mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix 2 potential xss problems

This commit is contained in:
Robin Appelman 2012-04-16 12:59:08 +02:00
parent 3c182bdb35
commit cfd0140e2f
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/templates/404.php
View File

@ -10,6 +10,6 @@ if(!isset($_)){//also provide standalone error page
<ul>
<li class='error'>
<?php echo $l->t( 'Cloud not found' ); ?><br/>
<p class='hint'><?php if(isset($_['file'])) echo $_['file']?></p>
<p class='hint'><?php if(isset($_['file'])) echo htmlentities($_['file'])?></p>
</li>
</ul>

2
files/templates/index.php
View File

@ -15,7 +15,7 @@
<form data-upload-id='1' class="file_upload_form" action="ajax/upload.php" method="post" enctype="multipart/form-data" target="file_upload_target_1">
<input type="hidden" name="MAX_FILE_SIZE" value="<?php echo $_['uploadMaxFilesize'] ?>" id="max_upload">
<input type="hidden" class="max_human_file_size" value="(max <?php echo $_['uploadMaxHumanFilesize']; ?>)">
<input type="hidden" name="dir" value="<?php echo $_['dir'] ?>" id="dir">
<input type="hidden" name="dir" value="<?php echo htmlentities($_['dir']) ?>" id="dir">
<button class="file_upload_filename">&nbsp;<img class='svg action' alt="Upload" src="<?php echo image_path("core", "actions/upload.svg"); ?>" /></button>
<input class="file_upload_start" type="file" name='files[]'/>
<a href="#" class="file_upload_button_wrapper" onclick="return false;" title="<?php echo $l->t('Upload'); echo ' max. '.$_['uploadMaxHumanFilesize'] ?>"></a>

2
files/templates/part.breadcrumb.php
View File

@ -1,6 +1,6 @@
<?php for($i=0; $i<count($_["breadcrumb"]); $i++):
$crumb = $_["breadcrumb"][$i]; ?>
<div class="crumb <?php if($i == count($_["breadcrumb"])-1) echo 'last';?> svg" data-dir='<?php echo $crumb["dir"];?>' style='background-image:url("<?php echo image_path('core','breadcrumb.png');?>")'>
<a href="<?php echo $_['baseURL'].$crumb["dir"]; ?>"><?php echo htmlspecialchars($crumb["name"]); ?></a>
<a href="<?php echo $_['baseURL'].$crumb["dir"]; ?>"><?php echo htmlentities($crumb["name"]); ?></a>
</div>
<?php endfor;?>