From a08f5ca8587f2477ea9091e97e5115e1820886b4 Mon Sep 17 00:00:00 2001 From: Krivchikov Dmitry Date: Fri, 11 Sep 2015 15:16:37 +0300 Subject: [PATCH] =?UTF-8?q?=D0=92=D1=8B=D1=80=D0=B5=D0=B7=D0=B0=D0=BD?= =?UTF-8?q?=D0=B8=D0=B5=20=D1=82=D0=B5=D0=B3=D0=BE=D0=B2=20=D0=B8=D0=B7=20?= =?UTF-8?q?=D0=B7=D0=B0=D0=B3=D0=BE=D0=BB=D0=BE=D0=B2=D0=BA=D0=B0=20=D0=B8?= =?UTF-8?q?=20=D0=BE=D0=BF=D0=B8=D1=81=D0=B0=D0=BD=D0=B8=D1=8F=20=D0=BF?= =?UTF-8?q?=D1=80=D0=B8=20=D1=81=D0=BE=D1=85=D1=80=D0=B0=D0=BD=D0=B5=D0=BD?= =?UTF-8?q?=D0=B8=D0=B8=20=D1=82=D0=BE=D1=87=D0=BA=D0=B8;=20=D0=92=D1=8B?= =?UTF-8?q?=D1=80=D0=B5=D0=B7=D0=B0=D0=BD=D0=B8=D0=B5=20=D1=82=D0=B5=D0=B3?= =?UTF-8?q?=D0=BE=D0=B2=20=D0=BF=D1=80=D0=B8=20=D1=81=D0=BE=D1=85=D1=80?= =?UTF-8?q?=D0=B0=D0=BD=D0=B5=D0=BD=D0=B8=D0=B8=20=D1=81=D1=82=D0=B0=D1=82?= =?UTF-8?q?=D1=8C=D0=B8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ground/controllers/ArticlesController.php | 2 +- ground/controllers/JsonController.php | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/ground/controllers/ArticlesController.php b/ground/controllers/ArticlesController.php index c2eb6ca..beb4162 100644 --- a/ground/controllers/ArticlesController.php +++ b/ground/controllers/ArticlesController.php @@ -74,7 +74,7 @@ class ArticlesController extends Controller } $id = (int) $_POST['id']; - $title = $_POST['title']; + $title = strip_tags($_POST['title']); $text = str_replace(array('<','>'), array('<','>'), $_POST['text']); $html = strip_tags($_POST['text']); diff --git a/ground/controllers/JsonController.php b/ground/controllers/JsonController.php index 15765df..48afdde 100644 --- a/ground/controllers/JsonController.php +++ b/ground/controllers/JsonController.php @@ -186,6 +186,14 @@ class JsonController extends Controller App::redirect('/?point=' . $id); } + if (isset($_POST['name'])) { + $_POST['name'] = strip_tags($_POST['name']); + } + + if (isset($_POST['description'])) { + $_POST['description'] = strip_tags($_POST['description']); + } + if (!( isset($_POST['name']) && $_POST['name'] && strlen($_POST['name']) > 1 )) $errors[1] = 'Неверное название точки'; if (!( isset($_POST['img']) && (int) $_POST['img']))