From 8c0f7853519cd9747cc5c8dff26f9d0099943cf7 Mon Sep 17 00:00:00 2001 From: RD WebDesign Date: Sun, 13 Jul 2025 02:55:19 -0300 Subject: [PATCH] Replace `mg.request_info.request_uri` with the variable `scriptname` The information from `mg.request_info.request_uri` depends on the URL typed by the user. This information was used without any sanitization, allowing an attacker to send crafted links containing anything, including javascript code, which could be loaded and executed in a few pages. Replacing this value with `scriptname` variable fixes the issue, since this variable contains the name of the file currently being executed. This information cannot be externally manipulated and it is safe to be used on the page. Signed-off-by: RD WebDesign --- error403.lp | 2 +- error404.lp | 2 +- login.lp | 2 +- scripts/lua/header_authenticated.lp | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/error403.lp b/error403.lp index eb28cb64..f777938a 100644 --- a/error403.lp +++ b/error403.lp @@ -10,7 +10,7 @@ mg.include('scripts/lua/header.lp','r') ?> - +