Changeset 1201 for trunk/TipsContrib/data/System/TipsTopics.txt

Timestamp:

12/07/08 17:13:55 (3 years ago)

Author:

KennethLavrsen

Message:

Item375: Eliminate use of URLPARAM in docs so it becomes an XSS trap
Done with the System web topics now

File:

• trunk/TipsContrib/data/System/TipsTopics.txt (modified) (1 diff)

trunk/TipsContrib/data/System/TipsTopics.txt

@@ -7 +7 @@
 Search (perl regular expression): <input name="searchfor" type="text" value="%URLPARAM{"searchfor" default="Enter search keywords here"}%" size="100" />
 </form>
-%SEARCH{ "%URLPARAM{"searchfor" default="search results go here"}%" topic="*TipTopic*" type="keyword" web="%SYSTEMWEB%, %MAINWEB%" format="     * [[$web.$topic][$pattern(.*?\-\-\-\+([^\n\r]+).*)]]:$n()       $summary(noheader, 100)$n()$percntCALC{$SETM(total, +1)}$percnt"}%
+%SEARCH{ "%URLPARAM{"searchfor" encode="quote" default="search results go here"}%" topic="*TipTopic*" type="keyword" web="%SYSTEMWEB%, %USERSWEB%" format="     * [[$web.$topic][$pattern(.*?\-\-\-\+([^\n\r]+).*)]]:$n()       $summary(noheader, 100)$n()$percntCALC{$SETM(total, +1)}$percnt"}%
 
 Total: %CALC{$GET(total)}% tips