From 4b02a1c432b10994c47b7d135eef850cdc214c6a Mon Sep 17 00:00:00 2001 From: eileen Date: Fri, 26 Jan 2018 12:02:26 +1300 Subject: [PATCH] CRM-21707 follow up fix - check keys as well as values for xss if we are going to encode json. --- api/v3/utils.php | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/api/v3/utils.php b/api/v3/utils.php index 959c17e0c0..2b858b6c00 100644 --- a/api/v3/utils.php +++ b/api/v3/utils.php @@ -2196,15 +2196,13 @@ function _civicrm_api3_validate_string(&$params, &$fieldName, &$fieldInfo, $enti if (!is_array($fieldValue)) { $fieldValue = (string) $fieldValue; } - else { - //@todo what do we do about passed in arrays. For many of these fields - // the missing piece of functionality is separating them to a separated string - // & many save incorrectly. But can we change them wholesale? - } + if ($fieldValue) { - foreach ((array) $fieldValue as $value) { - if (!CRM_Utils_Rule::xssString($fieldValue)) { - throw new Exception('Input contains illegal SCRIPT tag.'); + foreach ((array) $fieldValue as $key => $value) { + foreach ([$fieldValue, $key, $value] as $input) { + if (!CRM_Utils_Rule::xssString($input)) { + throw new Exception('Input contains illegal SCRIPT tag.'); + } } if ($fieldName == 'currency') { //When using IN operator $fieldValue is a array of currency codes -- 2.25.1