diff options
| author | friendica <info@friendica.com> | 2014-05-14 00:55:32 -0700 |
|---|---|---|
| committer | friendica <info@friendica.com> | 2014-05-14 00:55:32 -0700 |
| commit | 2f1e4a6370da6892433b6d8d57362a5a6565e07c (patch) | |
| tree | bb7bce4517e57933128248775f20067f62ba69d8 /include | |
| parent | de550d45ff992436843bc692c52f59e0cba5c2b4 (diff) | |
| download | volse-hubzilla-2f1e4a6370da6892433b6d8d57362a5a6565e07c.tar.gz volse-hubzilla-2f1e4a6370da6892433b6d8d57362a5a6565e07c.tar.bz2 volse-hubzilla-2f1e4a6370da6892433b6d8d57362a5a6565e07c.zip | |
xss prevention
Diffstat (limited to 'include')
| -rw-r--r-- | include/widgets.php | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/include/widgets.php b/include/widgets.php index 0f6d70ff7..0ed79f1eb 100644 --- a/include/widgets.php +++ b/include/widgets.php @@ -746,6 +746,11 @@ function widget_photo($arr) { if(array_key_exists('style',$arr) && isset($arr['style'])) $style = $arr['style']; + // ensure they can't sneak in an eval(js) function + + if(strpos($style,'(') !== false) + return ''; + if(array_key_exists('zrl',$arr) && isset($arr['zrl'])) $zrl = (($arr['zrl']) ? true : false); |