Leahnaya/pokemon-showdown-client
1
0
Fork 0
mirror of https://github.com/smogon/pokemon-showdown-client.git synced 2026-10-02 15:53:11 -05:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Fix XSS in getassertion

Browse Source
This commit is contained in:
Cathy J. Fitzpatrick
2013-01-30 22:49:51 -07:00
parent 76ddd847cf
commit 5a26bc4fdb
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
action.php
View File

@@ -107,6 +107,7 @@ foreach ($reqs as $reqData) {
break;
case 'checklogin':
// direct
header('Content-type: text/plain');
die(!!$users->getUser($reqData['userid']));
break;
case 'logout':
@@ -125,6 +126,7 @@ foreach ($reqs as $reqData) {
break;
case 'getsessiontoken':
// direct
header('Content-type: text/plain');
die($users->getSessionToken($reqData['servertoken']));
break;
case 'getassertion':
@@ -132,6 +134,7 @@ foreach ($reqs as $reqData) {
if (empty($reqData['servertoken'])) {
die('Probably cached version of client.');
}
header('Content-type: text/plain');
die($users->getAssertion(@$reqData['userid'], $reqData['servertoken']));
break;
case 'verifysessiontoken':