AWStats Patch for [ 2001151 ] XSS Issue

[khan2002]

Hy,

I've tried both and both not working on my Debian :

PHP Code:

patching file awstats.pl
Hunk #1 succeeded at 4394 (offset 18 lines).
Hunk #2 FAILED at 4446.
1 out of 2 hunks FAILED -- saving rejects to file awstats.pl.rej 


and in the awstats.pl.rej I find:

PHP Code:

*** awstats.pl    
--- awstats.pl.orig    
***************
*** 4376,4382 ****
  sub DecodeEncodedString {
      my $stringtodecode=shift;
      $stringtodecode =~ tr/\+/ /s;
-     $stringtodecode =~ s/%22//g;
      $stringtodecode =~ s/%([A-F0-9][A-F0-9])/pack("C", hex($1))/ieg;
      return $stringtodecode;
  }
--- 4376,4381 ----
***************
*** 4429,4440 ****
  #------------------------------------------------------------------------------
  sub CleanXSS {
      my $stringtoclean=shift;
-     # To avoid html tags and javascript
      $stringtoclean =~ s/</</g;
      $stringtoclean =~ s/>/>/g;
      $stringtoclean =~ s/|//g;
-     # To avoid onload="
-     $stringtoclean =~ s/onload//g;
      return $stringtoclean;
  }
  
--- 4428,4436 ---- 


Anyone an idea?[/php][/quote]