Fixed issue #13560: Stored XSS in Boxes

LimeSurvey · Apr 9, 2018 · 86a0275 · 86a0275
1 parent 48e588e
commit 86a0275
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/application/models/Boxes.php b/application/models/Boxes.php
@@ -27,6 +27,7 @@ public function rules()
         // will receive user inputs.
         return array(
             array('url, title, ico, desc, page', 'required'),
+            array('url', 'match', 'pattern'=>'/(http:\/\/)?[a-zA-Z]([a-zA-Z0-9-_?&"\'=]\/?)*/'),
             array('position', 'numerical', 'integerOnly'=>true),
             array('usergroup', 'numerical', 'integerOnly'=>true, 'min'=>-3),
             // The following rule is used by search().