Changeset 4534

Timestamp:

02/01/12 09:22:15 (4 months ago)

Author:

tboutell

Message:

Fix for XSS attack in #1218 thanks to david jacquel

Location:

plugins/apostropheBlogPlugin/branches/1.5/modules

Files:

• aBlog/templates/_singleColumnTemplate_slot.php (modified) (1 diff)
• aEvent/templates/_singleColumnTemplate_slot.php (modified) (1 diff)

plugins/apostropheBlogPlugin/branches/1.5/modules/aBlog/templates/_singleColumnTemplate_slot.php

@@ -28 +28 @@
   <div class="a-blog-item-excerpt-container">
         <div class="a-blog-item-excerpt">
-                <?php echo $aBlogPost->getTextForArea('blog-body', $options['excerptLength']) ?>
+                <?php echo aHtml::entities($aBlogPost->getTextForArea('blog-body', $options['excerptLength'])) ?>
         </div>
     <div class="a-blog-read-more">

plugins/apostropheBlogPlugin/branches/1.5/modules/aEvent/templates/_singleColumnTemplate_slot.php

@@ -23 +23 @@
  <div class="a-blog-item-excerpt-container">
         <div class="a-blog-item-excerpt">
-                <?php echo $aEvent->getTextForArea('blog-body', $options['excerptLength']) ?>
+                <?php echo aHtml::entities($aEvent->getTextForArea('blog-body', $options['excerptLength'])) ?>
         </div>
         <div class="a-blog-read-more">