Changeset 3440:5536ac77e915 for admin/media.php

Timestamp:

12/05/16 14:30:56 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Prevents XSS injection in media title, closes #2224, thanks smarterbitbybit for report

File:

• admin/media.php (modified) (1 diff)

admin/media.php

@@ -282 +282 @@
                files::uploadStatus($upfile);
 
-               $f_title = (isset($_POST['upfiletitle']) ? $_POST['upfiletitle'] : '');
+               $f_title = (isset($_POST['upfiletitle']) ? html::escapeHTML($_POST['upfiletitle']) : '');
                $f_private = (isset($_POST['upfilepriv']) ? $_POST['upfilepriv'] : false);