diff options
| author | winter | 2025-01-20 17:48:33 +0000 |
|---|---|---|
| committer | winter | 2025-01-20 17:49:22 +0000 |
| commit | fb4cbc73bae831e68fe8234811184f46077db5e6 (patch) | |
| tree | 1118e58b6fc2936964b5e2364fdd873bbf7ec2a6 /templates | |
| parent | 6b78446c1d5b76438d40bbe68aa0397de533e61a (diff) | |
fix some xss situations
Diffstat (limited to 'templates')
| -rw-r--r-- | templates/actor_profile.php | 4 | ||||
| -rw-r--r-- | templates/note.php | 5 | ||||
| -rw-r--r-- | templates/skeleton.php | 2 | ||||
| -rw-r--r-- | templates/write_note_form.php | 2 |
4 files changed, 7 insertions, 6 deletions
diff --git a/templates/actor_profile.php b/templates/actor_profile.php index 46ee273..fed8e3b 100644 --- a/templates/actor_profile.php +++ b/templates/actor_profile.php @@ -13,7 +13,7 @@ $user = UserAccount::findByCurrentSession(); </a> <?php endif; ?> <div> - <div class="displayName"><?= $actor->displayName ?></div> + <div class="displayName"><?= htmlspecialchars($actor->displayName) ?></div> <div class="handle">@<?= $actor->getFullHandle() ?></div> <div class="joinedDate"><?= sprintf(__('user.profile.createdAt'), $actor->created->format('Y-m-d')) ?></div> </div> @@ -25,7 +25,7 @@ $user = UserAccount::findByCurrentSession(); </div> </div> <?php if (isset($actor->bio) && $actor->bio != '') { ?> - <pre class="bio"><?= $actor->bio ?></pre> + <pre class="bio"><?= htmlspecialchars($actor->bio) ?></pre> <?php } else { call_template('placeholder_text', ['message' => __('user.profile.bio.placeholder')]); } ?> diff --git a/templates/note.php b/templates/note.php index 98581c8..3e978b9 100644 --- a/templates/note.php +++ b/templates/note.php @@ -20,7 +20,8 @@ if ($user != null) { <div> <div class="infoLine"> - <a class="authorName" href="/@/<?= $note->author->getFullHandle() ?>"><?= $note->author->displayName ?></a> + <a class="authorName" + href="/@/<?= $note->author->getFullHandle() ?>"><?= htmlspecialchars($note->author->displayName) ?></a> <span class="authorHandle">@<?= $note->author->getFullHandle() ?></span> <a class="timestamp" href="/@/<?= $note->author->getFullHandle() ?>/note/<?= $note->id ?>"> <?= // TODO: localise @@ -49,7 +50,7 @@ if ($user != null) { <a href="/@/<?= $note->inReplyTo->author->getFullHandle() ?>/note/<?= $note->inReplyTo->id ?>"> <span class="material-symbols-outlined inlineIcon">reply</span> <?= sprintf(__('note.info.replyTo'), - '<b>' . $note->inReplyTo->author->displayName) . '</b>' ?> + '<b>' . htmlspecialchars($note->inReplyTo->author->displayName)) . '</b>' ?> </a> </div> <?php endif; ?> diff --git a/templates/skeleton.php b/templates/skeleton.php index afe7321..a7b6e95 100644 --- a/templates/skeleton.php +++ b/templates/skeleton.php @@ -49,7 +49,7 @@ $settings = GlobalSettings::getInstance(); else: ?> <a href="/@/<?= $user->actor->handle ?>" id="currentUserInfo"> <?php call_template('actor_avatar', ['actor' => $user->actor]) ?> - <?= $user->actor->displayName ?> + <?= htmlspecialchars($user->actor->displayName) ?> </a> <?php endif; ?> </nav> diff --git a/templates/write_note_form.php b/templates/write_note_form.php index 914c48b..55ed77e 100644 --- a/templates/write_note_form.php +++ b/templates/write_note_form.php @@ -5,7 +5,7 @@ <?php call_template('actor_avatar', ['actor' => $actor]); ?> </a> <div class="basicInfo"> - <a class="displayName" href="/@/<?= $actor->handle ?>"><?= $actor->displayName ?></a> + <a class="displayName" href="/@/<?= $actor->handle ?>"><?= htmlspecialchars($actor->displayName) ?></a> <div class="handle">@<?= $actor->handle ?></div> </div> </div> |