Merge branch 'master' of https://github.com/unacms/una

inc/classes/BxDolDb.php

@@ -1374,7 +1374,7 @@ class BxDolDb extends BxDolFactory implements iBxDolSingleton
 			$sOutput .= '<div><b>Settings:</b></div><div style="overflow:scroll;height:300px;border:1px solid gray;"><pre>' . htmlspecialchars_adv($sSettings) . '</pre></div>';
 		}
 
-		$sOutput .= '<p><b>Called script:</b><br />' . $_SERVER['PHP_SELF'] . '</p>';
+        $sOutput .= '<p><b>Called script:</b><br />' . htmlspecialchars_adv($_SERVER['PHP_SELF']) . '</p>';
 
 		if(!empty($_REQUEST)) {
 			$sRequest = var_export($_REQUEST, true);

inc/utils.inc.php

@@ -659,14 +659,14 @@ function getVisitorIP()
     $ip = "0.0.0.0";
     if (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
         $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
-    } elseif (isset( $_SERVER['HTTP_CLIENT_IP']) && !empty($_SERVER['HTTP_CLIENT_IP'])) {
-        $ip = explode(".",$_SERVER['HTTP_CLIENT_IP']);
-        $ip = $ip[3].".".$ip[2].".".$ip[1].".".$ip[0];
+    } elseif (isset($_SERVER['HTTP_CLIENT_IP']) && !empty($_SERVER['HTTP_CLIENT_IP'])) {
+        $ip = $_SERVER['HTTP_CLIENT_IP'];
     } elseif (!isset( $_SERVER['HTTP_X_FORWARDED_FOR']) || empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
         if (!isset( $_SERVER['HTTP_CLIENT_IP']) && empty($_SERVER['HTTP_CLIENT_IP']) && isset($_SERVER['REMOTE_ADDR']))
             $ip = $_SERVER['REMOTE_ADDR'];
     }
-    return $ip;
+
+    return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : "0.0.0.0";
 }
 
 function genFlag($sLang = '', $oTemplate = null)