From fb4cbc73bae831e68fe8234811184f46077db5e6 Mon Sep 17 00:00:00 2001
From: winter
Date: Mon, 20 Jan 2025 17:48:33 +0000
Subject: fix some xss situations

---
 templates/actor_profile.php   | 4 ++--
 templates/note.php            | 5 +++--
 templates/skeleton.php        | 2 +-
 templates/write_note_form.php | 2 +-
 4 files changed, 7 insertions(+), 6 deletions(-)

(limited to 'templates')

diff --git a/templates/actor_profile.php b/templates/actor_profile.php
index 46ee273..fed8e3b 100644
--- a/templates/actor_profile.php
+++ b/templates/actor_profile.php
@@ -13,7 +13,7 @@ $user = UserAccount::findByCurrentSession();
             </a>
         <?php endif; ?>
         <div>
-            <div class="displayName"><?= $actor->displayName ?></div>
+            <div class="displayName"><?= htmlspecialchars($actor->displayName) ?></div>
             <div class="handle">@<?= $actor->getFullHandle() ?></div>
             <div class="joinedDate"><?= sprintf(__('user.profile.createdAt'), $actor->created->format('Y-m-d')) ?></div>
         </div>
@@ -25,7 +25,7 @@ $user = UserAccount::findByCurrentSession();
         </div>
     </div>
     <?php if (isset($actor->bio) && $actor->bio != '') { ?>
-        <pre class="bio"><?= $actor->bio ?></pre>
+        <pre class="bio"><?= htmlspecialchars($actor->bio) ?></pre>
     <?php } else {
         call_template('placeholder_text', ['message' => __('user.profile.bio.placeholder')]);
     } ?>
diff --git a/templates/note.php b/templates/note.php
index 98581c8..3e978b9 100644
--- a/templates/note.php
+++ b/templates/note.php
@@ -20,7 +20,8 @@ if ($user != null) {
     <div>
 
         <div class="infoLine">
-            <a class="authorName" href="/@/<?= $note->author->getFullHandle() ?>"><?= $note->author->displayName ?></a>
+            <a class="authorName"
+                href="/@/<?= $note->author->getFullHandle() ?>"><?= htmlspecialchars($note->author->displayName) ?></a>
             <span class="authorHandle">@<?= $note->author->getFullHandle() ?></span>
             <a class="timestamp" href="/@/<?= $note->author->getFullHandle() ?>/note/<?= $note->id ?>">
                 <?= // TODO: localise
@@ -49,7 +50,7 @@ if ($user != null) {
                 <a href="/@/<?= $note->inReplyTo->author->getFullHandle() ?>/note/<?= $note->inReplyTo->id ?>">
                     <span class="material-symbols-outlined inlineIcon">reply</span>
                     <?= sprintf(__('note.info.replyTo'),
-                        '<b>' . $note->inReplyTo->author->displayName) . '</b>' ?>
+                        '<b>' . htmlspecialchars($note->inReplyTo->author->displayName)) . '</b>' ?>
                 </a>
             </div>
         <?php endif; ?>
diff --git a/templates/skeleton.php b/templates/skeleton.php
index afe7321..a7b6e95 100644
--- a/templates/skeleton.php
+++ b/templates/skeleton.php
@@ -49,7 +49,7 @@ $settings = GlobalSettings::getInstance();
             else: ?>
                 <a href="/@/<?= $user->actor->handle ?>" id="currentUserInfo">
                     <?php call_template('actor_avatar', ['actor' => $user->actor]) ?>
-                    <?= $user->actor->displayName ?>
+                    <?= htmlspecialchars($user->actor->displayName) ?>
                 </a>
             <?php endif; ?>
         </nav>
diff --git a/templates/write_note_form.php b/templates/write_note_form.php
index 914c48b..55ed77e 100644
--- a/templates/write_note_form.php
+++ b/templates/write_note_form.php
@@ -5,7 +5,7 @@
             <?php call_template('actor_avatar', ['actor' => $actor]); ?>
         </a>
         <div class="basicInfo">
-            <a class="displayName" href="/@/<?= $actor->handle ?>"><?= $actor->displayName ?></a>
+            <a class="displayName" href="/@/<?= $actor->handle ?>"><?= htmlspecialchars($actor->displayName) ?></a>
             <div class="handle">@<?= $actor->handle ?></div>
         </div>
     </div>
-- 
cgit v1.3