mirror/postfixadmin
0
0
Fork 0
mirror of https://github.com/postfixadmin/postfixadmin.git synced 2024-09-20 03:36:20 +02:00
Code

flash_error.tpl:

Browse Source 
- html-escape flash_info() / flash_error() messages to fix XSS if the
  message contains user-supplied input
  (thanks to Filippo Cavallarin for the report)

Note: This will cause ugly output for some german error messages which
contain ü etc., and the warning message in backup.php (with some
HTML tags included) will also look totally ugly.
Nevertheless, that's still better than XSS attacks ;-)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1331 a1433add-5e2c-0410-b055-b7f2511e0802
This commit is contained in:
Christian Boltz 2012-01-11 21:46:41 +00:00
parent 19b9535e43
commit e3b242e4d8
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
templates/flash_error.tpl
View File

@ -5,14 +5,14 @@
{if isset($smarty.session.flash.info)}
<ul class="flash-info">
{foreach from=$smarty.session.flash.info item=msg}
<li>{$msg}</li>
<li>{$msg|escape:html}</li>
{/foreach}
</ul>
{/if}
{if isset($smarty.session.flash.error)}
<ul class="flash-error">
{foreach from=$smarty.session.flash.error item=msg}
<li>{$msg}</li>
<li>{$msg|escape:html}</li>
{/foreach}
</ul>
{/if}