mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix possible RSS XSS (#14457)

Browse Source 
Escape titles when shown.  Body was already cleaned.
This commit is contained in:
Tony Murray
2022-10-14 13:24:22 -05:00
committed by GitHub
parent bc48c8412a
commit 8e85698aa3
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/html/pages/notifications.inc.php
+3 -3
View File
@@ -84,7 +84,7 @@ if ($notifications['count'] > 0 && ! isset($vars['archive'])) {
$class = $notif['severity'] == 2 ? 'text-danger' : 'text-warning';
echo "<h4 class='$class' id='${notif['notifications_id']}'>";
echo "<strong><i class='fa fa-bell-o'></i>&nbsp;${notif['title']}</strong>";
echo "<strong><i class='fa fa-bell-o'></i>&nbsp;" . htmlentities($notif['title']) . '</strong>';
echo "<span class='pull-right'>";
if ($notif['user_id'] != Auth::id()) {
@@ -125,7 +125,7 @@ if ($notifications['count'] > 0 && ! isset($vars['archive'])) {
} elseif ($notif['severity'] == 2) {
$class = 'text-danger';
}
echo "<h4 class='$class' id='${notif['notifications_id']}'>${notif['title']}<span class='pull-right'>";
echo "<h4 class='$class' id='${notif['notifications_id']}'>" . htmlentities($notif['title']) . "<span class='pull-right'>";
if (Auth::user()->hasGlobalAdmin()) {
echo '<button class="btn btn-primary fa fa-bell-o stick-notif" data-toggle="tooltip" data-placement="bottom" title="Mark as Sticky" style="margin-top:-10px;"></button>';
@@ -168,7 +168,7 @@ if ($notifications['count'] > 0 && ! isset($vars['archive'])) {
} elseif ($notif['severity'] == 2) {
echo ' class="text-danger"';
}
echo " id='${notif['notifications_id']}'>${notif['title']}";
echo " id='${notif['notifications_id']}'>" . htmlentities($notif['title']);
if (Auth::user()->isAdmin()) {
echo '<span class="pull-right"><button class="btn btn-primary fa fa-bell-o stick-notif" data-toggle="tooltip" data-placement="bottom" title="Mark as Sticky" style="margin-top:-10px;"></button></span>';