Skip to content

Commit

Permalink
Escape category images to avoid backend XSS
Browse files Browse the repository at this point in the history
  • Loading branch information
@hannob @onli
hannob authored and onli committed Sep 28, 2019
1 parent 464c131 commit fa8e77c
Show file tree
Hide file tree
Showing 9 changed files with 9 additions and 9 deletions.
2 changes: 1 addition & 1 deletion templates/2k11/entries.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
</header>

<div class="clearfix content serendipity_entry_body">
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|escape}" src="{$entry_category.category_icon}"></a>{/if}{/foreach}{/if}
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|escape}" src="{$entry_category.category_icon|escape}"></a>{/if}{/foreach}{/if}
{$entry.body}
{if $entry.has_extended and not $is_single_entry and not $entry.is_extended}
<a class="read_more block_level" href="{$entry.link}#extended">{$CONST.VIEW_EXTENDED_ENTRY|@sprintf:$entry.title}</a>
Expand Down
2 changes: 1 addition & 1 deletion templates/bootstrap4/entries.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
</header>

<div class="post_content clearfix">
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|escape}{$entry_category.category_description|emptyPrefix}" alt="{$entry_category.category_name|escape}" src="{$entry_category.category_icon}"></a>{/if}{/foreach}{/if}
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|escape}{$entry_category.category_description|emptyPrefix}" alt="{$entry_category.category_name|escape}" src="{$entry_category.category_icon|escape}"></a>{/if}{/foreach}{/if}
{$entry.body}
{if $entry.has_extended and not $is_single_entry and not $entry.is_extended}
<a class="post_more btn btn-outline-primary btn-sm d-inline-block mb-3" href="{$entry.link}#extended">{$CONST.VIEW_EXTENDED_ENTRY|sprintf:$entry.title}</a>
Expand Down
2 changes: 1 addition & 1 deletion templates/bulletproof/entries.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@
<span class="serendipity_entryIcon">
{foreach from=$entry.categories item="entry_category"}
{if $entry_category.category_icon}
<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon}" /></a>
<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon|escape}" /></a>
{/if}
{/foreach}
</span>
Expand Down
2 changes: 1 addition & 1 deletion templates/clean-blog/entries.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
{if $template_option.entrybody_detailed_only != true || $entry.is_extended || $is_single_entry || $is_preview}
<section id="entry">
<div class="content serendipity_entry_body clearfix">
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon}"></a>{/if}{/foreach}{/if}
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon|escape}"></a>{/if}{/foreach}{/if}
{$entry.body}
{if $entry.has_extended and not $is_single_entry and not $entry.is_extended}
<a class="read_more" href="{$entry.link}#extended"><button class="btn btn-md btn-default pull-right">{$CONST.READ_MORE} <i class="fa fa-arrow-right" aria-hidden="true"></i></button></a>
Expand Down
2 changes: 1 addition & 1 deletion templates/competition/entries.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
<span class="serendipity_entryIcon">
{foreach from=$entry.categories item="entry_category"}
{if $entry_category.category_icon}
<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon}" /></a>
<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon|escape}" /></a>
{/if}
{/foreach}
</span>
Expand Down
2 changes: 1 addition & 1 deletion templates/contest/entries.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@
<span class="serendipity_entryIcon">
{foreach from=$entry.categories item="entry_category"}
{if $entry_category.category_icon}
<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon}" /></a>
<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon|escape}" /></a>
{/if}
{/foreach}
</span>
Expand Down
2 changes: 1 addition & 1 deletion templates/default/entries.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
<span class="serendipity_entryIcon">
{foreach from=$entry.categories item="entry_category"}
{if $entry_category.category_icon}
<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon}" /></a>
<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon|escape}" /></a>
{/if}
{/foreach}
</span>
Expand Down
2 changes: 1 addition & 1 deletion templates/skeleton/entries.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
</header>

<div class="post_content">
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|escape}{$entry_category.category_description|emptyPrefix}" alt="{$entry_category.category_name|escape}" src="{$entry_category.category_icon}"></a>{/if}{/foreach}{/if}
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|escape}{$entry_category.category_description|emptyPrefix}" alt="{$entry_category.category_name|escape}" src="{$entry_category.category_icon|escape}"></a>{/if}{/foreach}{/if}
{$entry.body}
{if $entry.has_extended and not $is_single_entry and not $entry.is_extended}
<a class="button read_more" href="{$entry.link}#extended">{$CONST.VIEW_EXTENDED_ENTRY|sprintf:$entry.title}</a>
Expand Down
2 changes: 1 addition & 1 deletion templates/timeline/entries.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
{/if}
{/if}
<div class="serendipity_entry_body clearfix">
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon}"></a>{/if}{/foreach}{/if}
{if $entry.categories}{foreach from=$entry.categories item="entry_category"}{if $entry_category.category_icon}<a href="{$entry_category.category_link}"><img class="serendipity_entryIcon" title="{$entry_category.category_name|@escape}{$entry_category.category_description|@emptyPrefix}" alt="{$entry_category.category_name|@escape}" src="{$entry_category.category_icon|escape}"></a>{/if}{/foreach}{/if}
{$entry.body}
</div>
{if $entry.is_extended}
Expand Down

0 comments on commit fa8e77c

Please sign in to comment.