Merge branch 'master-2.12'

mantisbt · Mar 30, 2018 · f605a52 · f605a52
2 parents e2547ba + baaf32a
commit f605a52
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 11 deletions.
diff --git a/composer.json b/composer.json
@@ -8,7 +8,7 @@
         "vboctor/disposable_email_checker": "^3.0",
         "adodb/adodb-php": "^5.20",
         "phpmailer/phpmailer": "^5.2.22",
-        "erusev/parsedown": "^1.6",
+        "erusev/parsedown": "^1.7.0",
         "dapphp/securimage": "dev-mantis"
     },
     "require-dev": {

diff --git a/composer.lock b/composer.lock
diff --git a/plugins/MantisCoreFormatting/core/MantisMarkdown.php b/plugins/MantisCoreFormatting/core/MantisMarkdown.php
@@ -60,12 +60,15 @@ class MantisMarkdown extends Parsedown
 	 * MantisMarkdown constructor.
 	 */
 	public function __construct() {
-		
+
 		# enable line break by default
 		$this->breaksEnabled = true;
 
 		# set the table class
 		$this->table_class = 'table table-nonfluid';
+
+		# XSS protection
+		$this->setSafeMode( true );
 	}
 
 	/**
@@ -77,7 +80,7 @@ public static function convert_text( $p_text ) {
 		self::init();
 
 		# Enabled quote conversion
-		# Text processing converts special character to entity name 
+		# Text processing converts special character to entity name
 		# Make sure to restore "&gt;" entity name to its characted result ">"
 		$p_text = str_replace( "&gt;", ">", $p_text );
 
@@ -205,7 +208,7 @@ protected function blockQuoteContinue( $line, array $block ){
 	protected function inlineCode( $block ) {
 
 		$block = parent::inlineCode( $block );
-		
+
 		if( isset( $block['element']['text'] )) {
 			$this->processAmpersand( $block['element']['text'] );
 		}
@@ -230,7 +233,7 @@ protected function blockFencedCodeComplete( $block = null ) {
 
 		return $block;
 	}
-	
+
 	/**
 	 * Customize the blockCodeComplete method
 	 *