Changeset 13652

Timestamp:

Aug 11, 2010, 2:56:59 PM (10 years ago)

Author:

imamura623

Message:

google map小窓のXSS対策パッチ適用

Location:

OpenPNE/branches/stable-2.10.x/webapp/modules/pc

Files:

• page/h_googlemap.php (modified) (1 diff)
• templates/h_googlemap.tpl (modified) (3 diffs)

OpenPNE/branches/stable-2.10.x/webapp/modules/pc/page/h_googlemap.php

@@ -17 +17 @@
         
         // --- リクエスト変数
-        $x = $requests['x'];
-        $y = $requests['y'];
-        $z = $requests['z'];
         $t = $requests['t'];
-        $q = $requests['q'];
         // ----------
-        $this->set('x', $x);
-        $this->set('y', $y);
-        $this->set('z', $z);
-        $this->set('q', $q);
+
         //表示モード
         {

OpenPNE/branches/stable-2.10.x/webapp/modules/pc/templates/h_googlemap.tpl

@@ -9 +9 @@
 <!--
 
+// parse request parameters
+var request = {
+  x: "", y: "", z: "", q: ""
+};
+var params = window.location.search.substr(1).split('&');
+for (var i = 0; i < params.length; i++) {
+  var parts = params[i].split('=');
+
+  var n = parts[0];
+  var v = decodeURIComponent(parts[1]);
+  if ("z" == n)
+  {
+    v = parseInt(v);
+  }
+  request[n] = v;
+}
+var MapType = ({$MapType});  // It is not user-inputed values
+
 var gls;
 var gMap;
@@ -16 +34 @@
         var first = gls.results[0];
         var point = new GLatLng(parseFloat(first.lat), parseFloat(first.lng));
-        var zoom = ({$z});
+        var zoom = request.z;
         gMap.addControl(new GSmallMapControl());
         gMap.addControl(new GMapTypeControl());
-        gMap.setMapType(({$MapType}));
+        gMap.setMapType(MapType);
         gMap.setCenter(point, zoom);
         var marker = new GMarker(point);
@@ -28 +46 @@
 function load() {
     if (GBrowserIsCompatible()) {
-        if((({$x}) == 0) && (({$y}) == 0)){
+        if ((request.x == 0) && (request.y == 0)){
                 gMap = new GMap2(document.getElementById("map"));
                 gMap.addControl(new GSmallMapControl());
                 gMap.addControl(new GMapTypeControl());
                 gMap.setCenter(new GLatLng(0, 0));
-
                 gls = new GlocalSearch();
                 gls.setCenterPoint(gMap);
                 gls.setSearchCompleteCallback(null, OnLocalSearch);
-                var q = "({$q})";
+                var q = request.q;
                 gls.execute(q);
-        }else{
-                var point = new GLatLng(({$x}), ({$y}));
-                var zoom = ({$z});
+        } else {
+                var point = new GLatLng(request.x, request.y);
+                var zoom = request.z;
                 gMap = new GMap2(document.getElementById("map"));
                 gMap.addControl(new GSmallMapControl());
                 gMap.addControl(new GMapTypeControl());
                 gMap.setCenter(point, zoom);
-                gMap.setMapType(({$MapType}));
-
+                gMap.setMapType(MapType);
                 var marker = new GMarker(point);
                 gMap.addOverlay(marker);