wamo/Qvitter
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #70 from mmn/xss_in_search_page

Browse Source 
XSS vulnerability in q parameter for search
This commit is contained in:
Hannes Mannerheim 2015-01-20 14:04:39 +01:00
commit 45df35fdc0
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/dom-functions.js
View File

@ -357,7 +357,7 @@ function setNewCurrentStream(stream,actionOnSuccess,setLocation) {
// if this is a search stream // if this is a search stream
else if(stream.substring(0,11) == 'search.json') { else if(stream.substring(0,11) == 'search.json') {
var defaultStreamName = stream; var defaultStreamName = stream;
var streamHeader = window.sL.searchVerb + ': ' + decodeURIComponent(stream.substring(stream.indexOf('?q=')+3)); var streamHeader = window.sL.searchVerb + ': ' + replaceHtmlSpecialChars(decodeURIComponent(stream.substring(stream.indexOf('?q=')+3)));
} }
// set the h2 header in the feed // set the h2 header in the feed