Mascali/raspisms
1
0
Fork 0
mirror of https://github.com/RaspbianFrance/raspisms.git synced 2025-04-22 17:36:29 +02:00
Code Issues Projects Releases Wiki Activity

Fix de failles xss et limitation des messages dans une discussion à 25

Browse source
This commit is contained in:
Pierre-Lin Bonnemaison 2015-08-17 02:41:51 +02:00
parent 4f9bb3e256
commit 43eb2dc610
2 changed files with 15 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

12
templates/discussions/show.php
View file

@ -71,8 +71,8 @@
var texte = '' +
'<div class="clearfix message-container">' +
'<div class="discussion-message message-received">' +
'<div class="discussion-message-text">' + message.text.replace(/</g, "&lt;").replace(/>/g, "&gt;") + '</div>' +
'<div class="discussion-message-date">' + message.date.replace(/</g, "&lt;").replace(/>/g, "&gt;") + '</div>' +
'<div class="discussion-message-text">' + message.text + '</div>' +
'<div class="discussion-message-date">' + message.date + '</div>' +
'</div>' +
'</div>';
break;
@ -80,8 +80,8 @@
var texte = '' +
'<div class="clearfix message-container">' +
'<div class="discussion-message message-sended">' +
'<div class="discussion-message-text">' + message.text.replace(/</g, "&lt;").replace(/>/g, "&gt;") + '</div>' +
'<div class="discussion-message-date">' + message.date.replace(/</g, "&lt;").replace(/>/g, "&gt;") + '</div>' +
'<div class="discussion-message-text">' + message.text + '</div>' +
'<div class="discussion-message-date">' + message.date + '</div>' +
'</div>' +
'</div>';
break;
@ -90,8 +90,8 @@
'<div class="clearfix message-container">' +
'<div class="discussion-message message-sended">' +
'<div class="message-in-progress-hover"><i class="fa fa-spinner fa-spin"></i></div>' +
'<div class="discussion-message-text">' + message.text.replace(/</g, "&lt;").replace(/>/g, "&gt;") + '</div>' +
'<div class="discussion-message-date">' + message.date.replace(/</g, "&lt;").replace(/>/g, "&gt;") + '</div>' +
'<div class="discussion-message-text">' + message.text + '</div>' +
'<div class="discussion-message-date">' + message.date + '</div>' +
'</div>' +
'</div>';
break;