Update Changelog

AUTHORS.md

@@ -2,7 +2,7 @@
 
 ## Main developers
 
-* Luc Didry, aka Sky (<http://www.fiat-tux.fr>), core developer, @framasky on [Twitter](https://twitter.com/framasky) and on [Diaspora*](https://framasphere.org/public/framasky)
+* Luc Didry, aka Sky (<http://www.fiat-tux.fr>), core developer, @framasky on [Mastodon](https://framapiaf.org/@framasky) and on [Diaspora*](https://framasphere.org/public/framasky)
 * Dattaz (<http://dattaz.fr>), webapp developer, [@dat_taz](https://twitter.com/dat_taz)
 
 ## Contributors

CHANGELOG

@@ -1,5 +1,8 @@
 Revision history for Lutim
 
+0.8.8  2018-02-07
+	- Fix security issues, thanks to SecuNinja
+
 0.8.7  2017-12-22
 	- Fix bug if dbtype not configured in lutim.conf
 

lib/Lutim/Controller.pm

@@ -534,7 +534,7 @@ sub short {
         }
 
         my $test;
-        if (defined($touit)) {
+        if (defined($touit) && $image->mediatype !~ m/svg/) {
             $test = 1;
             my $short  = $image->short;
                $short .= '/'.$key if (defined($key));

themes/default/templates/partial/lutim.js.ep

@@ -172,9 +172,9 @@ function buildMessage(success, msg) {
             '<div class="alert alert-danger">',
                 '<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>',
                 '<strong><%= l('Something bad happened') %></strong><br>',
-                msg.filename,
+                cleanName(msg.filename, false),
                 '<br>',
-                msg.msg,
+                cleanName(msg.msg, false),
             '</div>'
         ].join('');
     }