diff options
| author | Thomas Tanghus <thomas@tanghus.net> | 2012-05-28 12:58:51 +0200 |
|---|---|---|
| committer | Thomas Tanghus <thomas@tanghus.net> | 2012-05-28 13:19:31 +0200 |
| commit | df5bdc8e42a39ee8c74aac91ddbd03aef2731586 (patch) | |
| tree | ed5831211cd3fa176a07bf23e39a384c4373ee26 | |
| parent | 5e7b318e42bf7928f19af2ce023472273bca7608 (diff) | |
| download | nextcloud-server-df5bdc8e42a39ee8c74aac91ddbd03aef2731586.tar.gz nextcloud-server-df5bdc8e42a39ee8c74aac91ddbd03aef2731586.zip | |
Contacts: Double check XSS, and fix a rookie error ;-)
| -rw-r--r-- | apps/contacts/lib/vcard.php | 2 | ||||
| -rw-r--r-- | apps/contacts/templates/part.contacts.php | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/apps/contacts/lib/vcard.php b/apps/contacts/lib/vcard.php index 2414efe6764..a8ad695f620 100644 --- a/apps/contacts/lib/vcard.php +++ b/apps/contacts/lib/vcard.php @@ -227,7 +227,7 @@ class OC_Contacts_VCard{ $vcard->setString('FN', $fn); OCP\Util::writeLog('contacts','OC_Contacts_VCard::updateValuesFromAdd. Added missing \'FN\' field: '.$fn,OCP\Util::DEBUG); } - if(!$n || $n = ';;;;'){ // Fix missing 'N' field. Ugly hack ahead ;-) + if(!$n || $n == ';;;;'){ // Fix missing 'N' field. Ugly hack ahead ;-) $slice = array_reverse(array_slice(explode(' ', $fn), 0, 2)); // Take 2 first name parts of 'FN' and reverse. if(count($slice) < 2) { // If not enought, add one more... $slice[] = ""; diff --git a/apps/contacts/templates/part.contacts.php b/apps/contacts/templates/part.contacts.php index 00a61f72fdd..57517505405 100644 --- a/apps/contacts/templates/part.contacts.php +++ b/apps/contacts/templates/part.contacts.php @@ -8,5 +8,5 @@ } } ?> - <li role="button" book-id="<?php echo $contact['addressbookid']; ?>" data-id="<?php echo $contact['id']; ?>"><a href="index.php?id=<?php echo $contact['id']; ?>"><?php echo $display; ?></a></li> + <li role="button" book-id="<?php echo $contact['addressbookid']; ?>" data-id="<?php echo $contact['id']; ?>"><a href="index.php?id=<?php echo $contact['id']; ?>"><?php echo htmlspecialchars($display); ?></a></li> <?php endforeach; ?> |