Skip to content

Commit 099ec41

Browse files
committed
Security: Fix XSS vulnerability in agenda - see security report 28 - additions
1 parent 1d68026 commit 099ec41

File tree

2 files changed

+21
-5
lines changed

2 files changed

+21
-5
lines changed

main/inc/ajax/agenda.ajax.php

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,22 +19,26 @@
1919
}
2020

2121
$agenda = new Agenda($type);
22+
// get filtered type
23+
$type = $agenda->getType();
2224

2325
switch ($action) {
2426
case 'add_event':
2527
if (!$agenda->getIsAllowedToEdit()) {
2628
break;
2729
}
2830
$add_as_announcement = isset($_REQUEST['add_as_annonuncement']) ? $_REQUEST['add_as_annonuncement'] : null;
29-
$comment = isset($_REQUEST['comment']) ? $_REQUEST['comment'] : null;
31+
$title = isset($_REQUEST['title']) ? Security::remove_XSS($_REQUEST['title']) : null;
32+
$content = isset($_REQUEST['content']) ? Security::remove_XSS($_REQUEST['content']) : null;
33+
$comment = isset($_REQUEST['comment']) ? Security::remove_XSS($_REQUEST['comment']) : null;
3034
$userToSend = isset($_REQUEST['users_to_send']) ? $_REQUEST['users_to_send'] : [];
3135

3236
echo $agenda->addEvent(
3337
$_REQUEST['start'],
3438
$_REQUEST['end'],
3539
$_REQUEST['all_day'],
36-
$_REQUEST['title'],
37-
$_REQUEST['content'],
40+
$title,
41+
$content,
3842
$userToSend,
3943
$add_as_announcement,
4044
null, //$parentEventId = null,
@@ -54,8 +58,8 @@
5458
$_REQUEST['start'],
5559
$_REQUEST['end'],
5660
$_REQUEST['all_day'],
57-
$_REQUEST['title'],
58-
$_REQUEST['content']
61+
$title,
62+
$content
5963
);
6064
break;
6165
case 'delete_event':

main/inc/lib/agenda.lib.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,18 @@ public function setType($type)
160160
}
161161
}
162162

163+
/**
164+
* Returns the type previously set (and filtered) through setType
165+
* If setType() was not called, then type defaults to "personal" as
166+
* set in the class definition.
167+
*/
168+
public function getType()
169+
{
170+
if (isset($this->type)) {
171+
return $this->type;
172+
}
173+
}
174+
163175
/**
164176
* @param int $id
165177
*/

0 commit comments

Comments
 (0)