Skip to content

Commit 3c770c2

Browse files
committed
Security - Reintroducing HTML filter after report by Javier Bloem that it introduces an XSS, secifically for portals open to new teachers created by anonymous users, and reverting commit svn r20496 referencing issue http://projects.dokeos.com/index.php?do=details&task_id=4109 not accessible to the public anymore.
1 parent 2bfe104 commit 3c770c2

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

main/course_info/infocours.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ function is_settings_editable() {
134134

135135

136136
$form->add_textfield('title', get_lang('Title'), true, array('class' => 'span6'));
137-
//$form->applyFilter('title', 'html_filter');
137+
$form->applyFilter('title', 'html_filter');
138138
$form->applyFilter('title', 'trim');
139139

140140
//$form->add_textfield('tutor_name', get_lang('Professors'), true, array ('size' => '60'));
@@ -154,9 +154,11 @@ function is_settings_editable() {
154154
$form->addElement('select_language', 'course_language', array(get_lang('Ln'), get_lang('TipLang')));
155155

156156
$form->add_textfield('department_name', get_lang('Department'), false, array('class' => 'span5'));
157+
$form->applyFilter('department_name', 'html_filter');
157158
$form->applyFilter('department_name', 'trim');
158159

159160
$form->add_textfield('department_url', get_lang('DepartmentUrl'), false, array('class' => 'span5'));
161+
$form->applyFilter('department_url', 'html_filter');
160162
//$form->addRule('tutor_name', get_lang('ThisFieldIsRequired'), 'required');
161163

162164

0 commit comments

Comments
 (0)