/Contact/Form/Task/SMS.php
CRM/Contact/Page/AJAX.php
CRM/Contact/Page/DedupeFind.php
CRM/Contact/Page/DedupeRules.php
CRM/Contact/Page/View/Relationship.php
CRM/Contribute/BAO/ContributionRecur.php
CRM/Contribute/Form/Contribution.php
CRM/Contribute/Form/ContributionView.php
CRM/Contribute/Form/Search.php
CRM/Contribute/Page/PaymentInfo.php
CRM/Contribute/Page/Tab.php
CRM/Core/Page/AJAX.php
CRM/Dashlet/Page/Activity.php
CRM/Dashlet/Page/AllCases.php
CRM/Dashlet/Page/GettingStarted.php
CRM/Dashlet/Page/MyCases.php
CRM/Event/Form/Participant.php
CRM/Event/Form/Search.php
CRM/Event/Form/Task/Badge.php
CRM/Event/Page/EventInfo.php
CRM/Event/Page/Tab.php
CRM/Financial/Form/FinancialBatch.php
CRM/Financial/Page/AJAX.php
CRM/Financial/Page/FinancialBatch.php
CRM/Grant/Form/Grant.php
CRM/Grant/Form/GrantView.php
CRM/Grant/Form/Search.php
CRM/Grant/Page/Tab.php
CRM/Mailing/Page/Event.php
CRM/Mailing/Page/Report.php
CRM/Member/Form.php
CRM/Member/Form/MembershipView.php
CRM/Member/Form/Search.php
CRM/Member/Page/Tab.php
CRM/PCP/Form/Campaign.php
CRM/PCP/Form/PCP.php
CRM/Pledge/Form/Pledge.php
CRM/Pledge/Form/Search.php
CRM/Pledge/Page/Payment.php
CRM/Pledge/Page/Tab.php
CRM/Price/Page/Set.php
CRM/Profile/Form.php
CRM/Profile/Form/Edit.php
CRM/Report/Form/Activity.php
CRM/UF/Page/Group.php