浏览代码

Fixed vulnerability in json.php caused my missing Content-Type header

Federico Dossena 1 年之前
父节点
当前提交
dd1ce2cb88
共有 2 个文件被更改,包括 7 次插入4 次删除
  1. 6 3
      results/json.php
  2. 1 1
      speedtest.js

+ 6 - 3
results/json.php

@@ -1,5 +1,8 @@
 <?php
 
+error_reporting(0);
+header('Content-Type: application/json; charset=utf-8');
+
 require_once 'telemetry_db.php';
 
 /**
@@ -53,7 +56,7 @@ function formatSpeedtestData($speedtest)
 $speedtest = getSpeedtestUserById($_GET['id']);
 if (!is_array($speedtest)) {
     echo '{}';
+} else {
+    $speedtest = formatSpeedtestData($speedtest);
+    echo json_encode(array('timestamp'=>$speedtest['timestamp'],'download'=>$speedtest['dl'],'upload'=>$speedtest['ul'],'ping'=>$speedtest['ping'],'jitter'=>$speedtest['jitter'],'ispinfo'=>$speedtest['ispinfo']));
 }
-$speedtest = formatSpeedtestData($speedtest);
-
-echo json_encode(array('timestamp'=>$speedtest['timestamp'],'download'=>$speedtest['dl'],'upload'=>$speedtest['ul'],'ping'=>$speedtest['ping'],'jitter'=>$speedtest['jitter'],'ispinfo'=>$speedtest['ispinfo']));

+ 1 - 1
speedtest.js

@@ -49,7 +49,7 @@ function Speedtest() {
   this._settings = {}; //settings for the speed test worker
   this._state = 0; //0=adding settings, 1=adding servers, 2=server selection done, 3=test running, 4=done
   console.log(
-    "LibreSpeed by Federico Dossena v5.3.0 - https://github.com/librespeed/speedtest"
+    "LibreSpeed by Federico Dossena v5.3.1 - https://github.com/librespeed/speedtest"
   );
 }