Changeset 4542

Timestamp:

02/03/12 16:01:34 (4 months ago)

Author:

tboutell

Message:

Fixed #1220 XSS vulnerability in blog filters

Files:

• plugins/apostrophePlugin/branches/1.5/lib/helper/aHelper.php (modified) (2 diffs)

plugins/apostrophePlugin/branches/1.5/lib/helper/aHelper.php

@@ -622 +622 @@
 // This ought to call a_button but I'm wrestling with the incompatibility of inline
 // content and a_button's CSS. Notice that it's playing out rather well in the blog engine. -Tom
+//
+// Always entity-encode the label. Without this the blog filters are an XSS vulnerability
 
 function a_remove_filter_button($label, $url, $parameter)
@@ -636 +638 @@
   }
   $url = aUrl::addParams($url, $remove);
-  return link_to($label.'<span class="icon"></span>', url_for($url), array('class' => 'a-remove-filter-button', 'title' => 'Remove Filter: ' . $label));
+  return link_to(aHtml::entities($label).'<span class="icon"></span>', url_for($url), array('class' => 'a-remove-filter-button', 'title' => 'Remove Filter: ' . $label));
 }