Skip to content

Commit 252e187

Browse files
committed
SECURITY Escape links for SilverStripeNavigatorItem
1 parent 5fe7091 commit 252e187

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

Diff for: core/control/SilverStripeNavigatorItem.php

+4-4
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ function getHTML($page) {
6767
if(is_a(Controller::curr(), 'CMSMain')) {
6868
return '<a class="current">CMS</a>';
6969
} else {
70-
$cmsLink = 'admin/show/' . $page->ID;
70+
$cmsLink = Convert::raw2att('admin/show/' . $page->ID);
7171
$cmsLink = "<a href=\"$cmsLink\" class=\"newWindow\" target=\"cms\">". _t('ContentController.CMS', 'CMS') ."</a>";
7272

7373
return $cmsLink;
@@ -96,7 +96,7 @@ function getHTML($page) {
9696
} else {
9797
$draftPage = Versioned::get_one_by_stage('SiteTree', 'Stage', '"SiteTree"."ID" = ' . $page->ID);
9898
if($draftPage) {
99-
$pageLink = Controller::join_links($draftPage->AbsoluteLink(), "?stage=Stage");
99+
$pageLink = Convert::raw2att(Controller::join_links($draftPage->AbsoluteLink(), "?stage=Stage"));
100100
return "<a href=\"$pageLink\" class=\"newWindow\" target=\"site\" style=\"left : -1px;\">". _t('ContentController.DRAFTSITE', 'Draft Site') ."</a>";
101101
}
102102
}
@@ -128,7 +128,7 @@ function getHTML($page) {
128128
} else {
129129
$livePage = Versioned::get_one_by_stage('SiteTree', 'Live', '"SiteTree"."ID" = ' . $page->ID);
130130
if($livePage) {
131-
$pageLink = Controller::join_links($livePage->AbsoluteLink(), "?stage=Live");
131+
$pageLink = Convert::raw2att(Controller::join_links($livePage->AbsoluteLink(), "?stage=Live"));
132132
return "<a href=\"$pageLink\" class=\"newWindow\" target=\"site\" style=\"left : -3px;\">". _t('ContentController.PUBLISHEDSITE', 'Published Site') ."</a>";
133133
}
134134
}
@@ -165,7 +165,7 @@ function getHTML($page) {
165165
(!$currentDraft || ($currentDraft && $page->Version != $currentDraft->Version))
166166
&& (!$currentLive || ($currentLive && $page->Version != $currentLive->Version))
167167
) {
168-
$pageLink = $page->AbsoluteLink();
168+
$pageLink = Convert::raw2att($page->AbsoluteLink());
169169
return "<a href=\"$pageLink?archiveDate={$page->LastEdited}\" class=\"newWindow\" target=\"site\" style=\"left : -3px;\">". _t('ContentController.ARCHIVEDSITE', 'Archived Site') ."</a>";
170170
}
171171
}

0 commit comments

Comments
 (0)