Leahnaya/pokemon-showdown-client
1
0
Fork 0
mirror of https://github.com/smogon/pokemon-showdown-client.git synced 2026-03-21 17:50:29 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix XSS in crossdomain.php
Some checks failed
Node.js CI / build (22.x) (push) Has been cancelled
Details

Browse Source 
Thanks to Rektile404 for reporting this bug!

https://github.com/rektile
This commit is contained in:
Guangcong Luo 2025-11-13 12:56:20 +00:00
parent 64e79f49eb
commit f12dec091d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
play.pokemonshowdown.com/crossdomain.php
View File

@ -14,7 +14,7 @@ if (preg_match('/^([a-z0-9-_\.]*?)\.psim\.us$/', $host, $m)) {
die; // not authorised
}
$protocol = @$_REQUEST['protocol'] ?? 'http:';
$protocol = @$_REQUEST['protocol'] === 'https:' ? 'https:' : 'http:';
$portType = ($protocol === 'http:' ? 'port' : 'httpsport');
if ($config['host'] !== 'showdown') {