From 44260a552cd4ee50ee11eee45164c725f56f7027 Mon Sep 17 00:00:00 2001
From: Bjoern Schiessle <schiessle@owncloud.com>
Date: Tue, 5 Jun 2012 10:37:22 +0200
Subject: [PATCH] xss vulnerability fixed
---
apps/calendar/lib/object.php | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/apps/calendar/lib/object.php b/apps/calendar/lib/object.php
index f0a9bf050f..cc80a0bb70 100644
--- a/apps/calendar/lib/object.php
+++ b/apps/calendar/lib/object.php
@@ -600,8 +600,8 @@ class OC_Calendar_Object{
public static function updateVCalendarFromRequest($request, $vcalendar)
{
- $title = $request["title"];
- $location = $request["location"];
+ $title = strip_tags($request["title"]);
+ $location = strip_tags($request["location"]);
$categories = $request["categories"];
$allday = isset($request["allday"]);
$from = $request["from"];
@@ -611,7 +611,7 @@ class OC_Calendar_Object{
$totime = $request['totime'];
}
$vevent = $vcalendar->VEVENT;
- $description = $request["description"];
+ $description = strip_tags($request["description"]);
$repeat = $request["repeat"];
if($repeat != 'doesnotrepeat'){
$rrule = '';
--
GitLab