security/core#14 Validate "context" inputs
authorSean Madsen <sean@seanmadsen.com>
Sun, 22 Apr 2018 21:50:47 +0000 (17:50 -0400)
committerTim Otten <totten@civicrm.org>
Wed, 18 Jul 2018 20:51:53 +0000 (13:51 -0700)
commit443611bba9b6dfe0d56f705a1cbb08cfd2de99be
tree48a4d5964e848f80277522a770184d4b690f857c
parent1e970c0babffeb13ee677228b1d8a91eb635829f
security/core#14 Validate "context" inputs

When "context" is passed as a GET parameter, ensure that its values is
a valid "Alphanumeric" type. This helps prevent XSS when the "context"
value finds its way into templates that lack HTML output encoding.

Replace...

    CRM_Utils_Request::retrieve\((['"])context\1,(\s*)(['"])String\3

...with...

    CRM_Utils_Request::retrieve\($1context$1,$3Alphanumeric$3

Also search for the following and manually fix:

    \$_GET\[(['"])context\1\]
    \$_POST\[(['"])context\1\]
    \$_REQUEST\[(['"])context\1\]
68 files changed:
CRM/Activity/Form/Activity.php
CRM/Activity/Form/ActivityView.php
CRM/Activity/Form/Search.php
CRM/Activity/Page/Tab.php
CRM/Admin/Form/ScheduleReminders.php
CRM/Batch/Page/AJAX.php
CRM/Campaign/Form/Campaign.php
CRM/Campaign/Form/Petition.php
CRM/Campaign/Form/Search.php
CRM/Campaign/Form/Survey/Main.php
CRM/Case/Form/Activity.php
CRM/Case/Form/Activity/OpenCase.php
CRM/Case/Form/CaseView.php
CRM/Case/Form/EditClient.php
CRM/Case/Form/Search.php
CRM/Case/Page/CaseDetails.php
CRM/Case/Page/Tab.php
CRM/Contact/Form/Contact.php
CRM/Contact/Form/GroupContact.php
CRM/Contact/Form/Search.php
CRM/Contact/Form/Task/Delete.php
CRM/Contact/Form/Task/Email.php
CRM/Contact/Form/Task/Map.php
CRM/Contact/Form/Task/SMS.php
CRM/Contact/Page/AJAX.php
CRM/Contact/Page/DedupeFind.php
CRM/Contact/Page/DedupeRules.php
CRM/Contact/Page/View/Relationship.php
CRM/Contribute/BAO/ContributionRecur.php
CRM/Contribute/Form/Contribution.php
CRM/Contribute/Form/ContributionView.php
CRM/Contribute/Form/Search.php
CRM/Contribute/Page/PaymentInfo.php
CRM/Contribute/Page/Tab.php
CRM/Core/Page/AJAX.php
CRM/Dashlet/Page/Activity.php
CRM/Dashlet/Page/AllCases.php
CRM/Dashlet/Page/GettingStarted.php
CRM/Dashlet/Page/MyCases.php
CRM/Event/Form/Participant.php
CRM/Event/Form/Search.php
CRM/Event/Form/Task/Badge.php
CRM/Event/Page/EventInfo.php
CRM/Event/Page/Tab.php
CRM/Financial/Form/FinancialBatch.php
CRM/Financial/Page/AJAX.php
CRM/Financial/Page/FinancialBatch.php
CRM/Grant/Form/Grant.php
CRM/Grant/Form/GrantView.php
CRM/Grant/Form/Search.php
CRM/Grant/Page/Tab.php
CRM/Mailing/Page/Event.php
CRM/Mailing/Page/Report.php
CRM/Member/Form.php
CRM/Member/Form/MembershipView.php
CRM/Member/Form/Search.php
CRM/Member/Page/Tab.php
CRM/PCP/Form/Campaign.php
CRM/PCP/Form/PCP.php
CRM/Pledge/Form/Pledge.php
CRM/Pledge/Form/Search.php
CRM/Pledge/Page/Payment.php
CRM/Pledge/Page/Tab.php
CRM/Price/Page/Set.php
CRM/Profile/Form.php
CRM/Profile/Form/Edit.php
CRM/Report/Form/Activity.php
CRM/UF/Page/Group.php