XSS patch for basercms-1.6.13.1

baser_xss_patch.diff

--- basercms/baser/views/helpers/baser.php	2011-07-19 20:58:05.000000000 +0900
+++ basercms-1.6.13.1/baser/views/helpers/baser.php	2011-08-16 18:34:52.000000000 +0900
@@ -676,7 +676,7 @@
  * コンテンツ名を取得する
  * ・キャメルケースで取得
  * ・URLのコントローラー名までを取得
- * ・ページの場合は、カテゴリ名（カテゴリがない場合はdefault）
+ * ・ページの場合は、カテゴリ名（カテゴリがない場合はDefault）
  * @return string
  */
 	function getContentsName($detail = false) {
@@ -691,21 +691,23 @@
 		$url2 = '';
 
 		if(!empty($this->params['prefix'])) {
-			$prefix = $this->params['prefix'];
+			$prefix = h($this->params['prefix']);
 		}
 		if(!empty($this->params['plugin'])) {
-			$plugin = $this->params['plugin'];
+			$plugin = h($this->params['plugin']);
 		}
-		$controller = $this->params['controller'];
+		$controller = h($this->params['controller']);
 		if($prefix) {
-			$action = str_replace($prefix.'_','',$this->params['action']);
+			$action = str_replace($prefix.'_', '', h($this->params['action']));
 		}else {
-			$action = $this->params['action'];
+			$action = h($this->params['action']);
 		}
-		if(!empty($this->params['pass'][0])) {
-			$pass = $this->params['pass'];
+		if(!empty($this->params['pass'])) {
+			foreach($this->params['pass'] as $key => $value) {
+				$pass[$key] = h($value);
+			}
 		}
-		$url = split('/',$this->params['url']['url']);
+		$url = split('/', h($this->params['url']['url']));
 		if(isset($url[0])) {
 			$url0 = $url[0];
 		}
@@ -719,21 +721,28 @@
 		// ページ機能の場合
 		if($controller=='pages' && $action=='display') {
 			
-			if(strpos($this->params['pass'][0], 'pages/') !== false) {
-				$pageUrl = str_replace('pages/','',$this->params['pass'][0]);
+			if(strpos($pass[0], 'pages/') !== false) {
+				$pageUrl = str_replace('pages/','', $pass[0]);
 			} else {
-				$pageUrl = $this->params['url']['url'];
+				$pageUrl = h($this->params['url']['url']);
+			}
+			
+			$pageUrl = preg_replace('/\.html$/', '', $pageUrl);
+			
+			if(preg_match('/^[^\/]/', $pageUrl)) {
+				$pageUrl = '/'.$pageUrl;
 			}
-			$pos = strpos($pageUrl,'.html');
-			if($pos !== false) {
-				$pageUrl = substr($pageUrl, 0, $pos);
+			if(preg_match('/\/$/', $pageUrl)) {
+				$pageUrl .= 'index';
 			}
+			
 			if(!$detail) {
 				$aryPageUrl = split('/',$pageUrl);
 				$controller = $aryPageUrl[0];
 			} else {
 				return Inflector::camelize(str_replace('/', '_', $pageUrl));
 			}
+			
 		}
 
 		// プラグインルーティングの場合
@@ -758,6 +767,10 @@
 
 		$contentsName = Inflector::camelize($contentsName);
 
+		if(!$contentsName) {
+			$contentsName = 'Default';
+		}
+		
 		return $contentsName;
 
 	}