Changeset 3441:5210efb51a5e for admin/media_item.php

Timestamp:

12/05/16 14:30:56 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.10

source:

5536ac77e915c6f888796188185621effac42e6d

Message:

Prevents XSS injection in media title, closes #2224, thanks smarterbitbybit for report

File:

• admin/media_item.php (modified) (1 diff)

admin/media_item.php

@@ -117 +117 @@
           $newFile->relname = $newFile->basename;
      }
-     $newFile->media_title = $_POST['media_title'];
+     $newFile->media_title = html::escapeHTML($_POST['media_title']);
      $newFile->media_dt = strtotime($_POST['media_dt']);
      $newFile->media_dtstr = $_POST['media_dt'];