Vulnerability fix: add strip_tags to details view in visitors module.

andrzuk · Jun 1, 2022 · d64fcba · d64fcba
1 parent 37bfb4e
commit d64fcba
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/lib/gener/view.php b/lib/gener/view.php
@@ -153,7 +153,7 @@ public function build_view()
 							if ($ik == 'converted') $converted = $iv;
 						}
 						$main_text .= '<div>';
-						$main_text .= '<a href="' . $original . '" target="_blank">' . $converted . '</a>';
+						$main_text .= '<a href="' . strip_tags($original) . '" target="_blank">' . strip_tags($converted) . '</a>';
 						$main_text .= '</div>';
 					}
 					else // zwykłe dane
@@ -169,7 +169,7 @@ public function build_view()
 			}
 			else if (substr($this->row[$db_name], 0, 4) == '<img') // obrazek
 			{
-				$main_text .= $this->row[$db_name];
+				$main_text .= strip_tags($this->row[$db_name]);
 			}
 			else // zwykłe dane
 			{