fixed xss vulnerability in un-packed version of jquery.fancybox and repack it

2012-06-14 13:41:39 +02:00 · 2012-06-14 13:41:39 +02:00 · 211a546600
parent b0ecef02e9
commit 211a546600
2 changed files with 3 additions and 794 deletions
--- a/apps/files_imageviewer/js/jquery.fancybox-1.3.4.js
+++ b/apps/files_imageviewer/js/jquery.fancybox-1.3.4.js
@ -84,7 +84,8 @@
 			}

 			title = selectedOpts.title || (obj.nodeName ? $(obj).attr('title') : obj.title) || '';
-
+			title = title.replace(/</, "&lt;").replace(/>/, "&gt;");
+			
 			if (obj.nodeName && !selectedOpts.orig) {
 				selectedOpts.orig = $(obj).children("img:first").length ? $(obj).children("img:first") : $(obj);
 			}
--- a/apps/files_imageviewer/js/jquery.fancybox-1.3.4.pack.js
+++ b/apps/files_imageviewer/js/jquery.fancybox-1.3.4.pack.js