Changeset 3441:5210efb51a5e for admin/media.php

Timestamp:

12/05/16 14:30:56 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.10

source:

5536ac77e915c6f888796188185621effac42e6d

Message:

Prevents XSS injection in media title, closes #2224, thanks smarterbitbybit for report

File:

• admin/media.php (modified) (1 diff)

admin/media.php

@@ -276 +276 @@
                files::uploadStatus($upfile);
 
-               $f_title = (isset($_POST['upfiletitle']) ? $_POST['upfiletitle'] : '');
+               $f_title = (isset($_POST['upfiletitle']) ? html::escapeHTML($_POST['upfiletitle']) : '');
                $f_private = (isset($_POST['upfilepriv']) ? $_POST['upfilepriv'] : false);