Changeset 15879

Timestamp:

2007/09/21 20:39:02 (17 years ago)

Author:

nanasess

Message:

$_SERVERPHP_SELF? をサニタイズ

File:

• branches/feature-module-update/data/class/SC_PageNavi.php (modified) (4 diffs)

branches/feature-module-update/data/class/SC_PageNavi.php

@@ -28 +28 @@
     function SC_PageNavi($now_page, $all_row, $page_row, $func_name, $navi_max = NAVI_PMAX) {
         $this->arrPagenavi['mode'] = 'search';
+        $ps = htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES);
 
         //現在ページ($now_page)が正しい数値でない場合
@@ -59 +60 @@
             // FIXME ちゃんとサニタイズしよう
             if ($this->now_page > 1) {
-                $before="<a href=\"". $_SERVER['PHP_SELF']. "\" onclick=\"$func_name('" . (($this->now_page) - 1) . "'); return false;\"><<前へ</a> ";
+                $before="<a href=\"". $ps . "\" onclick=\"$func_name('" . (($this->now_page) - 1) . "'); return false;\"><<前へ</a> ";
                 $this->arrPagenavi['before'] = ($this->now_page) - 1;
             }else{
@@ -66 +67 @@
 
             if ($this->now_page < $this->max_page) {
-                $next="<a href=\"". $_SERVER['PHP_SELF']. "\" onclick=\"$func_name('" . (($this->now_page) + 1) ."'); return false;\">次へ>></a> ";
+                $next="<a href=\"". $ps . "\" onclick=\"$func_name('" . (($this->now_page) + 1) ."'); return false;\">次へ>></a> ";
                 $this->arrPagenavi['next'] = ($this->now_page) + 1;
             }else{
@@ -106 +107 @@
                     $page_number .= "<strong>$i</strong> ";
                 } else {
-                    $page_number.="<a href=\"". $_SERVER['PHP_SELF']. "\" onclick=\"$func_name('$i'); return false;\">$i</a> ";
+                    $page_number.="<a href=\"".  $ps . "\" onclick=\"$func_name('$i'); return false;\">$i</a> ";
                 }