diff options
| author | 6543 <6543@obermui.de> | 2024-02-22 23:37:21 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-02-22 23:37:21 +0100 |
| commit | 4435d8a4b6a2c4a2aa667a9a326e7aaf6a988932 (patch) | |
| tree | 261aff9c1d0787113659078834d78fbe1b8cd2ef /templates/repo/wiki | |
| parent | 6ca8cb590d510c98610031675e0a316f95efaf61 (diff) | |
| download | gitea-4435d8a4b6a2c4a2aa667a9a326e7aaf6a988932.tar.gz gitea-4435d8a4b6a2c4a2aa667a9a326e7aaf6a988932.zip | |
Fix XSS vulnerabilities (#29336)
- The Wiki page did not sanitize author name
- the reviewer name on a "dismiss review" comment is also affected
- the migration page has some spots
---------
Signed-off-by: jolheiser <john.olheiser@gmail.com>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: jolheiser <john.olheiser@gmail.com>
Diffstat (limited to 'templates/repo/wiki')
| -rw-r--r-- | templates/repo/wiki/revision.tmpl | 2 | ||||
| -rw-r--r-- | templates/repo/wiki/view.tmpl | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/templates/repo/wiki/revision.tmpl b/templates/repo/wiki/revision.tmpl index 95b3cd0920..afd9c94c31 100644 --- a/templates/repo/wiki/revision.tmpl +++ b/templates/repo/wiki/revision.tmpl @@ -10,7 +10,7 @@ {{$title}} <div class="ui sub header gt-word-break"> {{$timeSince := TimeSince .Author.When ctx.Locale}} - {{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}} + {{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}} </div> </div> </div> diff --git a/templates/repo/wiki/view.tmpl b/templates/repo/wiki/view.tmpl index 039ff3f179..c6e47ee63e 100644 --- a/templates/repo/wiki/view.tmpl +++ b/templates/repo/wiki/view.tmpl @@ -40,7 +40,7 @@ {{$title}} <div class="ui sub header"> {{$timeSince := TimeSince .Author.When ctx.Locale}} - {{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}} + {{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}} </div> </div> <div class="eight wide right aligned column"> |