Avoid stored XSS in task external link

kanboard · Jun 3, 2023 · 05f1d23 · 05f1d23
1 parent c20be8f
commit 05f1d23
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/app/Template/board/tooltip_external_links.php b/app/Template/board/tooltip_external_links.php
@@ -11,7 +11,7 @@
                     <?= $link['type'] ?>
                 </td>
                 <td>
-                    <a href="<?= $link['url'] ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?></a>
+                    <a href="<?= $this->text->e($link['url']) ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?></a>
                 </td>
                 <td>
                     <?= $this->text->e($link['dependency_label']) ?>

diff --git a/app/Template/task_external_link/table.php b/app/Template/task_external_link/table.php
@@ -29,7 +29,7 @@
                 <?= $this->text->e($link['type']) ?>
             </td>
             <td>
-                <a href="<?= $link['url'] ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?><span class="ui-helper-hidden-accessible"> (<?= $this->text->e($link['url']) ?>)</span></a>
+                <a href="<?= $this->text->e($link['url']) ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?><span class="ui-helper-hidden-accessible"> (<?= $this->text->e($link['url']) ?>)</span></a>
             </td>
             <td>
                 <?= $this->text->e($link['dependency_label']) ?>