tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ent-7062-vulneravilidad-xx-en-mensajes' into 'develop' 

fixed xss vulnerability

See merge request artica/pandorafms!3861
This commit is contained in:
Daniel Rodriguez 2021-03-18 10:00:35 +00:00
parent de175ec755 9040e832b8
commit cb1da6d7ba
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
pandora_console/include/functions_notifications.php
View File

@ -1080,6 +1080,27 @@ function notifications_print_dropdown_element($message_info)
break;
}
$split_subject = explode(' ', io_safe_output($message_info['subject']));
$is_image = false;
$img = '';
foreach ($split_subject as $item) {
if ($is_image) {
if (preg_match('/src/', $item)) {
$img .= $item.' >';
$is_image = false;
}
}
if (preg_match('/img/', $item)) {
$img = '<img ';
$is_image = true;
}
}
if ($img !== '') {
$message_info['subject'] = io_safe_input($img);
}
return sprintf(
"<a
class='notification-item'