mbirth/LuckyCoinkydink
1
0
Fork 0
Code Issues Pull Requests Activity

Fix XSS from image comment exif field (#598)

Browse Source
This commit is contained in:
onli 2019-04-27 12:56:31 +02:00
parent 57bb0b1e9a
commit eda8f71065
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/NEWS
View File

@ -1,6 +1,9 @@
Version 2.2.1-alpha2 ()
------------------------------------------------------------------------
* Security: Fix XSS in Editor Preview by interpreted EXIF tags
(thanks @hannob!)
* Security: Fix XSS in Media Library by interpreted EXIF tags
(thanks @hannob!)

2
templates/2k11/admin/media_choose.tpl
View File

@ -137,7 +137,7 @@
<div id="image_comment" class="form_area">
<label for="serendipity_imagecomment">{$CONST.COMMENT}</label>
<textarea id="serendipity_imagecomment" name="serendipity[imagecomment]" rows="5">{$media.file.props.base_property.COMMENT1|escape}</textarea>
<textarea id="serendipity_imagecomment" name="serendipity[imagecomment]" rows="5">{$media.file.props.base_property.COMMENT1|escape|escape}</textarea>
{serendipity_hookPlugin hookAll=true hook='frontend_image_selector_imagecomment' eventData=$media.file}
</div>