diff options
| -rw-r--r-- | include/functions_metadata.inc.php | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/include/functions_metadata.inc.php b/include/functions_metadata.inc.php index 5a8671d77..0c7b4de52 100644 --- a/include/functions_metadata.inc.php +++ b/include/functions_metadata.inc.php @@ -60,7 +60,10 @@ function get_iptc_data($filename, $map) foreach (array_keys($map, $iptc_key) as $pwg_key) { - $result[$pwg_key] = $value; + // in case the origin of the photo is unsecure (user upload), we + // remove HTML tags to avoid XSS (malicious execution of + // javascript) + $result[$pwg_key] = strip_tags($value); } } } @@ -140,6 +143,13 @@ function get_exif_data($filename, $map) } } + foreach ($result as $key => $value) + { + // in case the origin of the photo is unsecure (user upload), we remove + // HTML tags to avoid XSS (malicious execution of javascript) + $result[$key] = strip_tags($value); + } + return $result; } ?>
\ No newline at end of file |