mirror_php/formwork
1
0
Fork 0
mirror of https://github.com/getformwork/formwork.git synced 2025-01-29 11:31:19 +01:00
Code Issues Packages Projects Releases Wiki Activity

Escape meta attributes to avoid XSS injection

Browse Source
This commit is contained in:
Giuseppe Criscione 2024-06-07 11:30:16 +02:00
parent 257150aee2
commit f5312015a5
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
site/templates/partials/meta.php
View File

@ -1,9 +1,9 @@
<?php foreach ($page->metadata() as $meta) : ?>
<?php if ($meta->isCharset()) : ?>
<meta charset="<?= $meta->content() ?>">
<meta charset="<?= $this->escapeAttr($meta->content()) ?>">
<?php elseif ($meta->isHTTPEquiv()) : ?>
<meta http-equiv="<?= $meta->name() ?>" content="<?= $meta->content() ?>">
<meta http-equiv="<?= $this->escapeAttr($meta->name()) ?>" content="<?= $this->escapeAttr($meta->content()) ?>">
<?php else : ?>
<meta <?= $meta->prefix() === 'og' ? 'property' : 'name' ?>="<?= $meta->name() ?>" content="<?= $meta->content() ?>">
<meta <?= $meta->prefix() === 'og' ? 'property' : 'name' ?>="<?= $this->escapeAttr($meta->name()) ?>" content="<?= $this->escapeAttr($meta->content()) ?>">
<?php endif ?>
<?php endforeach ?>