Browse Source

escape html in syndication targets

pull/52/head
Aaron Parecki 5 years ago
parent
commit
c1101c687d
2 changed files with 4 additions and 4 deletions
  1. +3
    -3
      views/new-post.php
  2. +1
    -1
      views/partials/syndication-js.php

+ 3
- 3
views/new-post.php View File

@ -44,9 +44,9 @@
echo '<ul>';
foreach($this->syndication_targets as $syn) {
echo '<li>'
. '<button data-syndicate-to="'.(isset($syn['uid']) ? $syn['uid'] : $syn['target']).'" class="btn btn-default btn-block">'
. ($syn['favicon'] ? '<img src="'.$syn['favicon'].'" width="16" height="16"> ' : '')
. $syn['target']
. '<button data-syndicate-to="'.(isset($syn['uid']) ? htmlspecialchars($syn['uid']) : htmlspecialchars($syn['target'])).'" class="btn btn-default btn-block">'
. ($syn['favicon'] ? '<img src="'.htmlspecialchars($syn['favicon']).'" width="16" height="16"> ' : '')
. htmlspecialchars($syn['target'])
. '</button>'
. '</li>';
}

+ 1
- 1
views/partials/syndication-js.php View File

@ -7,7 +7,7 @@ function reload_syndications() {
var target = data.targets[i].target;
var uid = data.targets[i].uid;
var favicon = data.targets[i].favicon;
$("#syndication-container ul").append('<li><button data-syndicate-to="'+(uid ? uid : target)+'" class="btn btn-default btn-block">'+(favicon ? '<img src="'+favicon+'" width="16" height="16"> ':'')+target+'</button></li>');
$("#syndication-container ul").append('<li><button data-syndicate-to="'+htmlspecialchars(uid ? uid : target)+'" class="btn btn-default btn-block">'+(favicon ? '<img src="'+htmlspecialchars(favicon)+'" width="16" height="16"> ':'')+htmlspecialchars(target)+'</button></li>');
}
bind_syndication_buttons();
} else {

Loading…
Cancel
Save