(cp 917cab5a4) fixes GHSA-7379-w44f-mfw4 and fixes GHSA-8g2g-6f2c-6h7j protect tag name from XSS

2026-08-12 03:33:01 +02:00 · 2024-03-01 11:27:43 +01:00
parent 7fc04d7d6d
commit 5069610aae
1 changed files with 3 additions and 0 deletions
@@ -2365,6 +2365,9 @@ function get_extents($start='')
 */
 function create_tag($tag_name)
 {
+  // clean the tag, no html/js allowed in tag name
+  $tag_name = strip_tags($tag_name);
+
  // does the tag already exists?
  $query = '
 SELECT id