Changeset 19418 for trunk/include/functions_metadata.inc.php

Timestamp:

Dec 13, 2012, 10:33:10 AM (11 years ago)

Author:

plg

Message:

merge r19417 from branch 2.4 to trunk

bug 2805: avoid XSS from EXIF/IPTC

File:

• trunk/include/functions_metadata.inc.php (modified) (2 diffs)

trunk/include/functions_metadata.inc.php

@@ -61 +61 @@
           foreach (array_keys($map, $iptc_key) as $pwg_key)
           {
-            $result[$pwg_key] = $value;
+            // in case the origin of the photo is unsecure (user upload), we
+            // remove HTML tags to avoid XSS (malicious execution of
+            // javascript)
+            $result[$pwg_key] = strip_tags($value);
           }
         }
@@ -141 +144 @@
   }
 
+  foreach ($result as $key => $value)
+  {
+    // in case the origin of the photo is unsecure (user upload), we remove
+    // HTML tags to avoid XSS (malicious execution of javascript)
+    $result[$key] = strip_tags($value);
+  }
+
   return $result;
 }