aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--include/functions_metadata.inc.php12
1 files changed, 11 insertions, 1 deletions
diff --git a/include/functions_metadata.inc.php b/include/functions_metadata.inc.php
index 5a8671d77..0c7b4de52 100644
--- a/include/functions_metadata.inc.php
+++ b/include/functions_metadata.inc.php
@@ -60,7 +60,10 @@ function get_iptc_data($filename, $map)
foreach (array_keys($map, $iptc_key) as $pwg_key)
{
- $result[$pwg_key] = $value;
+ // in case the origin of the photo is unsecure (user upload), we
+ // remove HTML tags to avoid XSS (malicious execution of
+ // javascript)
+ $result[$pwg_key] = strip_tags($value);
}
}
}
@@ -140,6 +143,13 @@ function get_exif_data($filename, $map)
}
}
+ foreach ($result as $key => $value)
+ {
+ // in case the origin of the photo is unsecure (user upload), we remove
+ // HTML tags to avoid XSS (malicious execution of javascript)
+ $result[$key] = strip_tags($value);
+ }
+
return $result;
}
?> \ No newline at end of file