Development

#3745: fixed-xss.patch

You must first sign up to be able to contribute.

Ticket #3745: fixed-xss.patch

File fixed-xss.patch, 0.7 kB (added by cronfy, 7 months ago)

patch: fixes XSS vulnerability for 'title' and 'author_name' fields

  • lib/sfPropelActAsCommentableBehavior.class.php

    old new  
    5151      { 
    5252        if (strlen($comment['text']) > 0) 
    5353        { 
    54           $comment['text'] = strip_tags($comment['text']); 
    55           $comment['created_at'] = time(); 
     54          $comment['text']         = strip_tags($comment['text']); 
     55          $comment['title']        = strip_tags($comment['title']); 
     56          $comment['author_name']  = strip_tags($comment['author_name']); 
     57          $comment['created_at']   = time(); 
    5658 
    5759          if (!isset($comment['namespace'])) 
    5860          {