Contacts: Backport XSS fix.

owncloud · May 21, 2012 · 54a3717 · 54a3717
1 parent 3775c0d
commit 54a3717
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/apps/contacts/lib/vcard.php b/apps/contacts/lib/vcard.php
@@ -188,6 +188,9 @@ protected static function updateValuesFromAdd($aid, &$vcard) { // any suggestion
 			if($upgrade && in_array($property->name, $stringprops)) {
 				self::decodeProperty($property);
 			}
+			if(in_array($property->name, $stringprops)) {
+				$property->value = strip_tags($property->value);
+			}
 			// Fix format of type parameters.
 			if($upgrade && in_array($property->name, $typeprops)) {
 				OCP\Util::writeLog('contacts','OC_Contacts_VCard::updateValuesFromAdd. before: '.$property->serialize(),OCP\Util::DEBUG);