xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-07-25 22:16:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(profile): neutralize stored XSS in profile descriptions [#250] (#252)

Browse Source
This commit is contained in:
Ferywir
2026-06-22 15:31:20 +02:00
committed by GitHub
parent 4b208dbfd8
commit 9d2d7699a9
5 changed files with 36 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Templates/player.tpl
+6 -1
View File
@@ -31,7 +31,12 @@ if(isset($id))
{
include_once("../GameEngine/Ranking.php");
$varmedal = $database->getProfileMedal($id);
$profiel="".$user['desc1']."".md5('skJkev3')."".$user['desc2']."";
// Issue #250: escape the user-controlled descriptions before they reach the
// raw nl2br() render in playerinfo.tpl, so a stored HTML/JS payload (e.g.
// <details open ontoggle="eval(...)">) is shown as inert text. BBCode is
// intentionally NOT expanded here: the admin panel has no $generator (the
// [coor] tag would fatal) and seeing the raw markup helps moderation.
$profiel=htmlspecialchars($user['desc1'] ?? '', ENT_QUOTES, 'UTF-8').md5('skJkev3').htmlspecialchars($user['desc2'] ?? '', ENT_QUOTES, 'UTF-8');
$separator="../";
require("../Templates/Profile/medal.php");
$profiel=explode("".md5('skJkev3')."", $profiel);