diff options
| author | Robin Appelman <icewind@owncloud.com> | 2012-04-16 12:59:08 +0200 |
|---|---|---|
| committer | Robin Appelman <icewind@owncloud.com> | 2012-04-16 12:59:38 +0200 |
| commit | cfd0140e2faa250e6e90cbeb4ec2ca4dcceed2f4 (patch) | |
| tree | 5623f496ed61199ac64f8bceb0db04bf9b6b4758 /files/templates/index.php | |
| parent | 3c182bdb351cd0f7938c9f9f022b44b4e530664d (diff) | |
| download | nextcloud-server-cfd0140e2faa250e6e90cbeb4ec2ca4dcceed2f4.tar.gz nextcloud-server-cfd0140e2faa250e6e90cbeb4ec2ca4dcceed2f4.zip | |
fix 2 potential xss problems
Diffstat (limited to 'files/templates/index.php')
| -rw-r--r-- | files/templates/index.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/files/templates/index.php b/files/templates/index.php index f423b96ba1e..639bdeaead8 100644 --- a/files/templates/index.php +++ b/files/templates/index.php @@ -15,7 +15,7 @@ <form data-upload-id='1' class="file_upload_form" action="ajax/upload.php" method="post" enctype="multipart/form-data" target="file_upload_target_1"> <input type="hidden" name="MAX_FILE_SIZE" value="<?php echo $_['uploadMaxFilesize'] ?>" id="max_upload"> <input type="hidden" class="max_human_file_size" value="(max <?php echo $_['uploadMaxHumanFilesize']; ?>)"> - <input type="hidden" name="dir" value="<?php echo $_['dir'] ?>" id="dir"> + <input type="hidden" name="dir" value="<?php echo htmlentities($_['dir']) ?>" id="dir"> <button class="file_upload_filename"> <img class='svg action' alt="Upload" src="<?php echo image_path("core", "actions/upload.svg"); ?>" /></button> <input class="file_upload_start" type="file" name='files[]'/> <a href="#" class="file_upload_button_wrapper" onclick="return false;" title="<?php echo $l->t('Upload'); echo ' max. '.$_['uploadMaxHumanFilesize'] ?>"></a> |