aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorrub <rub@piwigo.org>2007-06-07 18:52:40 +0000
committerrub <rub@piwigo.org>2007-06-07 18:52:40 +0000
commitfcb3c824a0ee2c750453de1ccc12dd4a9af8f0b0 (patch)
tree6854f8a69b89eea3ab36a746ca6bc43ee7303650 /include
parentd949a3862434284607dca5234b54a4e8e594d32f (diff)
Resolved issue 0000702: Code Injection with picture comment
Merge BSF 2029:2030 into branch-1_7 git-svn-id: http://piwigo.org/svn/branches/branch-1_7@2031 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to 'include')
-rw-r--r--include/common.inc.php1
-rw-r--r--include/picture_comment.inc.php5
2 files changed, 4 insertions, 2 deletions
diff --git a/include/common.inc.php b/include/common.inc.php
index 8c7c9d85d..1ab44143f 100644
--- a/include/common.inc.php
+++ b/include/common.inc.php
@@ -243,5 +243,6 @@ if (isset($conf['header_notes']))
// default event handlers
add_event_handler('render_comment_content', 'htmlspecialchars');
add_event_handler('render_comment_content', 'parse_comment_content');
+add_event_handler('render_comment_author', 'strip_tags');
trigger_action('init');
?>
diff --git a/include/picture_comment.inc.php b/include/picture_comment.inc.php
index c84f2a629..7ae87d78a 100644
--- a/include/picture_comment.inc.php
+++ b/include/picture_comment.inc.php
@@ -136,9 +136,10 @@ SELECT id,author,date,image_id,content
$template->assign_block_vars(
'comments.comment',
array(
- 'COMMENT_AUTHOR' => empty($row['author'])
+ 'COMMENT_AUTHOR' => trigger_event('render_comment_author',
+ empty($row['author'])
? $lang['guest']
- : $row['author'],
+ : $row['author']),
'COMMENT_DATE' => format_date(
$row['date'],