xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-17 00:31:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(profile): neutralize stored XSS in profile descriptions [#250] (#252)

Browse Source
This commit is contained in:
Ferywir
2026-06-22 15:31:20 +02:00
committed by GitHub
parent 4b208dbfd8
commit 9d2d7699a9
5 changed files with 36 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Templates/Profile/overview.tpl
+19 -2
View File
@@ -40,8 +40,17 @@ $varmedal = $database->getProfileMedal($uid);
// marker legacy (păstrat pentru compatibilitate DB)
$profileSeparator = md5('skJkev3');
// păstrăm exact formatul original (IMPORTANT pentru medal.php)
$profiel = $displayarray['desc1'] . $profileSeparator . $displayarray['desc2'];
// Issue #250: profile descriptions are user-controlled free text. Escape them
// BEFORE any markup expansion so embedded HTML/JS (e.g. a stored
// <details open ontoggle="eval(...)"> payload) is rendered inert, then expand
// the BBCode the form advertises ("Suport BBCode"). The md5 separator and the
// [#..] medal markers carry no HTML/BBCode-special characters, so they survive
// htmlspecialchars()/BBCode.php untouched and are still handled by medal.php.
$input = htmlspecialchars($displayarray['desc1'] ?? '', ENT_QUOTES, 'UTF-8')
. $profileSeparator
. htmlspecialchars($displayarray['desc2'] ?? '', ENT_QUOTES, 'UTF-8');
include("GameEngine/BBCode.php");
$profiel = $bbcoded;
// medal.php se ocupă de procesare (NU îi strica inputul)
require("medal.php");
@@ -253,7 +262,12 @@ if ($uid == $session->uid) {
<tr>
<td colspan="2" class="desc2">
<div class="desc2div">
<!-- Issue #250: the "messages" wrapper re-uses the existing smiley sprite
CSS (scoped to div.messages/div.forum) so BBCode smileys render here too;
its only layout rule (padding/width) is overridden inline. -->
<div class="messages" style="padding:0;width:auto">
<?php echo nl2br($profiel[0]); ?>
</div>
</div>
</td>
</tr>
@@ -264,7 +278,10 @@ if ($uid == $session->uid) {
<td class="desc1">
<div class="desc1div">
<!-- Issue #250: see the matching wrapper above (enables BBCode smileys). -->
<div class="messages" style="padding:0;width:auto">
<?php echo nl2br($profiel[1]); ?>
</div>
</div>
</td>
Templates/Profile/profile.tpl
+2 -2
View File
@@ -95,7 +95,7 @@ maxlength="4" class="text year">
<!-- DESCRIPTION RIGHT -->
<td rowspan="<?php echo 7 + count($database->getProfileVillages($session->uid)); ?>" class="desc1">
<textarea tabindex="7" name="be1"><?= htmlspecialchars($session->userinfo['desc2'] ?? '', ENT_QUOTES, 'UTF-8') ?></textarea>
<textarea tabindex="7" name="be1" maxlength="3000"><?= htmlspecialchars($session->userinfo['desc2'] ?? '', ENT_QUOTES, 'UTF-8') ?></textarea>
</td>
</tr>
@@ -152,7 +152,7 @@ maxlength="30" class="text">
<!-- DESCRIPTION LEFT -->
<tr>
<td colspan="2" class="desc2">
<textarea tabindex="8" name="be2"><?= htmlspecialchars($session->userinfo['desc1'] ?? '', ENT_QUOTES, 'UTF-8') ?></textarea>
<textarea tabindex="8" name="be2" maxlength="3000"><?= htmlspecialchars($session->userinfo['desc1'] ?? '', ENT_QUOTES, 'UTF-8') ?></textarea>
</td>
</tr>