cron-manager
cron-manager copied to clipboard
Possible XSS vulnerability in Codeigniter
Hello,
I would like to report for possible XSS vulnerability with date_begin and date_end.
In file cron-manager-master\examples\codeigniter\application\controllers\TasksController.php
public function tasksReport()
{
$date_begin = isset($_GET['date_begin']) ? $_GET['date_begin'] : date('Y-m-d', strtotime('-6 day'));
$date_end = isset($_GET['date_end']) ? $_GET['date_end'] : date('Y-m-d');
$this->load->view('tasks/report', array(
'report' => Task::getReport($date_begin, $date_end),
'date_begin' => $date_begin,
'date_end' => $date_end,
));
}
In file cron-manager-master\examples\codeigniter\application\views\tasks\report.php
<div class="form-group">
<label for="date_begin" class="control-label">Date begin</label>
<input type="date" value="<?= $date_begin ?>" name="date_begin" id="date_begin" class="form-control">
</div>
<div class="form-group">
<label for="date_end" class="control-label">Date end</label>
<input type="date" value="<?= $date_end ?>" name="date_end" id="date_end" class="form-control">
</div>
Hello @enferas. Thanks for reaching out. Sorry about very late response, I was genuinely going to make changes, but I don't have time for this project. The changes in code looks pretty straightforward, but I don't use PHP anymore, so it's more complicated for me to just set up the environment. If you make a PR with changes I'll be happy to merge it.