summaryrefslogtreecommitdiffstats
path: root/templates
diff options
context:
space:
mode:
author6543 <6543@obermui.de>2024-02-22 23:37:21 +0100
committerGitHub <noreply@github.com>2024-02-22 23:37:21 +0100
commit4435d8a4b6a2c4a2aa667a9a326e7aaf6a988932 (patch)
tree261aff9c1d0787113659078834d78fbe1b8cd2ef /templates
parent6ca8cb590d510c98610031675e0a316f95efaf61 (diff)
downloadgitea-4435d8a4b6a2c4a2aa667a9a326e7aaf6a988932.tar.gz
gitea-4435d8a4b6a2c4a2aa667a9a326e7aaf6a988932.zip
Fix XSS vulnerabilities (#29336)
- The Wiki page did not sanitize author name - the reviewer name on a "dismiss review" comment is also affected - the migration page has some spots --------- Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: Gusted <postmaster@gusted.xyz> Co-authored-by: jolheiser <john.olheiser@gmail.com>
Diffstat (limited to 'templates')
-rw-r--r--templates/repo/issue/view_content/comments.tmpl2
-rw-r--r--templates/repo/migrate/migrating.tmpl6
-rw-r--r--templates/repo/settings/options.tmpl4
-rw-r--r--templates/repo/wiki/revision.tmpl2
-rw-r--r--templates/repo/wiki/view.tmpl2
5 files changed, 8 insertions, 8 deletions
diff --git a/templates/repo/issue/view_content/comments.tmpl b/templates/repo/issue/view_content/comments.tmpl
index 4c1b428aaa..4433d86fcc 100644
--- a/templates/repo/issue/view_content/comments.tmpl
+++ b/templates/repo/issue/view_content/comments.tmpl
@@ -615,7 +615,7 @@
{{else}}
{{$reviewerName = .Review.OriginalAuthor}}
{{end}}
- {{ctx.Locale.Tr "repo.issues.review.dismissed" $reviewerName $createdStr | Safe}}
+ <span class="dismissed-message">{{ctx.Locale.Tr "repo.issues.review.dismissed" ($reviewerName | Escape) $createdStr | Safe}}</span>
</span>
</div>
{{if .Content}}
diff --git a/templates/repo/migrate/migrating.tmpl b/templates/repo/migrate/migrating.tmpl
index 48411e2da2..7871cd7129 100644
--- a/templates/repo/migrate/migrating.tmpl
+++ b/templates/repo/migrate/migrating.tmpl
@@ -21,12 +21,12 @@
<div class="ui stackable middle very relaxed page grid">
<div class="sixteen wide center aligned centered column">
<div id="repo_migrating_progress">
- <p>{{ctx.Locale.Tr "repo.migrate.migrating" .CloneAddr | Safe}}</p>
+ <p>{{ctx.Locale.Tr "repo.migrate.migrating" (.CloneAddr | Escape) | Safe}}</p>
<p id="repo_migrating_progress_message"></p>
</div>
<div id="repo_migrating_failed" class="gt-hidden">
{{if .CloneAddr}}
- <p>{{ctx.Locale.Tr "repo.migrate.migrating_failed" .CloneAddr | Safe}}</p>
+ <p>{{ctx.Locale.Tr "repo.migrate.migrating_failed" (.CloneAddr | Escape) | Safe}}</p>
{{else}}
<p>{{ctx.Locale.Tr "repo.migrate.migrating_failed_no_addr" | Safe}}</p>
{{end}}
@@ -58,7 +58,7 @@
<div class="content">
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.delete_notices_1" | Safe}}<br>
- {{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName | Safe}}
+ {{ctx.Locale.Tr "repo.settings.delete_notices_2" (.Repository.FullName | Escape) | Safe}}
{{if .Repository.NumForks}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
{{end}}
diff --git a/templates/repo/settings/options.tmpl b/templates/repo/settings/options.tmpl
index 8456bb409b..6e7bd4ce4d 100644
--- a/templates/repo/settings/options.tmpl
+++ b/templates/repo/settings/options.tmpl
@@ -906,7 +906,7 @@
<div class="content">
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.delete_notices_1" | Safe}}<br>
- {{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName | Safe}}
+ {{ctx.Locale.Tr "repo.settings.delete_notices_2" (.Repository.FullName | Escape) | Safe}}
{{if .Repository.NumForks}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
{{end}}
@@ -941,7 +941,7 @@
<div class="content">
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.delete_notices_1" | Safe}}<br>
- {{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" .Repository.Name | Safe}}
+ {{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" (.Repository.Name | Escape) | Safe}}
</div>
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
diff --git a/templates/repo/wiki/revision.tmpl b/templates/repo/wiki/revision.tmpl
index 95b3cd0920..afd9c94c31 100644
--- a/templates/repo/wiki/revision.tmpl
+++ b/templates/repo/wiki/revision.tmpl
@@ -10,7 +10,7 @@
{{$title}}
<div class="ui sub header gt-word-break">
{{$timeSince := TimeSince .Author.When ctx.Locale}}
- {{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}}
+ {{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}}
</div>
</div>
</div>
diff --git a/templates/repo/wiki/view.tmpl b/templates/repo/wiki/view.tmpl
index 039ff3f179..c6e47ee63e 100644
--- a/templates/repo/wiki/view.tmpl
+++ b/templates/repo/wiki/view.tmpl
@@ -40,7 +40,7 @@
{{$title}}
<div class="ui sub header">
{{$timeSince := TimeSince .Author.When ctx.Locale}}
- {{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}}
+ {{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}}
</div>
</div>
<div class="eight wide right aligned column">