public/gallery3-contrib
Archived
1
0
Fork 0
Code Releases Activity

use html::purify on album titles to prevent XSS

Browse Source
This commit is contained in:
Bharat Mediratta 2012-02-29 07:35:40 -08:00
parent c144af904a
commit a7a222aa34
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
3.0/modules/albumtree/views/albumtree_block_dtree.html.php
View File

@ -398,7 +398,7 @@ albumTree.config.cookieDomain = '';
<? <?
function addtree($album){ function addtree($album){
?> ?>
albumTree.add(<?= $album->id -1 ?>, <?= $album->parent_id -1 ?>, "<?= $album->title ?>", pf+'<?= $album->relative_url() ?>'); albumTree.add(<?= $album->id -1 ?>, <?= $album->parent_id -1 ?>, "<?= html::purify($album->title) ?>", pf+'<?= $album->relative_url() ?>');
<? <?
foreach ($album->viewable()->children(null, null, array(array("type", "=", "album"))) as $child){ foreach ($album->viewable()->children(null, null, array(array("type", "=", "album"))) as $child){
addtree($child); addtree($child);

2
3.0/modules/albumtree/views/albumtree_block_list.html.php
View File

@ -15,7 +15,7 @@ function makelist($album,$level){
//print out the list item //print out the list item
?> ?>
<li> <li>
<a href="<?= item::root()->url() ?><?= $album->relative_url() ?>"><?= str_repeat("&nbsp;&nbsp;", $level) ?><?= $album->title ?></a> <a href="<?= item::root()->url() ?><?= $album->relative_url() ?>"><?= str_repeat("&nbsp;&nbsp;", $level) ?><?= html::purify($album->title) ?></a>
</li> </li>
<? <?
//recurse over the children, and print their list items as well //recurse over the children, and print their list items as well

2
3.0/modules/albumtree/views/albumtree_block_select.html.php
View File

@ -4,7 +4,7 @@
function makeselect($album, $level){ function makeselect($album, $level){
//print out the list item as a select option //print out the list item as a select option
?> ?>
<option value="<?= item::root()->url() ?><?= $album->relative_url() ?>"><?= str_repeat("&nbsp;&nbsp;", $level) ?><?= $album->title ?></option> <option value="<?= item::root()->url() ?><?= $album->relative_url() ?>"><?= str_repeat("&nbsp;&nbsp;", $level) ?><?= html::purify($album->title) ?></option>
<? <?
//recurse over the children, and print their list items as well //recurse over the children, and print their list items as well
foreach ($album->viewable()->children(null, null, array(array("type", "=", "album"))) as $child){ foreach ($album->viewable()->children(null, null, array(array("type", "=", "album"))) as $child){