Skip to content

Instantly share code, notes, and snippets.

@xxorax

xxorax/jsQuoteEscapeTest.php

Created May 19, 2016 10:15
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save xxorax/1c9653fd59785085f96d4f676bc64ee2 to your computer and use it in GitHub Desktop.
Save xxorax/1c9653fd59785085f96d4f676bc64ee2 to your computer and use it in GitHub Desktop.
Download ZIP
Magento jsQuoteEscape security test
Raw
jsQuoteEscapeTest.php
<?php
$mageFilename = dirname(__FILE__).'/app/Mage.php';
require_once($mageFilename);
$mageRunCode = isset($_SERVER['MAGE_RUN_CODE']) ? $_SERVER['MAGE_RUN_CODE'] : '';
$mageRunType = isset($_SERVER['MAGE_RUN_TYPE']) ? $_SERVER['MAGE_RUN_TYPE'] : 'store';
Mage::init($mageRunCode, $mageRunType);
$test = 'test\\\'+alert("powned");//';
echo '<html><script>var test = \''.Mage::helper('core')->jsQuoteEscape($test).'\';</script>';
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment