escpaping built-in data array before pushing it to the view, to avoid possible XSS problems (bug 434521, r=clouserw)

git-svn-id: http://svn.mozilla.org/addons/trunk@13323 4eb1ac78-321c-0410-a911-ec516a8615a5

1 files changed, 12 insertions, 0 deletions

diff --git a/site/app/app_controller.php b/site/app/app_controller.php
index 37509c4..8680e9e 100644
--- a/site/app/app_controller.php
+++ b/site/app/app_controller.php
@@ -299,6 +299,18 @@ class AppController extends Controller
     }
     
     /**
+     * beforeRender callback. Sanitizes Cake's built-in data array containing
+     * form data, as it is automatically pushed back to the view unsanitized,
+     * circumventing the publish() function.
+     */
+    function beforeRender() {
+        if (isset($this->data))
+            $this->_sanitizeArray($this->data);
+
+        return parent::beforeRender();
+    }
+    
+    /**
      * html-encode an array, recursively
      * 
      * @param mixed the data array (or string) to be html-encoded (by reference)