Checking of GPC Parameters for valid UTF-8

[cmb]

Hello Community,

CMSimple_XH 1.5.4 introduced the check of all GPC parameters for valid UTF-8. But I overlooked the possibility of array parameters, so these wouldn't be checked. Either we fix this bug by changing the check to:

Code: Select all

function XH_checkValidUtf8($arr)
{
    foreach ($arr as $elt) {
        if (is_array($elt)) {
            XH_checkValidUtf8($elt);
        } elseif (!utf8_is_valid($elt)) {
            header('HTTP/1.0 400 Bad Request'); // TODO: use "Status:" for FastCGI?
            exit('Malformed UTF-8 detected!');
        }
    }
}

XH_checkValidUtf8(array($_GET, $_POST, $_COOKIE)); 

or we remove the check altogether.

Christoph

[svasti]

Where do you suggest to change what??? Which file, which line nr?

[cmb]

Which file, which line nr?

The new code should replace cmsimple/cms.php line 188-195.