friendica/friendica
6
0
Fork 1
mirror of https://github.com/friendica/friendica synced 2024-05-22 19:34:58 +02:00
Code Issues Packages Projects Releases 1 Wiki Activity

Escape HTML in the location field of a calendar event post

Browse source 
- This allowed script tags to be interpreted in the post display of an event.
This commit is contained in:
Hypolite Petovan 2024-02-21 21:56:11 -05:00
parent fc3898fe64
commit bb737adf51
2 changed files with 3 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/Model/Event.php
View file

@ -925,9 +925,6 @@ class Event
$end_short = ''; $end_short = '';
} }
// Format the event location.
$location = self::locationToArray($item['event-location']);
// Construct the profile link (magic-auth). // Construct the profile link (magic-auth).
$author = [ $author = [
'uid' => 0, 'uid' => 0,
@ -964,7 +961,7 @@ class Event
'$show_map_label' => DI::l10n()->t('Show map'), '$show_map_label' => DI::l10n()->t('Show map'),
'$hide_map_label' => DI::l10n()->t('Hide map'), '$hide_map_label' => DI::l10n()->t('Hide map'),
'$map_btn_label' => DI::l10n()->t('Show map'), '$map_btn_label' => DI::l10n()->t('Show map'),
'$location' => $location '$location' => self::locationToTemplateVars($item['event-location']),
]); ]);
return $return; return $return;
@ -984,7 +981,7 @@ class Event
* 'coordinates' => Latitude and longitude (e.g. '48.864716,2.349014').<br> * 'coordinates' => Latitude and longitude (e.g. '48.864716,2.349014').<br>
* @throws \Friendica\Network\HTTPException\InternalServerErrorException * @throws \Friendica\Network\HTTPException\InternalServerErrorException
*/ */
private static function locationToArray(string $s = ''): array private static function locationToTemplateVars(string $s = ''): array
{ {
if ($s == '') { if ($s == '') {
return []; return [];

2
view/theme/frio/templates/event_stream_item.tpl
View file

@ -23,7 +23,7 @@
</span> </span>
{{if $location.name}} {{if $location.name}}
<span role="presentation" aria-hidden="true"> · </span> <span role="presentation" aria-hidden="true"> · </span>
<span class="event-location event-card-location">{{$location.name nofilter}}</span> <span class="event-location event-card-location">{{$location.name}}</span>
{{/if}} {{/if}}
</div> </div>
<div class="event-card-profile-name profile-entry-name"> <div class="event-card-profile-name profile-entry-name">