Fix an XSS in the result graph

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
This commit is contained in:
Thomas Citharel 2021-07-19 11:17:00 +02:00
parent e0028dc813
commit 02229c671b
No known key found for this signature in database
GPG Key ID: A061B9DDE0CA0773
2 changed files with 5 additions and 1 deletions

View File

@ -73,6 +73,10 @@ function smarty_modifier_addslashes_single_quote($string) {
return addcslashes($string, '\\\''); return addcslashes($string, '\\\'');
} }
function smarty_modifier_addslashes($string) {
return addslashes($string);
}
function smarty_modifier_html($html) { function smarty_modifier_html($html) {
return Utils::htmlEscape($html); return Utils::htmlEscape($html);
} }

View File

@ -282,7 +282,7 @@
}); });
var cols = [ var cols = [
{foreach $slots as $id=>$slot} {foreach $slots as $id=>$slot}
$('<div/>').html('{$slot->title|markdown:true}').text(), "{$slot->title|markdown:true|addslashes}",
{/foreach} {/foreach}
]; ];