Merge pull request #74 from kpcyrd/vichan-player

Suppress warnings that might leak information in player.php

1 files changed, 8 insertions, 5 deletions

diff --git a/player.php b/player.php
index 33f02215..d1a76a86 100644
--- a/player.php
+++ b/player.php
@@ -1,12 +1,15 @@
 <?php 
 /* This file is dedicated to the public domain; you may do as you wish with it. */
-$params = '?v=' . urlencode($_GET['v']) . '&amp;t=' . urlencode($_GET['t']);
-$loop = ($_GET['loop'] != "0");
+$v = @(string)$_GET['v'];
+$t = @(string)$_GET['t'];
+$loop = @(boolean)$_GET['loop'];
+
+$params = '?v=' . urlencode($v) . '&amp;t=' . urlencode($t);
 ?><!DOCTYPE html>
 <html>
 <head>
     <meta charset="utf-8">
-    <title><?php echo htmlspecialchars($_GET['t']); ?></title>
+    <title><?php echo htmlspecialchars($t); ?></title>
     <link rel="stylesheet" href="stylesheets/webm/playerstyle.css">
     <script src="js/webm-settings.js"></script>
     <script src="js/webm/playersettings.js"></script>
@@ -17,8 +20,8 @@ $loop = ($_GET['loop'] != "0");
         <a id="loop1" href="<?php echo $params; ?>&amp;loop=1"<?php if ($loop) echo ' style="font-weight: bold"'; ?>>[loop]</a>
     </div>
     <div id="playercontent">
-        <video controls<?php if ($loop) echo ' loop'; ?> src="<?php echo htmlspecialchars($_GET['v']); ?>">
-            Your browser does not support HTML5 video. <a href="<?php echo htmlspecialchars($_GET['v']); ?>">[Download]</a>
+        <video controls<?php if ($loop) echo ' loop'; ?> src="<?php echo htmlspecialchars($v); ?>">
+            Your browser does not support HTML5 video. <a href="<?php echo htmlspecialchars($v); ?>">[Download]</a>
         </video>
     </div>
 </body>