* Bugfix: Hilfe wird unter PHP 7 nicht angezeigt

* Bugfix: Mögliche XSS-Lücke in Template-Vorschau
sea75300 · Jan 15, 2018 · c380d34 · c380d34
1 parent 05a3ef4
commit c380d34
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 3 deletions.
diff --git a/inc/controller/action/system/help.php b/inc/controller/action/system/help.php
@@ -45,12 +45,18 @@ public function process() {
             if (!parent::process()) return false;
 
             $contents = $this->cache->read();
-            if ($this->cache->isExpired() || !is_array($contents)) {
+            if (!is_array($contents)) {
+                $contents = [];
+            }
+
+            if ($this->cache->isExpired()) {
                 $xml = simplexml_load_string($this->lang->getHelp());
                 foreach ($xml->chapter as $chapter) {
                     $headline = trim($chapter->headline);
                     $contents[$headline] = trim($chapter->text);
-                }                
+                }
+
+                $this->cache->write($contents, FPCM_LANGCACHE_TIMEOUT);
             }            
 
             $contents = $this->events->runEvent('extendHelp', $contents);

diff --git a/inc/controller/action/system/templatepreview.php b/inc/controller/action/system/templatepreview.php
@@ -62,6 +62,7 @@ public function process() {
             if (!parent::process()) return false;
 
             $this->template = $this->getTemplateById($this->tid);
+
             switch ($this->tid) {
                 case 1 :
                     $this->getArticlesPreview();
@@ -156,7 +157,11 @@ private function getArticlesPreview() {
             $this->template->setReplacementTags($replacements);
             $parsed[] = $this->template->parse();
 
-            $this->view->assign('content', implode(PHP_EOL, $parsed));
+            $this->view->assign('content', str_replace(
+                ['<script>', '</script>'],
+                ['&lt;script_diabled_in_preview&gt;', '&lt;/script_diabled_in_preview&gt;'],
+                implode(PHP_EOL, $parsed))
+            );
             $this->view->assign('commentform', '');
 
         }