脆弱性

------------------------------------------
脆弱性の種類
------------------------------------------
XSS
-----------------------------------------
脆弱性のあるファイル
-----------------------------------------
data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php
-----------------------------------------
対策
-----------------------------------------
=========================================
変更前 67行目付近
=========================================


if (isset($_GET['page'])) {
    $ParentPage = $_GET['page'];
}

=========================================
変更後 67行目付近
=========================================
if (isset($_GET['page'])) {
   $ParentPage = htmlspecialchars($_GET['page'],ENT_QUOTES);
}


=========================================
変更前 87行目付近
=========================================

$ob$this->tpl_onload = "fnUpdateParent('". $this->getLocation($_POST['ParentPage']) ."'); window.close();";

=========================================
変更後 87行目付近
=========================================

if( $_POST['ParentPage'] == MYPAGE_DELIVADDR_URL || $_POST['ParentPage'] == URL_DELIV_TOP ){
    $this->tpl_onload = "fnUpdateParent('". $this->getLocation($_POST['ParentPage']) ."'); window.close();";
}else{
    SC_Utils_Ex::sfDispSiteError(CUSTOMER_ERROR);
}