Flatpress- 1.2.1 - Reflected XSS on page parameter #153

[laborix]

Details here:
https://github.com/flatpressblog/flatpress/issues/153

There is a quick fix for Flatpress 1.2.1 Issue #153 and you only have to change the existing Flatpress code (from 2015!) in only one file.

File: /admin/panels/static/admin.static.write.php
Line: 66 ff

Code: Select all

if (isset($_GET['page'])) {
  $id = $_GET['page'];
  $arr = static_parse($id);
  // if entry does not exists,
  // we print the list
  if ($arr) {
    $this->_makePreview($arr, $id);		
  }
		
}

Replace this lines with the following lines:

Code: Select all

if (isset($_GET['page'])) {
  $id = $_GET['page'];
  $arr = static_parse($id);
  // if entry does not exists,
  // we print the list
  if ($arr) {
    $this->_makePreview($arr, $id);		
  } else {
    $id = '';
    $arr = array();
    $_GET['page'] = '';
    utils_redirect('admin.php?p=static');        
  }
		
} 

regards

[fraenkiman]

Hello Laborix,

I have tested your quick solution.
Once with fp-1.3dev [master (smarty 2.6.31)] and once with fp-1.3dev [master (smarty 4.2.1)].

So it seems that your solution can be used in the current master branch.

I was too free and left a comment in the issue.

With best regards
Frank

[Arvid]

Awesome, thank you very much for taking the time to inspect this and for providing and testing the fix. I just fixed it in the FlatPress code.

And again, you're both so much of help - thanks!