mirrors/wallabag
1
0
Fork 0
mirror of https://github.com/wallabag/wallabag.git synced 2025-04-23 18:34:06 +00:00
Code Issues Projects Releases Wiki Activity

Fix XSS on username on share page

Browse source
This commit is contained in:
Jeremy Benoist 2023-02-07 19:58:06 +01:00
parent 784bc1393c
commit bd4c71682e
No known key found for this signature in database
GPG key ID: 7168D5DD29F38552
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/Wallabag/CoreBundle/Resources/views/themes/common/Entry/share.html.twig
View file

@ -28,7 +28,7 @@
<header class="block"> <header class="block">
<h1>{{ entry.title|e|raw }}</h1> <h1>{{ entry.title|e|raw }}</h1>
<a href="{{ entry.url|e }}" target="_blank" rel="noopener" title="{{ 'entry.view.original_article'|trans }} : {{ entry.title|e|raw }}" class="tool">{{ entry.domainName|removeWww }}</a> <a href="{{ entry.url|e }}" target="_blank" rel="noopener" title="{{ 'entry.view.original_article'|trans }} : {{ entry.title|e|raw }}" class="tool">{{ entry.domainName|removeWww }}</a>
<p class="shared-by">{{ "entry.public.shared_by_wallabag"|trans({'%wallabag_instance%': url('homepage'), '%username%': entry.user.username})|raw }}.</p> <p class="shared-by">{{ "entry.public.shared_by_wallabag"|trans({'%wallabag_instance%': url('homepage'), '%username%': entry.user.username|escape})|raw }}.</p>
</header> </header>
<article class="block"> <article class="block">
{{ entry.content | raw }} {{ entry.content | raw }}