Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: HTML injection in payment request/posData/receiptData (Close #4678) #4679

Merged
merged 2 commits into from Feb 22, 2023

Conversation

NicolasDorier
Copy link
Member

Fix #4678

Copy link
Member

@dennisreimann dennisreimann left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tACK.

@dennisreimann
Copy link
Member

@Kukks Can you also review this? I removed some more Safe.Raw instances, from what I saw those weren't needed.

@@ -69,7 +69,7 @@
<div class="col-12 col-sm-auto">
<div class="form-group">
<label asp-for="Add.CurrencyCode" class="form-label"></label>
<input asp-for="Add.CurrencyCode" class="form-control" style="max-width:16ch;"/>
<input asp-for="Add.CurrencyCode" class="form-control w-auto" currency-selection style="max-width:16ch;"/>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sneaked this in. :)

@Kukks Kukks merged commit ddb125f into btcpayserver:master Feb 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug]: HTML injection in forms for payment requests
3 participants