composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-02-12 23:14:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

N°6282 Fix XSS vulnerability in wsdl

Browse Source
This commit is contained in:
Timothee
2024-12-19 15:34:43 +01:00
parent f0685e33e1
commit 49e72e83fe
1 changed files with 10 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
webservices/itop.wsdl.php
View File

@@ -17,19 +17,15 @@
* You should have received a copy of the GNU Affero General Public License
*/
if (isset($_REQUEST['debug']))
{
if ($_REQUEST['debug'] == 'text')
{
if (isset($_REQUEST['debug'])) {
if ($_REQUEST['debug'] == 'text') {
header('Content-Type: text/plain; charset=UTF-8');
}
else
{
else {
header('Content-Type: application/xml; charset=UTF-8');
}
}
else
{
else {
// This is to make sure that the client will accept it....
//
header('Content-Type: application/xml; charset=UTF-8');
@@ -48,19 +44,17 @@ require_once(APPROOT.'/application/startup.inc.php');
require_once(APPROOT.'webservices/webservices.basic.php');
if (isset($_REQUEST['service_category']) && (!empty($_REQUEST['service_category'])))
{
$sRawFile = WebServicesBase::GetWSDLContents($_REQUEST['service_category']);
$sServiceCategory = utils::ReadParam('service_category');
if (!empty($sServiceCategory)) {
$sRawFile = WebServicesBase::GetWSDLContents($sServiceCategory);
}
else
{
else {
$sRawFile = WebServicesBase::GetWSDLContents();
}
$sServerURI = utils::GetAbsoluteUrlAppRoot().'webservices/soapserver.php';
if (isset($_REQUEST['service_category']) && (!empty($_REQUEST['service_category'])))
{
$sServerURI .= "?service_category=".$_REQUEST['service_category'];
if (!empty($sServiceCategory)) {
$sServerURI .= "?service_category=".$sServiceCategory;
}
$sFinalFile = str_replace(