Fixed vulnerability in xmms.pl where names with \n or \r can execute IRC commands

diff --git a/perl/xmms.pl b/perl/xmms.pl
index d68fe35d9980db91067dcecffcb23c3bd2831d6a..a454b40b55e97ec69b93bfbcfd8002db95e752d6 100644 (file)
--- a/perl/xmms.pl
+++ b/perl/xmms.pl
@@ -32,7 +32,11 @@
 #                                                                   #
 #####################################################################
 
-weechat::register ("xmms", "1.1", "", "xmms info script (usage: /xmms)");
+# FlashCode <flashcode@flashtux.org>, 2007-11-02, version 1.2:
+#   Fix vulnerability where names with \n or \r can execute IRC commands:
+#   See http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4398
+
+weechat::register ("xmms", "1.2", "", "xmms info script (usage: /xmms)");
 weechat::add_command_handler ("xmms", xmmsinfo);
 
 sub xmmsinfo {
@@ -49,12 +53,14 @@ sub xmmsinfo {
             push @db,$tmp;
         }
     }
+    $db[12] =~ s/[\n\r]/ /g;
     if (($db[7]!=-1) && ($db[7]!=0)) 
     {
         weechat::command("/me np: $db[12]");
     }
     else
     {
+        $db[13] =~ s/[\n\r]/ /g;
         weechat::command("/me np: $db[12] ($db[13])");
     }
     @db = ();