merge r19417 from branch 2.4 to trunk

bug 2805: avoid XSS from EXIF/IPTC



git-svn-id: http://piwigo.org/svn/trunk@19418 68402e56-0260-453c-a942-63ccdbb3a9ee

1 files changed, 11 insertions, 1 deletions

diff --git a/include/functions_metadata.inc.php b/include/functions_metadata.inc.php
index 5a8671d77..0c7b4de52 100644
--- a/include/functions_metadata.inc.php
+++ b/include/functions_metadata.inc.php
@@ -60,7 +60,10 @@ function get_iptc_data($filename, $map)
 
           foreach (array_keys($map, $iptc_key) as $pwg_key)
           {
-            $result[$pwg_key] = $value;
+            // in case the origin of the photo is unsecure (user upload), we
+            // remove HTML tags to avoid XSS (malicious execution of
+            // javascript)
+            $result[$pwg_key] = strip_tags($value);
           }
         }
       }
@@ -140,6 +143,13 @@ function get_exif_data($filename, $map)
     }
   }
 
+  foreach ($result as $key => $value)
+  {
+    // in case the origin of the photo is unsecure (user upload), we remove
+    // HTML tags to avoid XSS (malicious execution of javascript)
+    $result[$key] = strip_tags($value);
+  }
+
   return $result;
 }
 ?>
\ No newline at end of file