Changeset 3440:5536ac77e915 for admin/media_item.php

Timestamp:

12/05/16 14:30:56 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Prevents XSS injection in media title, closes #2224, thanks smarterbitbybit for report

File:

• admin/media_item.php (modified) (1 diff)

admin/media_item.php

@@ -117 +117 @@
           $newFile->relname = $newFile->basename;
      }
-     $newFile->media_title = $_POST['media_title'];
+     $newFile->media_title = html::escapeHTML($_POST['media_title']);
      $newFile->media_dt = strtotime($_POST['media_dt']);
      $newFile->media_dtstr = $_POST['media_dt'];