diff options
| author | rub <rub@piwigo.org> | 2007-06-07 18:52:40 +0000 |
|---|---|---|
| committer | rub <rub@piwigo.org> | 2007-06-07 18:52:40 +0000 |
| commit | fcb3c824a0ee2c750453de1ccc12dd4a9af8f0b0 (patch) | |
| tree | 6854f8a69b89eea3ab36a746ca6bc43ee7303650 /include | |
| parent | d949a3862434284607dca5234b54a4e8e594d32f (diff) | |
Resolved issue 0000702: Code Injection with picture comment
Merge BSF 2029:2030 into branch-1_7
git-svn-id: http://piwigo.org/svn/branches/branch-1_7@2031 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to 'include')
| -rw-r--r-- | include/common.inc.php | 1 | ||||
| -rw-r--r-- | include/picture_comment.inc.php | 5 |
2 files changed, 4 insertions, 2 deletions
diff --git a/include/common.inc.php b/include/common.inc.php index 8c7c9d85d..1ab44143f 100644 --- a/include/common.inc.php +++ b/include/common.inc.php @@ -243,5 +243,6 @@ if (isset($conf['header_notes'])) // default event handlers add_event_handler('render_comment_content', 'htmlspecialchars'); add_event_handler('render_comment_content', 'parse_comment_content'); +add_event_handler('render_comment_author', 'strip_tags'); trigger_action('init'); ?> diff --git a/include/picture_comment.inc.php b/include/picture_comment.inc.php index c84f2a629..7ae87d78a 100644 --- a/include/picture_comment.inc.php +++ b/include/picture_comment.inc.php @@ -136,9 +136,10 @@ SELECT id,author,date,image_id,content $template->assign_block_vars( 'comments.comment', array( - 'COMMENT_AUTHOR' => empty($row['author']) + 'COMMENT_AUTHOR' => trigger_event('render_comment_author', + empty($row['author']) ? $lang['guest'] - : $row['author'], + : $row['author']), 'COMMENT_DATE' => format_date( $row['date'], |