Pluginloader and escaping

[cmb]

Hello Developers,

I've found an issue regarding the pluginloader and its way to handle escape characters (particularly when magic_quotes_gpc is On). The following changes might suffice:

Code: Select all

Index: index.php
===================================================================
--- index.php	(revision 2)
+++ index.php	(working copy)
@@ -526,7 +526,7 @@
         if (!empty($plugin)) {
             $save_data .= '[\'' . $plugin . '\']';
         }
-        $save_data .= '[\'' . $key . '\']="' . trim(str_replace("\\'", "'", ((get_magic_quotes_gpc() === 1) ? $value : addslashes($value)))) . '";' . "\n";
+        $save_data .= '[\'' . $key . '\']="' . addcslashes($value, "\n\r\t\\\$\"") . '";' . "\n";
     }
     $save_data .= "\n?>";
     return $save_data;
@@ -819,13 +819,13 @@
             $config_data = ARRAY();
             foreach ($data as $key => $value) {
                 global $pluginloader_cfg;
-                $config_data[$key] = $_POST[$pluginloader_cfg['form_namespace'] . $key];
+                $config_data[$key] = stsl($_POST[$pluginloader_cfg['form_namespace'] . $key]);
             }
             $save_data = PluginPrepareConfigData($var_name, $config_data, $plugin);
         }
         if ($action == 'plugin_textsave') {
-            $text_data = $_POST[$var_name];
-            $save_data = PluginPrepareTextData($text_data);
+            $text_data = stsl($_POST[$var_name]);
+            $save_data = $text_data;
         }
         $is_saved = PluginWriteFile($pth['file'][$admin], $save_data);
         $t .= tag('br') . '<b>' . $is_saved['msg'] . '</b>' . tag('br');

About PluginPrepareTextData(): this has exactly the same functionality as stsl() (in cmsimple/cms.php). So it might be considered to deprecate the function, and remove it sometime in the future. But however: the comment "Prepare text data for writing to file." is misleading. Stripping the slashes this way has to be done on the GPC data before any further processing, not just before writing these to a file.

Christoph