Beanz/flatpress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixes #186, possible XSS in comments

Browse Source
This commit is contained in:
azett 2023-01-08 13:04:12 +01:00
parent 8c79821e9e
commit 264217f318
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
fp-includes/core/core.comment.php
View File

@ -73,12 +73,14 @@ function comment_exists($entryid, $id) {
} }
function comment_clean(&$arr) { function comment_clean(&$arr) {
$arr ['name'] = apply_filters('pre_comment_author_name', stripslashes($arr ['name'])); $arr ['name'] = strip_tags(apply_filters('pre_comment_author_name', stripslashes($arr ['name'])));
if (isset($arr ['email'])) if (isset($arr ['email'])) {
$arr ['email'] = apply_filters('pre_comment_author_email', $arr ['email']); $arr ['email'] = strip_tags(apply_filters('pre_comment_author_email', $arr ['email']));
if (isset($arr ['url'])) }
$arr ['url'] = apply_filters('pre_comment_author_url', $arr ['url']); if (isset($arr ['url'])) {
$arr ['content'] = apply_filters('pre_comment_content', $arr ['content']); $arr ['url'] = strip_tags(apply_filters('pre_comment_author_url', $arr ['url']));
}
$arr ['content'] = strip_tags(apply_filters('pre_comment_content', $arr ['content']));
return $arr; return $arr;
} }