adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-06 16:53:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

(cp 619849f) fixes #1150 prevent HTML code in group name

Browse Source 
It avoids any stored XSS between administrators and it's totally useless to have HTML code in the group name.
This commit is contained in:
plegall
2020-02-07 17:07:19 +01:00
parent 36e860af50
commit 4e0ab8e515
2 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/group_list.php
+13 -1
View File
@@ -45,6 +45,11 @@ if (isset($_POST['submit_add']))
{
$page['errors'][] = l10n('The name of a group must not contain " or \' or be empty.');
}
else
{
$_POST['groupname'] = strip_tags($_POST['groupname']);
}
if (count($page['errors']) == 0)
{
// is the group not already existing ?
@@ -107,7 +112,7 @@ SELECT name
$group_names = array_from_query($query, 'name');
foreach($groups as $group)
{
$_POST['rename_'.$group] = stripslashes($_POST['rename_'.$group]);
$_POST['rename_'.$group] = strip_tags(stripslashes($_POST['rename_'.$group]));
if (in_array($_POST['rename_'.$group], $group_names))
{
@@ -181,6 +186,8 @@ SELECT name
if ($action=="merge" and count($groups) > 1)
{
$_POST['merge'] = strip_tags($_POST['merge']);
// is the group not already existing ?
$query = '
SELECT COUNT(*)
@@ -268,6 +275,11 @@ SELECT COUNT(*)
{
break;
}
else
{
$_POST['duplicate_'.$group.''] = strip_tags(stripslashes($_POST['duplicate_'.$group.'']));
}
// is the group not already existing ?
$query = '
SELECT COUNT(*)