Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

SECURITY Escape links for SilverStripeNavigatorItem

  • Loading branch information...
commit 252e187015a4f4c14470ab39bcf6a5c43b64081e 1 parent 5fe7091
@chillu chillu authored
Showing with 4 additions and 4 deletions.
  1. +4 −4 core/control/SilverStripeNavigatorItem.php
View
8 core/control/SilverStripeNavigatorItem.php
@@ -67,7 +67,7 @@ function getHTML($page) {
if(is_a(Controller::curr(), 'CMSMain')) {
return '<a class="current">CMS</a>';
} else {
- $cmsLink = 'admin/show/' . $page->ID;
+ $cmsLink = Convert::raw2att('admin/show/' . $page->ID);
$cmsLink = "<a href=\"$cmsLink\" class=\"newWindow\" target=\"cms\">". _t('ContentController.CMS', 'CMS') ."</a>";
return $cmsLink;
@@ -96,7 +96,7 @@ function getHTML($page) {
} else {
$draftPage = Versioned::get_one_by_stage('SiteTree', 'Stage', '"SiteTree"."ID" = ' . $page->ID);
if($draftPage) {
- $pageLink = Controller::join_links($draftPage->AbsoluteLink(), "?stage=Stage");
+ $pageLink = Convert::raw2att(Controller::join_links($draftPage->AbsoluteLink(), "?stage=Stage"));
return "<a href=\"$pageLink\" class=\"newWindow\" target=\"site\" style=\"left : -1px;\">". _t('ContentController.DRAFTSITE', 'Draft Site') ."</a>";
}
}
@@ -128,7 +128,7 @@ function getHTML($page) {
} else {
$livePage = Versioned::get_one_by_stage('SiteTree', 'Live', '"SiteTree"."ID" = ' . $page->ID);
if($livePage) {
- $pageLink = Controller::join_links($livePage->AbsoluteLink(), "?stage=Live");
+ $pageLink = Convert::raw2att(Controller::join_links($livePage->AbsoluteLink(), "?stage=Live"));
return "<a href=\"$pageLink\" class=\"newWindow\" target=\"site\" style=\"left : -3px;\">". _t('ContentController.PUBLISHEDSITE', 'Published Site') ."</a>";
}
}
@@ -165,7 +165,7 @@ function getHTML($page) {
(!$currentDraft || ($currentDraft && $page->Version != $currentDraft->Version))
&& (!$currentLive || ($currentLive && $page->Version != $currentLive->Version))
) {
- $pageLink = $page->AbsoluteLink();
+ $pageLink = Convert::raw2att($page->AbsoluteLink());
return "<a href=\"$pageLink?archiveDate={$page->LastEdited}\" class=\"newWindow\" target=\"site\" style=\"left : -3px;\">". _t('ContentController.ARCHIVEDSITE', 'Archived Site') ."</a>";
}
}

1 comment on commit 252e187

@sminnee
Owner

This looks fine.

Please sign in to comment.
Something went wrong with that request. Please try again.