yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Html encode nodenames to prevent XSS attacks. Fixes U4-10497 XSS Vulnerability in page name.

Browse Source 
(cherry picked from commit fe2b86b681)
This commit is contained in:
Sebastiaan Janssen
2017-10-06 14:38:07 +02:00
parent f46ef0b006
commit fd577afe2c
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs
View File

@@ -30,7 +30,7 @@ namespace Umbraco.Web.UI.Umbraco.Dialogs
}
DocumentId = doc.Id;
PageName = doc.Name;
PageName = Server.HtmlEncode(doc.Name);
DocumentPath = doc.Path;
}

2
src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs
View File

@@ -26,7 +26,7 @@ namespace umbraco.dialogs
protected void Page_Load(object sender, EventArgs e)
{
Button1.Text = ui.Text("update");
pane_form.Text = ui.Text("notifications", "editNotifications", node.Text, base.getUser());
pane_form.Text = ui.Text("notifications", "editNotifications", Server.HtmlEncode(node.Text), base.getUser());
}
#region Web Form Designer generated code