sbrl-github/Pepperminty-Wiki
sbrl-github
/
Pepperminty-Wiki
mirror of https://github.com/sbrl/Pepperminty-Wiki.git
1
0
Fork 0
Code

core | render_pagename, render_username: fix potential authenticated XSS attack

This commit is contained in:
Starbeamrainbowlabs 2021-09-02 23:04:26 +01:00
parent d977d594e6
commit 738715af43
Signed by: sbrl
GPG Key ID: 1BE5172E637709C2
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
core/05-functions.php
View File

@ -679,7 +679,7 @@ function render_timestamp($timestamp, $absolute = false, $html = true) {
*/
function render_pagename($rchange) {
global $pageindex;
$pageDisplayName = $rchange->page;
$pageDisplayName = htmlentities($rchange->page);
if(isset($pageindex->$pageDisplayName) and !empty($pageindex->$pageDisplayName->redirect))
$pageDisplayName = "<em>$pageDisplayName</em>";
$pageDisplayLink = "<a href='?page=" . rawurlencode($rchange->page) . "'>$pageDisplayName</a>";
@ -692,7 +692,7 @@ function render_pagename($rchange) {
* @return string HTML representing the given editor's name.
*/
function render_editor($editorName) {
return "<span class='editor'>&#9998; $editorName</span>";
return "<span class='editor'>&#9998; ".htmlentities($editorName)."</span>";
}
/**