Peter M. Groen / knowledgetree

Commit ad9a6092f6ccee77d9b4f249296aaab6a3b46f09

Authored by kevin_fourie
1 parent d79a6769

Merged in from DEV trunk... 

KTS-2178
"cross site scripting"
Implemented.

Committed By: Conrad
Reviewed By: Kevin

git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/STABLE/trunk@6985 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 3 changed files with 4 additions and 4 deletions
templates/kt3/browse.smarty
  View file @ad9a609
... ... @@ -44,7 +44,7 @@
44 44 <input type="hidden" name="sListCode" value="{$code}" />
45 45 <input type="hidden" name="action" value="bulkaction" />
46 46 <input type="hidden" name="fReturnAction" value="{$returnaction}" />
47   - <input type="hidden" name="fReturnData" value="{$returndata}" />
  47 + <input type="hidden" name="fReturnData" value="{$returndata|sanitize}" />
48 48  
49 49 {foreach from=$bulkactions item=bulkaction}
50 50 <input type="submit" name="submit[{$bulkaction->getName()}]" value="{$bulkaction->getDisplayName()}" />
... ...
templates/ktcore/assist/assist_notification.smarty
  View file @ad9a609
1   -<dt class="actionitem">{$subject}</dt>
  1 +<dt class="actionitem">{$subject|sanitize}</dt>
2 2 <dd class="actionmessage">
3   - {i18n arg_name=$document_name arg_state=$state_name arg_user=$actor->getName()}A
  3 + {i18n arg_name=$document_name|sanitize arg_state=$state_name arg_user=$actor->getName()}A
4 4 user, <b>#user#</b>, has requested help on the document <b>#name#</b>, and you are
5 5 the owner or an admin of this document.{/i18n}
6 6 <div class="actionoptions">
... ...
templates/ktcore/assist/assist_notification_details.smarty
  View file @ad9a609
1 1 <p class="descriptiveText">
2   - {i18n arg_name=$document_name arg_state=$state_name arg_user=$actor->getName()}A
  2 + {i18n arg_name=$document_name|sanitize arg_state=$state_name arg_user=$actor->getName()}A
3 3 user, <b>#user#</b>, has requested help on the document <b>#name#</b>, and you are
4 4 the owner or an admin of this document.{/i18n}
5 5 </p>
... ...