Comunic/ComunicWeb
1
0
Fork 0
mirror of https://github.com/pierre42100/ComunicWeb synced 2024-11-26 05:49:22 +00:00
Code Issues Projects Releases Wiki Activity

Fixed security breach in conversations system

Browse Source
This commit is contained in:
Pierre 2017-07-04 21:13:02 +02:00
parent 798e43d446
commit 6251d47ca0
2 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
assets/js/common/utils.js
View File

@ -290,3 +290,30 @@ function checkString(value){
return true;
}
/**
* Remove HTML carachters : < and >
*
* @param {String} input The string to change
* @return {String} The updated string
*/
function removeHtmlTags(input){
//Prepare update
var output = input;
//Replace opening braces
while(output.includes("<")){
//Replace an occurence
output = output.replace("<", "&lt;");
}
//Replace closing braces
while(output.includes(">")){
//Replace an occurence
output = output.replace(">", "&gt;");
}
//Return result
return output;
}

2
assets/js/components/conversations/chatWindows.js
View File

@ -789,7 +789,7 @@ ComunicWeb.components.conversations.chatWindows = {
var textMessage = createElem2({
appendTo: messageTargetElem,
type: "span",
innerHTML: messageInfos.message,
innerHTML: removeHtmlTags(messageInfos.message), //Remove HTML tags
});
//Check if an image has to be added