Skip to content

Commit fe2d895

Browse files
committed
added fixed for XSS holes (fixes #93)
1 parent 18fee9b commit fe2d895

File tree

2 files changed

+4
-4
lines changed

2 files changed

+4
-4
lines changed

Diff for: templates/com/pugh/sockso/templates/web/browse/TPlaylist.jamon

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@
2323
Vector<User> recentUsers = null;
2424
</%args>
2525

26-
<& ../IHeader; properties=properties; title="Playlist: " + playlist.getName(); user=user; locale=locale; &>
26+
<& ../IHeader; properties=properties; title="Playlist: " + Utils.XMLEncode(playlist.getName()); user=user; locale=locale; &>
2727

2828
<h2>
2929
<div class="links">
30-
<% Utils.u2e(playlist.getName()) #n %>
30+
<% Utils.XMLEncode(playlist.getName()) #n %>
3131
<div class="links">
3232
<& IMusicLinks; type="pl"; id=playlist.getId(); name=playlist.getName(); shareLink=true; playRandomLink=true; locale=locale; properties=properties; &>
3333
</div>

Diff for: templates/com/pugh/sockso/templates/web/browse/TPlaylists.jamon

+2-2
Original file line numberDiff line numberDiff line change
@@ -53,12 +53,12 @@
5353
<%for Playlist playlist : userPlaylists %>
5454
<li class="playlist" id="userPlaylist<% playlist.getId() %>">
5555
<& IMusicLinks; type="pl"; id=playlist.getId(); name=playlist.getName(); locale=locale; properties=properties; &>
56-
<a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.u2e(playlist.getName()) #n %></a>
56+
<a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.XMLEncode(playlist.getName()) #n %></a>
5757
by
5858
<%if user != null && (user.getId() == playlist.getUser().getId()) %>
5959
<b>you</b>
6060
<%else>
61-
<% Utils.u2e(playlist.getUser().getName()) #n %>
61+
<% Utils.XMLEncode(playlist.getUser().getName()) #n %>
6262
</%if>
6363
(<% playlist.getTrackCount() %> track<%if playlist.getTrackCount() != 1 %>s</%if>)
6464
<%if user != null && (playlist.getUser().getId() == user.getId()) %>

0 commit comments

Comments
 (0)