From e1d144b5da15acbe991f1d006a152fc552aa12c3 Mon Sep 17 00:00:00 2001
From: root <root@www.cacert.org>
Date: Sun, 23 Nov 2008 04:28:20 +0000
Subject: [PATCH] Added XSS protection

---
 pages/account/19.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pages/account/19.php b/pages/account/19.php
index 1f2264f..6a2749c 100644
--- a/pages/account/19.php
+++ b/pages/account/19.php
@@ -18,7 +18,7 @@
 <?
 	$certid = 0; if(array_key_exists('cert',$_REQUEST)) $certid=intval($_REQUEST['cert']);
 
-	$query = "select * from `orgemailcerts`,`org` where `orgemailcerts`.`id`='$certid' and
+	$query = "select * from `orgemailcerts`,`org` where `orgemailcerts`.`id`='".intval($certid)."' and
 			`org`.`memid`='".intval($_SESSION['profile']['id'])."' and
 			`org`.`orgid`=`orgemailcerts`.`orgid`";
 	$res = mysql_query($query);
@@ -39,7 +39,9 @@
 		{
 			header("Content-Type: application/x-x509-user-cert");
 			header("Content-Length: ".strlen($cert));
-			header('Content-Disposition: inline; filename="'.$row['CN'].'.crt"');
+			$fname=sanitizeFilename($row['CN']);
+			if($fname=="") $fname="certificate";
+			header('Content-Disposition: inline; filename="'.$fname.'.crt"');
 			echo $cert;
 			exit;
 		} else {