kashire/lainchan
4
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

SECURITY / XSS : Stop XSS in post subjects displayed in catalog

Browse Source 
git blame says czaks forgot an |e in catalog.html, this means that anyone posting a new thread with HTML in the subject field or name field can arbitrarily insert it into the page.

Conflicts:
	templates/themes/catalog/catalog.html
This commit is contained in:
8chan 2015-01-23 02:29:55 -08:00
parent f4422e597b
commit a550c63f9c
1 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
templates/themes/catalog/catalog.html
View File

@ -52,14 +52,22 @@
{% else %} {% else %}
<img src="{{post.file}}" <img src="{{post.file}}"
{% endif %} {% endif %}
id="img-{{ post.id }}" data-subject="{% if post.subject %}{{ post.subject }}{% endif %}" data-name="{{ post.name }}" data-muhdifference="{{ post.muhdifference }}" data-last-reply="{% if post.last_reply %}{{ post.last_reply }}{% endif %}" data-last-subject="{% if post.last_reply_subject %}{{ post.last_reply_subject }}{% endif %}" data-last-name="{% if post.last_reply %}{{ post.last_reply_name }}{% endif %}" data-last-difference="{% if post.last_reply %}{{ post.last_reply_difference }}{% endif %}" class="{{post.board}} thread-image" title="{{post.bump|date('%b %d %H:%M')}}"> id="img-{{ post.id }}" data-subject="{% if post.subject %}{{ post.subject|e }}{% endif %}" data-name="{{ post.name|e }}" data-muhdifference="{{ post.muhdifference }}" class="{{post.board}} thread-image" title="{{post.bump|date('%b %d %H:%M')}}">
</a> </a>
<p> <div class="replies">
<span class="replies"> <strong>R: {{ post.reply_count }} / I: {{ post.image_count }}</strong>
<strong>R: {{ post.reply_count }} / I: {{ post.image_count }}</strong><br/> {% if post.subject %}
{{ post.body }} <p class="intro">
</span> <span class="subject">
</p> {{ post.subject|e }}
</span>
</p>
{% else %}
<br />
{% endif %}
{{ post.body }}
</div>
</div> </div>
</li> </li>
{% endfor %} {% endfor %}