Chapril/date.chapril.org-framadate
Chapril/date.chapril.org-framadate
24
1
Fork 0
Code Issues Pull Requests Releases Activity

Merge branch 'fix-graph-xss' into 'v1.1.x'

Browse Source 
Fix an XSS in the result graph

See merge request framasoft/framadate/framadate!493
This commit is contained in:
Thomas Citharel 2021-10-18 14:12:34 +00:00
commit 6e40f1cf02
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/inc/smarty.php
View File

@ -73,6 +73,10 @@ function smarty_modifier_addslashes_single_quote($string) {
return addcslashes($string, '\\\''); return addcslashes($string, '\\\'');
} }
function smarty_modifier_addslashes($string) {
return addslashes($string);
}
function smarty_modifier_html($html) { function smarty_modifier_html($html) {
return Utils::htmlEscape($html); return Utils::htmlEscape($html);
} }

2
tpl/part/vote_table_classic.tpl
View File

@ -282,7 +282,7 @@
}); });
var cols = [ var cols = [
{foreach $slots as $id=>$slot} {foreach $slots as $id=>$slot}
$('<div/>').html('{$slot->title|markdown:true}').text(), "{$slot->title|markdown:true|addslashes}",
{/foreach} {/foreach}
]; ];