kashire/lainchan
4
0
Fork 0
Code Issues 3 Pull Requests Releases Wiki Activity

SECURITY / XSS : Stop XSS in post subjects displayed in catalog

Browse Source 
git blame says czaks forgot an |e in catalog.html, this means that anyone posting a new thread with HTML in the subject field or name field can arbitrarily insert it into the page.

Conflicts:
	templates/themes/catalog/catalog.html
This commit is contained in:
8chan 2015-01-23 02:29:55 -08:00
parent f4422e597b
commit a550c63f9c
1 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
templates/themes/catalog/catalog.html
View File

@ -52,14 +52,22 @@
{% else %}
<img src="{{post.file}}"
{% endif %}
id="img-{{ post.id }}" data-subject="{% if post.subject %}{{ post.subject }}{% endif %}" data-name="{{ post.name }}" data-muhdifference="{{ post.muhdifference }}" data-last-reply="{% if post.last_reply %}{{ post.last_reply }}{% endif %}" data-last-subject="{% if post.last_reply_subject %}{{ post.last_reply_subject }}{% endif %}" data-last-name="{% if post.last_reply %}{{ post.last_reply_name }}{% endif %}" data-last-difference="{% if post.last_reply %}{{ post.last_reply_difference }}{% endif %}" class="{{post.board}} thread-image" title="{{post.bump|date('%b %d %H:%M')}}">
id="img-{{ post.id }}" data-subject="{% if post.subject %}{{ post.subject|e }}{% endif %}" data-name="{{ post.name|e }}" data-muhdifference="{{ post.muhdifference }}" class="{{post.board}} thread-image" title="{{post.bump|date('%b %d %H:%M')}}">
</a>
<p>
<span class="replies">
<strong>R: {{ post.reply_count }} / I: {{ post.image_count }}</strong><br/>
{{ post.body }}
</span>
</p>
<div class="replies">
<strong>R: {{ post.reply_count }} / I: {{ post.image_count }}</strong>
{% if post.subject %}
<p class="intro">
<span class="subject">
{{ post.subject|e }}
</span>
</p>
{% else %}
<br />
{% endif %}
{{ post.body }}
</div>
</div>
</li>
{% endfor %}