[patch] Updated patch for security hole

tikiwiki.patch (text/plain), 1.07 KB, created by Stuart Herbert (RETIRED) on 2005-07-05 16:12:46 UTC

--- tikiwiki-1.8.5/lib/xmlrpc.inc.old	2005-07-04 22:45:18.000000000 +0200
+++ tikiwiki-1.8.5/lib/xmlrpc.inc	2002-10-15 17:42:38.000000000 +0200
@@ -160,7 +160,7 @@
 		$_xh[$parser]['qt']=0;
 	  break;
 	case "NAME":
-	  $_xh[$parser]['st'].="'"; $_xh[$parser]['ac']="";
+	  $_xh[$parser]['st'].='"'; $_xh[$parser]['ac']="";
 	  break;
 	case "FAULT":
 	  $_xh[$parser]['isf']=1;
@@ -225,7 +225,7 @@
 	  $_xh[$parser]['cm']--;
 	  break;
 	case "NAME":
-	  $_xh[$parser]['st'].= $_xh[$parser]['ac'] . "' => ";
+	  $_xh[$parser]['st'].= $_xh[$parser]['ac'] . '" => ';
 	  break;
 	case "BOOLEAN":
 		// special case here: we translate boolean 1 or 0 into PHP
@@ -246,7 +246,7 @@
 			// we use double quotes rather than single so backslashification works OK
 			$_xh[$parser]['st'].="\"". $_xh[$parser]['ac'] . "\""; 
 		} else if ($_xh[$parser]['qt']==2) {
-			$_xh[$parser]['st'].="base64_decode('". $_xh[$parser]['ac'] . "')"; 
+			$_xh[$parser]['st'].='base64_decode("'. $_xh[$parser]['ac'] . '")'; 
 		} else if ($name=="BOOLEAN") {
 			$_xh[$parser]['st'].=$_xh[$parser]['ac'];
 		} else {