Skip to content

Commit c216ab2

Browse files
committed
Fix XSS in repo_manage_page.php and list.php
Vulnerability on repo_manage_page.php was introduced in v2.0.0-beta.2 (commit 79497dd). The one on list.php existed since the initial version of the page. Fixes #286
2 parents 8878a45 + 9e89752 commit c216ab2

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

Source/pages/list.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<div class="widget-box widget-color-blue2">
2929
<div class="widget-header widget-header-small">
3030
<h4 class="widget-title lighter">
31-
<?php echo plugin_lang_get( 'changesets' ), ': ', $t_repo->name ?>
31+
<?php echo plugin_lang_get( 'changesets' ), ': ', string_display_line( $t_repo->name ) ?>
3232
</h4>
3333
</div>
3434

@@ -48,7 +48,7 @@
4848
</a>
4949
<?php
5050
if( $t_url = $t_vcs->url_repo( $t_repo ) ) { ?>
51-
<a class="btn btn-xs btn-primary btn-white btn-round" href="<?php echo $t_url ?>">
51+
<a class="btn btn-xs btn-primary btn-white btn-round" href="<?php echo string_display_line( $t_url ) ?>">
5252
<?php echo plugin_lang_get( 'browse' ) ?>
5353
</a>
5454
<?php } ?>

Source/pages/repo_manage_page.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ function convert_to_key_value( $p_array ) {
123123
?>
124124
<tr>
125125
<td class="category"><?php echo plugin_lang_get_defaulted( $t_key, $t_key, $t_vcs->basename ) ?></td>
126-
<td><?php echo is_bool( $t_value ) ? trans_bool( $t_value ) : $t_value ?></td>
126+
<td><?php echo is_bool( $t_value ) ? trans_bool( $t_value ) : string_display_line( $t_value )?></td>
127127
</tr>
128128
<?php } ?>
129129
</table>

0 commit comments

Comments
 (0)