Fixed possible XSS.

hschletz · Feb 19, 2014 · 185ecdc · 185ecdc
1 parent dd9ff33
commit 185ecdc
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 2 deletions.
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
@@ -11,6 +11,8 @@ CHANGES IN VERSION 0.14
 
 Fixed bugs:
 
+- Console: Fixed possible XSS.
+
 - Console: Fixed fatal error when a locking conflict occurs.
 
 

diff --git a/application/views/scripts/software/accept.phtml b/application/views/scripts/software/accept.phtml
@@ -26,7 +26,7 @@ print $this->htmlTag(
         $this->translate(
             'Software \'%s\' will be marked as known and accepted. Continue?'
         ),
-        Model_Software::mangleName($this->name)
+        $this->escape(Model_Software::mangleName($this->name))
     )
 );
 

diff --git a/application/views/scripts/software/ignore.phtml b/application/views/scripts/software/ignore.phtml
@@ -26,7 +26,7 @@ print $this->htmlTag(
         $this->translate(
             'Software \'%s\' will be no longer be displayed. Continue?'
         ),
-        Model_Software::mangleName($this->name)
+        $this->escape(Model_Software::mangleName($this->name))
     )
 );