Changeset 26916 for trunk/include/functions_comment.inc.php

Timestamp:

Jan 23, 2014, 12:06:38 PM (10 years ago)

Author:

mistic100

Message:

bug 3029: XSS on website_url comment form

File:

• trunk/include/functions_comment.inc.php (modified) (2 diffs)

trunk/include/functions_comment.inc.php

@@ -148 +148 @@
   if (!empty($comm['website_url']))
   {
+    $comm['website_url'] = strip_tags($comm['website_url']);
     if (!preg_match('/^https?/i', $comm['website_url']))
     {
@@ -352 +353 @@
   if (!empty($comment['website_url']))
   {
+    $comm['website_url'] = strip_tags($comm['website_url']);
     if (!preg_match('/^https?/i', $comment['website_url']))
     {