From a896da0d91844ed1332fae4d476582308af7c537 Mon Sep 17 00:00:00 2001
From: Thomas Tanghus <thomas@tanghus.net>
Date: Mon, 21 May 2012 21:47:15 +0200
Subject: [PATCH] Contacts: XSS fix. Still some more to check.

---
 apps/contacts/lib/vcard.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/apps/contacts/lib/vcard.php b/apps/contacts/lib/vcard.php
index 91ae3a7514d..2414efe6764 100644
--- a/apps/contacts/lib/vcard.php
+++ b/apps/contacts/lib/vcard.php
@@ -188,6 +188,9 @@ class OC_Contacts_VCard{
 			if($upgrade && in_array($property->name, $stringprops)) {
 				self::decodeProperty($property);
 			}
+			if(in_array($property->name, $stringprops)) {
+				$property->value = strip_tags($property->value);
+			}
 			// Fix format of type parameters.
 			if($upgrade && in_array($property->name, $typeprops)) {
 				OCP\Util::writeLog('contacts','OC_Contacts_VCard::updateValuesFromAdd. before: '.$property->serialize(),OCP\Util::DEBUG);
-- 
2.39.5