diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2015-11-28 12:19:58 +0100 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2015-11-28 12:21:53 +0100 |
| commit | f3e9106864421d902cb3751fdd0004f84b369938 (patch) | |
| tree | 4b95bf59fb688f4628e213fa16b4187ec74e4cec /core/templates | |
| parent | d305412a357f31174abff757602b343c24cd91c1 (diff) | |
| download | nextcloud-server-f3e9106864421d902cb3751fdd0004f84b369938.tar.gz nextcloud-server-f3e9106864421d902cb3751fdd0004f84b369938.zip | |
Don't trust update server
In case the update server may deliver malicious content this would allow an adversary to inject arbitrary HTML into the response. So very bad stuff.
While signing the response would be better and something we can also do in the future (considering the code signing work), this is already a good first start.
Diffstat (limited to 'core/templates')
| -rw-r--r-- | core/templates/layout.user.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php index 5e13d9329f3..714525cf87e 100644 --- a/core/templates/layout.user.php +++ b/core/templates/layout.user.php @@ -4,7 +4,7 @@ <!--[if (gt IE 9)|!(IE)]><!--><html class="ng-csp" data-placeholder-focus="false" lang="<?php p($_['language']); ?>" ><!--<![endif]--> <head data-user="<?php p($_['user_uid']); ?>" data-requesttoken="<?php p($_['requesttoken']); ?>" <?php if ($_['updateAvailable']): ?> - data-update-version="<?php print($_['updateVersion']); ?>" data-update-link="<?php print_unescaped($_['updateLink']); ?>" + data-update-version="<?php p($_['updateVersion']); ?>" data-update-link="<?php p($_['updateLink']); ?>" <?php endif; ?> > <meta charset="utf-8"> |