prevent xss attacks by manipulating image file names

2012-06-04 16:22:25 +02:00 · 2012-06-04 16:22:25 +02:00 · f291a843bf
parent 1d6ca084a6
commit f291a843bf
1 changed files with 1 additions and 1 deletions
--- a/apps/files_imageviewer/js/lightbox.js
+++ b/apps/files_imageviewer/js/lightbox.js
@ -25,7 +25,7 @@ function viewImage(dir, file) {
 	var location=OC.filePath('files','ajax','download.php')+'?files='+file+'&dir='+dir;
 	$.fancybox({
 		"href": location,
-		"title": file,
+		"title": file.replace(/</, "&lt;").replace(/>/, "&gt;"),
 		"titlePosition": "inside"
 	});
 }