News:

You may pay someone to create your store, or you visit our seminar and become a professional yourself with the silver certification

Main Menu

Review problem - words that contain "on" and brackets after.

Started by Ventsi Genchev, October 08, 2019, 08:39:55 AM

Previous topic - Next topic

Studio 42

Have you try to dump the $data to check what is inside the $data['comment'] or with vmdebug ?

Ventsi Genchev

Yes of course.

There is no change before and after the FILTER_SANITIZE_STRING. Absolutely no difference:

Array
(
    [vote] => 5
    [comment] => Welcome <script> alert(\"Hi virtuemart\")</script>
    ......
)


But if I add the following:
$data['comment'] = 'Welcome <script> alert(\"Hi virtuemart\")</script>';

before:
$data['comment'] = vRequest::filter($data['comment'],FILTER_SANITIZE_STRING, array());

The result after the FILTER_SANITIZE_STRING is:

Array
(
    [vote] => 5
    [comment] => Welcome  alert(\"Hi virtuemart\")
    ......
)
Audio Store:
https://vsystem.bg - Bulgarian language
https://vsystem.bg/en - English

Studio 42

i think that you have do a mistake.
I tried this and filter is working :


// no HTML TAGS but permit all alphabet
$value = filter_var($data['comment'] , FILTER_SANITIZE_STRING);
/* $value = preg_replace('@<[\/\!]*?[^<>]*?>@si','',$data['comment']);//remove all html tags
$value = (string)preg_replace('#on[a-z](.+?)\)#si','',$value);//replace start of script onclick() onload()... */
$value = trim(str_replace('"', ' ', $value),"'") ;
$data['comment'] = (string)preg_replace('#^\'#si','',$value);//replace ' at start
$data['comment'] = nl2br($data['comment']);  // keep returns

Ventsi Genchev

Patrick, the last file change was made by Max in revision 10172. The purpose is to fix the old code.
http://dev.virtuemart.net/projects/virtuemart/repository/revisions/10172
I test with it and it doesn't work.

Your code doesn't work either.
Just put this in a review:
Welcome <script> alert(\"Hi virtuemart\")</script>
and post it. There is no code cleanup.

Then put the same text here and test:
https://www.w3schools.com/php/phptryit.asp?filename=tryphp_func_sanitize_string

Can you share what text you are testing?
Audio Store:
https://vsystem.bg - Bulgarian language
https://vsystem.bg/en - English

Studio 42

I have done the test with input :
"test<script>my script</script>"
Result was "test my script"

Ventsi Genchev

Very strange. It doesn't work for me.
In all variants (yours or Max's) it doesn't change the text.
Audio Store:
https://vsystem.bg - Bulgarian language
https://vsystem.bg/en - English

Milbo

To see that it got changed, you must open the source in a new tab. Then you will see that for example the < is replaced against &#60
Should I fix your bug, please support the VirtueMart project and become a member
______________________________________
Extensions approved by the core team: http://extensions.virtuemart.net/

Ventsi Genchev

I understand now. I was expecting it to disappear from the text.  :)

Would you also correct the vm_reviews_maximum_comment_length, please.
Must be reviews_maximum_comment_length.

Thank you.
Audio Store:
https://vsystem.bg - Bulgarian language
https://vsystem.bg/en - English

Milbo

Should I fix your bug, please support the VirtueMart project and become a member
______________________________________
Extensions approved by the core team: http://extensions.virtuemart.net/