From d9fbdae75801d00227b0295b56f997c5af00e899 Mon Sep 17 00:00:00 2001
From: Michael Gapczynski <GapczynskiM@gmail.com>
Date: Thu, 10 May 2012 10:26:12 -0400
Subject: [PATCH] Prevent XSS exploit by checking if path-info is set, thanks
 to Lukas Reschke

---
 lib/json.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/json.php b/lib/json.php
index 0d208ce12a2..6782bad8bb7 100644
--- a/lib/json.php
+++ b/lib/json.php
@@ -73,9 +73,11 @@ class OC_JSON{
 	* Encode and print $data in json format
 	*/
 	public static function encodedPrint($data,$setContentType=true){
-		if($setContentType){
-			self::setContentTypeHeader();
+		if(!isset($_SERVER['PATH_INFO'])) {
+			if($setContentType){
+				self::setContentTypeHeader();
+			}
+			echo json_encode($data);
 		}
-		echo json_encode($data);
 	}
 }
-- 
2.39.5