diff options
| author | 6543 <6543@obermui.de> | 2024-02-22 23:37:21 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-02-22 23:37:21 +0100 |
| commit | 4435d8a4b6a2c4a2aa667a9a326e7aaf6a988932 (patch) | |
| tree | 261aff9c1d0787113659078834d78fbe1b8cd2ef /templates | |
| parent | 6ca8cb590d510c98610031675e0a316f95efaf61 (diff) | |
| download | gitea-4435d8a4b6a2c4a2aa667a9a326e7aaf6a988932.tar.gz gitea-4435d8a4b6a2c4a2aa667a9a326e7aaf6a988932.zip | |
Fix XSS vulnerabilities (#29336)
- The Wiki page did not sanitize author name
- the reviewer name on a "dismiss review" comment is also affected
- the migration page has some spots
---------
Signed-off-by: jolheiser <john.olheiser@gmail.com>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: jolheiser <john.olheiser@gmail.com>
Diffstat (limited to 'templates')
| -rw-r--r-- | templates/repo/issue/view_content/comments.tmpl | 2 | ||||
| -rw-r--r-- | templates/repo/migrate/migrating.tmpl | 6 | ||||
| -rw-r--r-- | templates/repo/settings/options.tmpl | 4 | ||||
| -rw-r--r-- | templates/repo/wiki/revision.tmpl | 2 | ||||
| -rw-r--r-- | templates/repo/wiki/view.tmpl | 2 |
5 files changed, 8 insertions, 8 deletions
diff --git a/templates/repo/issue/view_content/comments.tmpl b/templates/repo/issue/view_content/comments.tmpl index 4c1b428aaa..4433d86fcc 100644 --- a/templates/repo/issue/view_content/comments.tmpl +++ b/templates/repo/issue/view_content/comments.tmpl @@ -615,7 +615,7 @@ {{else}} {{$reviewerName = .Review.OriginalAuthor}} {{end}} - {{ctx.Locale.Tr "repo.issues.review.dismissed" $reviewerName $createdStr | Safe}} + <span class="dismissed-message">{{ctx.Locale.Tr "repo.issues.review.dismissed" ($reviewerName | Escape) $createdStr | Safe}}</span> </span> </div> {{if .Content}} diff --git a/templates/repo/migrate/migrating.tmpl b/templates/repo/migrate/migrating.tmpl index 48411e2da2..7871cd7129 100644 --- a/templates/repo/migrate/migrating.tmpl +++ b/templates/repo/migrate/migrating.tmpl @@ -21,12 +21,12 @@ <div class="ui stackable middle very relaxed page grid"> <div class="sixteen wide center aligned centered column"> <div id="repo_migrating_progress"> - <p>{{ctx.Locale.Tr "repo.migrate.migrating" .CloneAddr | Safe}}</p> + <p>{{ctx.Locale.Tr "repo.migrate.migrating" (.CloneAddr | Escape) | Safe}}</p> <p id="repo_migrating_progress_message"></p> </div> <div id="repo_migrating_failed" class="gt-hidden"> {{if .CloneAddr}} - <p>{{ctx.Locale.Tr "repo.migrate.migrating_failed" .CloneAddr | Safe}}</p> + <p>{{ctx.Locale.Tr "repo.migrate.migrating_failed" (.CloneAddr | Escape) | Safe}}</p> {{else}} <p>{{ctx.Locale.Tr "repo.migrate.migrating_failed_no_addr" | Safe}}</p> {{end}} @@ -58,7 +58,7 @@ <div class="content"> <div class="ui warning message"> {{ctx.Locale.Tr "repo.settings.delete_notices_1" | Safe}}<br> - {{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName | Safe}} + {{ctx.Locale.Tr "repo.settings.delete_notices_2" (.Repository.FullName | Escape) | Safe}} {{if .Repository.NumForks}}<br> {{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}} {{end}} diff --git a/templates/repo/settings/options.tmpl b/templates/repo/settings/options.tmpl index 8456bb409b..6e7bd4ce4d 100644 --- a/templates/repo/settings/options.tmpl +++ b/templates/repo/settings/options.tmpl @@ -906,7 +906,7 @@ <div class="content"> <div class="ui warning message"> {{ctx.Locale.Tr "repo.settings.delete_notices_1" | Safe}}<br> - {{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName | Safe}} + {{ctx.Locale.Tr "repo.settings.delete_notices_2" (.Repository.FullName | Escape) | Safe}} {{if .Repository.NumForks}}<br> {{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}} {{end}} @@ -941,7 +941,7 @@ <div class="content"> <div class="ui warning message"> {{ctx.Locale.Tr "repo.settings.delete_notices_1" | Safe}}<br> - {{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" .Repository.Name | Safe}} + {{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" (.Repository.Name | Escape) | Safe}} </div> <form class="ui form" action="{{.Link}}" method="post"> {{.CsrfTokenHtml}} diff --git a/templates/repo/wiki/revision.tmpl b/templates/repo/wiki/revision.tmpl index 95b3cd0920..afd9c94c31 100644 --- a/templates/repo/wiki/revision.tmpl +++ b/templates/repo/wiki/revision.tmpl @@ -10,7 +10,7 @@ {{$title}} <div class="ui sub header gt-word-break"> {{$timeSince := TimeSince .Author.When ctx.Locale}} - {{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}} + {{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}} </div> </div> </div> diff --git a/templates/repo/wiki/view.tmpl b/templates/repo/wiki/view.tmpl index 039ff3f179..c6e47ee63e 100644 --- a/templates/repo/wiki/view.tmpl +++ b/templates/repo/wiki/view.tmpl @@ -40,7 +40,7 @@ {{$title}} <div class="ui sub header"> {{$timeSince := TimeSince .Author.When ctx.Locale}} - {{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}} + {{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}} </div> </div> <div class="eight wide right aligned column"> |