The manage from yicenburan

manage's People

Contributors

Stargazers

Watchers

manage's Issues

Possible XSS vilnerability

Hello,

I would like to report to XSS vulnerability.

The path of the vulnerability.

In file Application/Home/Controller/GoodsController.class.php, line 21

public function postGoods(){
		$postData = $_POST;
		$add=true;
		$this->upload($postData,$add);  
	}

line 53

public function upload($postData,$isAdd){
	    //...
	    	$add['title']=$postData['title'];
	    	$add['price']=$postData['price'];
	    	$add['img']=$info['picture']['savepath'].$info['picture']['savename'];

	    	if($isAdd){
	    		$this->addGoods($add);
	    	}
          //...
	    }
	}

line 77

public function addGoods($addGoods){
		// ...
		if($result >= 0){
			$data=array(
				code=>'0',
				msg=>'添加成功',
				data=>$addGoods
			);
			$this->ajaxReturn($data);
		}
               // ...
	}

In file ThinkPHP/Mode/Api/Controller.class.php
line 55

protected function ajaxReturn($data,$type='') {
        if(empty($type)) $type  =   C('DEFAULT_AJAX_RETURN');
        switch (strtoupper($type)){
            case 'JSON' :
                // 返回JSON数据格式到客户端 包含状态信息
                header('Content-Type:application/json; charset=utf-8');
                exit(json_encode($data));
            case 'XML'  :
                // 返回xml格式数据
                header('Content-Type:text/xml; charset=utf-8');
                exit(xml_encode($data));
            case 'JSONP':
                // 返回JSON数据格式到客户端 包含状态信息
                header('Content-Type:application/json; charset=utf-8');
                $handler  =   isset($_GET[C('VAR_JSONP_HANDLER')]) ? $_GET[C('VAR_JSONP_HANDLER')] : C('DEFAULT_JSONP_HANDLER');
                exit($handler.'('.json_encode($data).');');  
            case 'EVAL' :
                // 返回可执行的js脚本
                header('Content-Type:text/html; charset=utf-8');
                exit($data);            
        }
    }