From dcc5b5ca0a67d4e21442bb96d67d9d23fc7f1647 Mon Sep 17 00:00:00 2001 From: Bjoern Schiessle Date: Tue, 5 Jun 2012 10:37:22 +0200 Subject: [PATCH] xss vulnerability fixed --- apps/calendar/lib/object.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/calendar/lib/object.php b/apps/calendar/lib/object.php index f0a9bf050fc..cc80a0bb708 100644 --- a/apps/calendar/lib/object.php +++ b/apps/calendar/lib/object.php @@ -600,8 +600,8 @@ class OC_Calendar_Object{ public static function updateVCalendarFromRequest($request, $vcalendar) { - $title = $request["title"]; - $location = $request["location"]; + $title = strip_tags($request["title"]); + $location = strip_tags($request["location"]); $categories = $request["categories"]; $allday = isset($request["allday"]); $from = $request["from"]; @@ -611,7 +611,7 @@ class OC_Calendar_Object{ $totime = $request['totime']; } $vevent = $vcalendar->VEVENT; - $description = $request["description"]; + $description = strip_tags($request["description"]); $repeat = $request["repeat"]; if($repeat != 'doesnotrepeat'){ $rrule = ''; -- 2.39.5