deac/instiki
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix Two XSS Vulnerabilities

Browse source 
Unescaped  page names (in 'edit' an 'new' views).
Unsanitized HTTP_CLIENT_IP header.
This commit is contained in:
Jacques Distler 2008-03-14 23:22:46 +00:00
parent ab63a21ccd
commit 503f956084
4 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/models/page.rb
View file

@ -77,7 +77,7 @@ class Page < ActiveRecord::Base
# Returns the original wiki-word name as separate words, so "MyPage" becomes "My Page".
def plain_name
web.brackets_only? ? name : WikiWords.separate(name)
web.brackets_only? ? CGI.escapeHTML(name) : CGI.escapeHTML(WikiWords.separate(name))
end
LOCKING_PERIOD = 30.minutes