Inicio Explorar Axuda
Iniciar sesión
computer_glamour
/
privatebin-mirror
réplica de https://github.com/PrivateBin/PrivateBin
1
0
Fork 0
Ficheiros Incidencias 0 Wiki
Explorar o código

properly escaping HTML in raw text mode, fixes #358

El RIDO %!s(int64=8) %!d(string=hai) anos
pai
fe7fa09ce8
achega
8b71cb0b2f
Modificáronse 3 ficheiros con 3 adicións e 3 borrados
Dividir vista Mostrar estatísticas de Diff
  1. 1 1
      js/privatebin.js
  2. 1 1
      tpl/bootstrap.php
  3. 1 1
      tpl/page.php

+ 1 - 1
js/privatebin.js
Ver ficheiro 

@@ -2894,7 +2894,7 @@ jQuery.PrivateBin = (function($, sjcl, Base64, RawDeflate) {
 
             for (var i = 0; i < $head.length; i++) {
 
                 newDoc.write($head[i].outerHTML);
 
             }
 
-            newDoc.write('</head><body><pre>' + DOMPurify.sanitize(paste) + '</pre></body></html>');
 
+            newDoc.write('</head><body><pre>' + DOMPurify.sanitize($('<div />').text(paste).html()) + '</pre></body></html>');
 
             newDoc.close();
 
         }

+ 1 - 1
tpl/bootstrap.php
Ver ficheiro 

@@ -75,7 +75,7 @@ if ($MARKDOWN):
 
 endif;
 
 ?>
 
 		<script type="text/javascript" data-cfasync="false" src="js/purify-1.0.7.js" integrity="sha512-VnKJHLosO8z2ojNvWk9BEKYqnhZyWK9rM90FgZUUEp/PRnUqR5OLLKE0a3BkVmn7YgB7LXRrjHgFHQYKd6DAIA==" crossorigin="anonymous"></script>
 
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-5xT6WHyurvC0LFESbkycBMAjhsi0KL/Xhx2oU+d0bqiJPkWK6ZAZgZ7I02oQiXaLtFSLf7UqpBo5XEePlfhH7Q==" crossorigin="anonymous"></script>
 
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-gFuGN7PD3lRe5ZTe/S2NfugOrjqNWYgEwBmb3Grk2EVckz1UbqVPs8+PQp6SmQ0preKNpXC50omnwGh4MPkoRg==" crossorigin="anonymous"></script>
 
 		<!--[if lt IE 10]>
 
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 
 		<![endif]-->

+ 1 - 1
tpl/page.php
Ver ficheiro 

@@ -53,7 +53,7 @@ if ($MARKDOWN):
 
 endif;
 
 ?>
 
 		<script type="text/javascript" data-cfasync="false" src="js/purify-1.0.7.js" integrity="sha512-VnKJHLosO8z2ojNvWk9BEKYqnhZyWK9rM90FgZUUEp/PRnUqR5OLLKE0a3BkVmn7YgB7LXRrjHgFHQYKd6DAIA==" crossorigin="anonymous"></script>
 
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-5xT6WHyurvC0LFESbkycBMAjhsi0KL/Xhx2oU+d0bqiJPkWK6ZAZgZ7I02oQiXaLtFSLf7UqpBo5XEePlfhH7Q==" crossorigin="anonymous"></script>
 
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-gFuGN7PD3lRe5ZTe/S2NfugOrjqNWYgEwBmb3Grk2EVckz1UbqVPs8+PQp6SmQ0preKNpXC50omnwGh4MPkoRg==" crossorigin="anonymous"></script>
 
 		<!--[if lt IE 10]>
 
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 
 		<![endif]-->