diff options
| author | winter | 2025-01-20 17:48:33 +0000 |
|---|---|---|
| committer | winter | 2025-01-20 17:49:22 +0000 |
| commit | fb4cbc73bae831e68fe8234811184f46077db5e6 (patch) | |
| tree | 1118e58b6fc2936964b5e2364fdd873bbf7ec2a6 /templates/note.php | |
| parent | 6b78446c1d5b76438d40bbe68aa0397de533e61a (diff) | |
fix some xss situations
Diffstat (limited to 'templates/note.php')
| -rw-r--r-- | templates/note.php | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/templates/note.php b/templates/note.php index 98581c8..3e978b9 100644 --- a/templates/note.php +++ b/templates/note.php @@ -20,7 +20,8 @@ if ($user != null) { <div> <div class="infoLine"> - <a class="authorName" href="/@/<?= $note->author->getFullHandle() ?>"><?= $note->author->displayName ?></a> + <a class="authorName" + href="/@/<?= $note->author->getFullHandle() ?>"><?= htmlspecialchars($note->author->displayName) ?></a> <span class="authorHandle">@<?= $note->author->getFullHandle() ?></span> <a class="timestamp" href="/@/<?= $note->author->getFullHandle() ?>/note/<?= $note->id ?>"> <?= // TODO: localise @@ -49,7 +50,7 @@ if ($user != null) { <a href="/@/<?= $note->inReplyTo->author->getFullHandle() ?>/note/<?= $note->inReplyTo->id ?>"> <span class="material-symbols-outlined inlineIcon">reply</span> <?= sprintf(__('note.info.replyTo'), - '<b>' . $note->inReplyTo->author->displayName) . '</b>' ?> + '<b>' . htmlspecialchars($note->inReplyTo->author->displayName)) . '</b>' ?> </a> </div> <?php endif; ?> |