stian/gallery3
1
0
Fork 0
mirror of https://github.com/Pathduck/gallery3.git synced 2026-07-10 17:29:18 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix XSS vectors in HTML attributes (mostly t() calls)

Browse Source
This commit is contained in:
Andy Staudacher
2009-08-31 21:51:57 -07:00
parent 8c3a2db380
commit 2bc73e2e36
24 changed files with 63 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
modules/rss/views/feed.mrss.php
View File

@@ -22,25 +22,25 @@
<lastBuildDate><?= $pub_date ?></lastBuildDate>
<? foreach ($feed->children as $child): ?>
<item>
<title><?= html::clean($child->title) ?></title>
<title><?= html::purify($child->title) ?></title>
<link><?= url::abs_site("{$child->type}s/{$child->id}") ?></link>
<guid isPermaLink="true"><?= url::abs_site("{$child->type}s/{$child->id}") ?></guid>
<pubDate><?= date("D, d M Y H:i:s T", $child->created); ?></pubDate>
<content:encoded>
<![CDATA[
<span><?= html::clean($child->description) ?></span>
<span><?= html::purify($child->description) ?></span>
<p>
<? if ($child->type == "photo" || $child->type == "album"): ?>
<img alt="" src="<?= $child->resize_url(true) ?>"
title="<?= html::clean($child->title) ?>"
title="<?= html::purify($child->title)->for_html_attr() ?>"
height="<?= $child->resize_height ?>" width="<?= $child->resize_width ?>" /><br />
<? else: ?>
<a href="<?= url::abs_site("{$child->type}s/{$child->id}") ?>">
<img alt="" src="<?= $child->thumb_url(true) ?>"
title="<?= html::clean($child->title) ?>"
title="<?= html::purify($child->title)->for_html_attr() ?>"
height="<?= $child->thumb_height ?>" width="<?= $child->thumb_width ?>" /></a><br />
<? endif ?>
<?= html::clean($child->description) ?>
<?= html::purify($child->description) ?>
</p>
]]>
</content:encoded>