mbirth/LuckyCoinkydink
Archived
1
0
Fork 0
Code Issues Pull Requests Activity

* Fixes escaping of comments in the new backend pane to prevent

Browse Source 
XSS. Thanks to Steffen Röemann for reporting!
This commit is contained in:
garvinhicking
2014-12-23 11:10:53 +01:00
parent 91412bf73b
commit 36cde3030a
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
templates/2k11/admin/overview.inc.tpl
View File

@ -39,9 +39,9 @@
{if is_array($comments)}
{foreach $comments as $comment}
<li class="clearfix"><b>{$comment.author|escape|truncate:30:"&hellip;"} {$CONST.IN} <a href="{$comment.entrylink}" title="Comment to {$comment.title}">#{$comment.id}</a></b>
<div class="comment_summary">{$comment.body|truncate:100:"&hellip;"}</div>
<div class="comment_summary">{$comment.body|escape|truncate:100:"&hellip;"}</div>
<div id="c{$comment.id}_full" class="comment_full additional_info">{$comment.fullBody}</div>
<div id="c{$comment.id}_full" class="comment_full additional_info">{$comment.fullBody|escape}</div>
<ul class="plainList actions">
<li><a class="button_link" href="?serendipity[action]=admin&amp;serendipity[adminModule]=comments&amp;serendipity[adminAction]=edit&amp;serendipity[id]={$comment.id}&amp;serendipity[entry_id]={$comment.entry_id}&amp;{$urltoken}" title="{$CONST.EDIT}"><span class="icon-edit"></span><span class="visuallyhidden"> {$CONST.EDIT}</span></a></li>