فهرست منبع

Certain hosts could try to inject html using the <body> tag as a reference point (replacing it server-side), this could break all the javascript of the post page

Signed-off-by: emanuele <[email protected]>
emanuele 12 سال پیش
والد
کامیت
e06a46164b
1فایلهای تغییر یافته به همراه1 افزوده شده و 0 حذف شده
  1. 1 0
      Sources/QueryString.php

+ 1 - 0
Sources/QueryString.php

@@ -572,6 +572,7 @@ function JavaScriptEscape($string)
 		'\'' => '\\\'',
 		'</' => '<\' + \'/',
 		'script' => 'scri\'+\'pt',
+		'<body>' => '<bo\'+\'dy>',
 		'<a href' => '<a hr\'+\'ef',
 		$scripturl => '\' + smf_scripturl + \'',
 	)) . '\'';