tobias/friendica
1
0
Fork 0
Code Pull requests Activity

Security: Use htmlspecialchars() for user input in Arguments class

Browse source
This commit is contained in:
Philipp Holzer 2023-01-11 23:09:40 +01:00 committed by Hypolite Petovan
parent 0ad246f910
commit a31d5ae7b1
2 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/App/Page.php
View file

@ -73,6 +73,8 @@ class Page implements ArrayAccess
'right_aside' => '',
'template' => '',
'title' => '',
'section' => '',
'module' => '',
];
/**
* @var string The basepath of the page
@ -509,6 +511,11 @@ class Page implements ArrayAccess
$page = $this->page;
// add and escape some common but crucial content for direct "echo" in HTML (security)
$page['title'] = htmlspecialchars($page['title'] ?? '');
$page['section'] = htmlspecialchars($args->get(0) ?? 'generic');
$page['module'] = htmlspecialchars($args->getModuleName() ?? '');
header("X-Friendica-Version: " . App::VERSION);
header("Content-type: text/html; charset=utf-8");

4
view/theme/frio/php/default.php
View file

@ -77,7 +77,7 @@ $is_singleuser_class = $is_singleuser ? "is-singleuser" : "is-not-singleuser";
?>
</head>
<body id="top" class="mod-<?php echo DI::args()->getModuleName() . " " . $is_singleuser_class . " " . $view_mode_class;?>">
<body id="top" class="mod-<?php echo $page['module'] . " " . $is_singleuser_class . " " . $view_mode_class;?>">
<a href="#content" class="sr-only sr-only-focusable"><?php echo DI::l10n()->t('Skip to main content'); ?></a>
<?php
if (!empty($page['nav']) && !$minimal) {
@ -125,7 +125,7 @@ $is_singleuser_class = $is_singleuser ? "is-singleuser" : "is-not-singleuser";
<div class="col-lg-7 col-md-7 col-sm-12 col-xs-12" id="content">
<section class="sectiontop ';
echo DI::args()->get(0, 'generic');
echo $page['section'] ?? '';
echo '-content-wrapper">';
if (!empty($page['content'])) {
echo $page['content'];