BugTrack/651 XSS vulnerability in ls2.inc.php

diff --git a/plugin/ls2.inc.php b/plugin/ls2.inc.php
index c2aa765..dd45618 100644 (file)
--- a/plugin/ls2.inc.php
+++ b/plugin/ls2.inc.php
@@ -2,7 +2,7 @@
 /////////////////////////////////////////////////
 // PukiWiki - Yet another WikiWikiWeb clone.
 //
-// $Id: ls2.inc.php,v 1.19 2004/08/11 22:56:04 henoheno Exp $
+// $Id: ls2.inc.php,v 1.20 2004/08/12 14:26:58 henoheno Exp $
 //
 
 /*
@@ -10,7 +10,7 @@
 ÇÛ²¼¤Î¥Ú¡¼¥¸¤Î¸«½Ð¤·(*,**,***)¤Î°ìÍ÷¤òɽ¼¨¤¹¤ë
 
 * Usage
- #ls2(¥Ñ¥¿¡¼¥ó[,¥Ñ¥é¥á¡¼¥¿])
+ #ls2(¥Ñ¥¿¡¼¥ó[,title|include|link|reverse|compact, ...],¥¿¥¤¥È¥ë)
 
 * ¥Ñ¥é¥á¡¼¥¿
 
@@ -32,6 +32,10 @@ action
 - compact
 ¸«½Ð¤·¥ì¥Ù¥ë¤òÄ´À°¤¹¤ë
 LS2_LIST_COMPACT¤¬TRUE¤Î»þ¤Ï̵¸ú(ÊѲ½¤·¤Ê¤¤)
+
+- ¥¿¥¤¥È¥ë
+¸«½Ð¤·¤Î¥¿¥¤¥È¥ë¤ò»ØÄꤹ¤ë
+
 */
 
 //¸«½Ð¤·¥¢¥ó¥«¡¼¤Î½ñ¼°
@@ -91,9 +95,10 @@ function plugin_ls2_convert()
                '_args'   => array(),
                '_done'   => FALSE
        );
-       array_walk($args, 'ls2_check_arg', &$params);
+       array_walk($args, 'ls2_check_arg', & $params);
+
        $title = (count($params['_args']) > 0) ?
-               join(',', $params['_args']) :
+               htmlspecialchars(join(',', $params['_args'])) :
                str_replace('$1', htmlspecialchars($prefix), $_ls2_msg_title);
 
        if ($params['link'])