Changeset 3441:5210efb51a5e

Timestamp:

12/05/16 14:30:56 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.10

source:

5536ac77e915c6f888796188185621effac42e6d

Message:

Prevents XSS injection in media title, closes #2224, thanks smarterbitbybit for report

Location:

admin

Files:

• media.php (modified) (1 diff)
• media_item.php (modified) (1 diff)

admin/media.php

@@ -276 +276 @@
                files::uploadStatus($upfile);
 
-               $f_title = (isset($_POST['upfiletitle']) ? $_POST['upfiletitle'] : '');
+               $f_title = (isset($_POST['upfiletitle']) ? html::escapeHTML($_POST['upfiletitle']) : '');
                $f_private = (isset($_POST['upfilepriv']) ? $_POST['upfilepriv'] : false);
 

admin/media_item.php

@@ -117 +117 @@
           $newFile->relname = $newFile->basename;
      }
-     $newFile->media_title = $_POST['media_title'];
+     $newFile->media_title = html::escapeHTML($_POST['media_title']);
      $newFile->media_dt = strtotime($_POST['media_dt']);
      $newFile->media_dtstr = $_POST['media_dt'];