[FIX] Stored-XSS using htmlentities()

monicahq · Sep 9, 2020 · 3871537 · 3871537
1 parent 5f414ca
commit 3871537
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/Http/Controllers/JournalController.php b/app/Http/Controllers/JournalController.php
@@ -160,7 +160,7 @@ public function save(Request $request)
 
         $entry = new Entry;
         $entry->account_id = $request->user()->account_id;
-        $entry->post = $request->input('entry');
+        $entry->post = htmlentities($request->input('entry'), ENT_QUOTES, 'utf-8');
 
         if ($request->input('title') != '') {
             $entry->title = $request->input('title');
@@ -206,7 +206,7 @@ public function update(Request $request, Entry $entry)
                 ->withErrors($validator);
         }
 
-        $entry->post = $request->input('entry');
+        $entry->post = htmlentities($request->input('entry'), ENT_QUOTES, 'utf-8');
 
         if ($request->input('title') != '') {
             $entry->title = $request->input('title');