mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-06 22:45:02 +02:00
Code Issues Releases Wiki Activity

[ticket/12212] Encode the attachment file name before presenting to user.

Browse Source 
The uploader inserts the file name directly into the page at the moment without
handling any HTML special chars that may be in the name. This results in HTML
that may be present getting rendered in error messages and the attachments
list. This simply causes layout breakage for the user, since the backend takes
care of sanitizing the name. Once phpBB returns the file data for the uploaded
file, the name in the attachment list gets replaced by the one that phpBB
provides.

PHPBB3-12212
This commit is contained in:
Cesar G 2014-02-17 23:56:58 -08:00
parent 233bdfa5f6
commit 627dc886b3
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
phpBB/assets/javascript/plupload.js
View File

@ -162,7 +162,7 @@ phpbb.plupload.insertRow = function(file) {
var row = $(phpbb.plupload.rowTpl);
row.attr('id', file.id);
row.find('.file-name').html(file.name);
row.find('.file-name').html(plupload.xmlEncode(file.name));
row.find('.file-size').html(plupload.formatSize(file.size));
if (phpbb.plupload.order == 'desc') {
@ -496,6 +496,8 @@ $('#file-list').on('click', '.file-error', function(e) {
* Fires when an error occurs.
*/
uploader.bind('Error', function(up, error) {
error.file.name = plupload.xmlEncode(error.file.name);
// The error message that Plupload provides for these is vague, so we'll be more specific.
if (error.code === plupload.FILE_EXTENSION_ERROR) {
error.message = plupload.translate('Invalid file extension:') + ' ' + error.file.name;