Details
-
Type:
Bug
-
Status: Done/Fixed
-
Priority:
Major
-
Resolution: Duplicate
-
Affects Version/s: 4.7.5
-
Fix Version/s: None
-
Component/s: Core CiviCRM
-
Labels:
-
Documentation Required?:None
-
Funding Source:Contributed Code
Description
It would appear that looking at the code in CRM/Contact/Page/Ajax.php that we are mixing in both unsanitised $_GET params and the sanitised versions..
This to me could be a recipie for problems. It also is apparent that not all of the $_GET paramaters that are manipulated get sanitised as they are manipulated.