From 2f1e4a6370da6892433b6d8d57362a5a6565e07c Mon Sep 17 00:00:00 2001
From: friendica <info@friendica.com>
Date: Wed, 14 May 2014 00:55:32 -0700
Subject: xss prevention

---
 include/widgets.php            | 5 +++++
 version.inc                    | 2 +-
 view/css/choklet_bannertwo.css | 2 ++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/widgets.php b/include/widgets.php
index 0f6d70ff7..0ed79f1eb 100644
--- a/include/widgets.php
+++ b/include/widgets.php
@@ -746,6 +746,11 @@ function widget_photo($arr) {
 	if(array_key_exists('style',$arr) && isset($arr['style']))
 		$style = $arr['style'];
 
+	// ensure they can't sneak in an eval(js) function
+
+	if(strpos($style,'(') !== false)
+		return '';
+
 	if(array_key_exists('zrl',$arr) && isset($arr['zrl']))
 		$zrl = (($arr['zrl']) ? true : false);
 
diff --git a/version.inc b/version.inc
index 2ac8372b9..bb7d12c4b 100644
--- a/version.inc
+++ b/version.inc
@@ -1 +1 @@
-2014-05-13.674
+2014-05-14.675
diff --git a/view/css/choklet_bannertwo.css b/view/css/choklet_bannertwo.css
index 63917cb26..386f8ead3 100644
--- a/view/css/choklet_bannertwo.css
+++ b/view/css/choklet_bannertwo.css
@@ -10,6 +10,8 @@ header #banner {
 	margin-top: 75px;
 	width: 100%;
 	margin-bottom: 20px;
+	margin-left: auto;
+	margin-right: auto;
 	overflow-x: hidden;
 }
 
-- 
cgit v1.2.3