diff --git a/config/global.ini.php b/config/global.ini.php
index 1005ba5788772c12196cd0ef97bcfa190131f488..426d53cc280ae1e83e413f1572f8709fd709227a 100755
--- a/config/global.ini.php
+++ b/config/global.ini.php
@@ -5,7 +5,7 @@
; For example if you override enable_browser_archiving_triggering,
; edit config/config.ini.php and add the following:
; [General]
-; enable_browser_archiving_triggering = false
+; enable_browser_archiving_triggering = 0
[superuser]
login = root
@@ -30,13 +30,13 @@ port = 3306
adapter = PDO_MYSQL
[Debug]
-; if set to true, the archiving process will always be triggered, even if the archive has already been computed
+; if set to 1, the archiving process will always be triggered, even if the archive has already been computed
; this is useful when making changes to the archiving code so we can force the archiving process
-always_archive_data = false
+always_archive_data = 0
-; if set to true, all the SQL queries will be recorded by the profiler
+; if set to 1, all the SQL queries will be recorded by the profiler
; and a profiling summary will be printed at the end of the request
-enable_sql_profiler = false
+enable_sql_profiler = 0
[General]
; Time in seconds after which an archive will be computed again.
@@ -52,13 +52,13 @@ default_day = yesterday
; You can override the setting to force the user to login.
; This is useful when you have some websites view "anonymous" access but you want to
; force users to login instead of viewing the first anonymous website available
-default_module_login = false
+default_module_login = 0
; When loading the piwik interface in the browser (as opposed to from the PHP-CLI client)
; should we launch the archiving process if the archives have not yet been processed?
-; You want to set it to false when triggering the archiving is done through a crontab,
+; You want to set it to 0 when triggering the archiving is done through a crontab,
; so that your users do not trigger archiving in their browser when this is not expected
-enable_browser_archiving_triggering = true
+enable_browser_archiving_triggering = 1
; character used to automatically create categories in the "Action" "Downloads" reports
; for example a URL like "example.com/blog/development/first-post" will create
@@ -78,10 +78,10 @@ dataTable_default_sort_order = desc
; default number of elements in the datatable
dataTable_default_limit = 10
-; if set to true, the website selector will be displayed in the Piwik UI
+; if set to 1, the website selector will be displayed in the Piwik UI
; if your Piwik installation has thousands of websites, you may disable the website selector
-; as it slows down the loading of the Piwik UI by setting this value to false
-show_website_selector_in_user_interface = true
+; as it slows down the loading of the Piwik UI by setting this value to 0
+show_website_selector_in_user_interface = 1
; PHP minimum required version (minimum requirement known to date = ->newInstanceArgs)
minimum_php_version = 5.1.3
@@ -129,20 +129,20 @@ visit_standard_length = 1800
; visitors that stay on the website and view only one page will be considered staying 10 seconds
default_time_one_page_visit = 10
-; if set to false, any goal conversion will be credited to the last more recent non empty referer.
-; when set to true, the first ever referer used to reach the website will be used
-use_first_referer_to_determine_goal_referer = false
+; if set to 0, any goal conversion will be credited to the last more recent non empty referer.
+; when set to 1, the first ever referer used to reach the website will be used
+use_first_referer_to_determine_goal_referer = 0
-; if set to true, Piwik will try to match visitors without cookie to a previous visitor that has the same
+; if set to 1, Piwik will try to match visitors without cookie to a previous visitor that has the same
; configuration: OS, browser, resolution, IP, etc. This heuristic adds an extra SQL query for each page view without cookie.
-; it is advised to set it to true for more accurate detection of unique visitors.
-; However when most users have the same IP, and the same configuration, it is advised to set it to false
-enable_detect_unique_visitor_using_settings = true
+; it is advised to set it to 1 for more accurate detection of unique visitors.
+; However when most users have the same IP, and the same configuration, it is advised to set it to 0
+enable_detect_unique_visitor_using_settings = 1
-; if set to true, Piwik attempts a "best guess" at the visitor's country of
+; if set to 1, Piwik attempts a "best guess" at the visitor's country of
; origin when the preferred language tag omits region information.
; The mapping is defined in core/DataFiles/LanguageToCountry.php,
-enable_language_to_country_guess = true
+enable_language_to_country_guess = 1
; name of the cookie used to store the visitor information
cookie_name = piwik_visitor
@@ -213,7 +213,7 @@ cache_dir = tmp/cache
error_reporting = E_ALL|E_NOTICE
; allow smarty debugging using {debug}
-debugging = true
+debugging = 1
[Plugins]
diff --git a/core/Config.php b/core/Config.php
index 8e67e46268238d4ae3b344a720ec691c73c51989..9338faa83323134d4a282eb7b5384e1a0dd2c99d 100644
--- a/core/Config.php
+++ b/core/Config.php
@@ -144,12 +144,15 @@ class Piwik_Config
else
{
$value = htmlentities($value);
- $configFile .= $name.' = "'.$value.'"'."\n";
+ if(!is_numeric($value))
+ {
+ $value = "\"$value\"";
+ }
+ $configFile .= $name.' = '.$value."\n";
}
}
$configFile .= "\n";
}
-
chdir($this->correctCwd);
file_put_contents($this->getDefaultUserConfigPath(), $configFile );
}
diff --git a/tests/resources/referer-xss.txt b/tests/resources/referer-xss.txt
index 9bee9422d12a660f2cd7cc772a3213c6abdc540c..e0defb172503e751b134de9d69a4a0ff623f8489 100644
--- a/tests/resources/referer-xss.txt
+++ b/tests/resources/referer-xss.txt
@@ -3,9 +3,10 @@ Manual regression test procedure for XSS referer
1. set in the config.ini.php
[Tracker]
visit_standard_length = 1
-enable_detect_unique_visitor_using_settings = false
+enable_detect_unique_visitor_using_settings = 0
+
[Debug]
-always_archive_data = true
+always_archive_data = 1
2. go to /misc/testJavascriptTracker/ and fake the referer using, eg. RefControl options Firefox extension
http://www.google.co.uk/search?hl=en&q=<script>alert('test');</script>