yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Removing malicious code from the name of a Stylesheet.

Browse Source
This commit is contained in:
elitsa
2018-12-03 08:45:11 +01:00
parent 5f165d23db
commit 3a26fe8fe2
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Umbraco.Web/UI/LegacyDialogHandler.cs
View File

@@ -207,7 +207,7 @@ namespace Umbraco.Web.UI
typeInstance.TypeID = typeId;
typeInstance.ParentID = nodeId;
typeInstance.Alias = text;
typeInstance.Alias = text.CleanForXss();
// check for returning url
ITaskReturnUrl returnUrlTask = typeInstance as LegacyDialogTask;

2
src/Umbraco.Web/WebServices/SaveFileController.cs
View File

@@ -243,7 +243,7 @@ namespace Umbraco.Web.WebServices
// sanitize input - stylesheet names have no extension
var svce = (FileService)Services.FileService;
filename = CleanFilename(filename);
filename = CleanFilename(filename.CleanForXss());
oldName = CleanFilename(oldName);
if (filename != oldName)