Chapril
/
xmpp.chapril.org-ejabberd
mirror of https://github.com/processone/ejabberd.git
24
1
Fork 0
Code Releases Activity

* src/mod_muc/mod_muc_log.erl: Prevent XSS in MUC logs by 

linkifying only a few known protocols (EJAB-850)

SVN Revision: 1879
This commit is contained in:
Badlop 2009-02-16 15:32:54 +00:00
parent 2bd54854ec
commit f6ddd8bc5b
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -1,5 +1,8 @@
2009-02-16 Badlop <badlop@process-one.net>
* src/mod_muc/mod_muc_log.erl: Prevent XSS in MUC logs by
linkifying only a few known protocols (EJAB-850)
* src/mod_muc/mod_muc.erl: Export function to create MUC
room (thanks to Eric Cestari) (EJAB-729)

3
src/mod_muc/mod_muc_log.erl
View File

@ -752,7 +752,8 @@ htmlize2(S1, NoFollow) ->
S2 = element(2, regexp:gsub(S1, "\\&", "\\&amp;")),
S3 = element(2, regexp:gsub(S2, "<", "\\&lt;")),
S4 = element(2, regexp:gsub(S3, ">", "\\&gt;")),
S5 = element(2, regexp:gsub(S4, "[-+.a-zA-Z0-9]+://[^] )\'\"}]+", link_regexp(NoFollow))),
S5 = element(2, regexp:gsub(S4, "(http|https|ftp|mailto|xmpp)://[^] )\'\"}]+",
link_regexp(NoFollow))),
%% Remove 'right-to-left override' unicode character 0x202e
element(2, regexp:gsub(S5, [226,128,174], "[RLO]")).