merge r19417 from branch 2.4 to trunk

bug 2805: avoid XSS from EXIF/IPTC git-svn-id: http://piwigo.org/svn/trunk@19418 68402e56-0260-453c-a942-63ccdbb3a9ee
Piwigo · Dec 13, 2012 · 703465f · 703465f
1 parent 3f83863
commit 703465f
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/include/functions_metadata.inc.php b/include/functions_metadata.inc.php
@@ -60,7 +60,10 @@ function get_iptc_data($filename, $map)
 
           foreach (array_keys($map, $iptc_key) as $pwg_key)
           {
-            $result[$pwg_key] = $value;
+            // in case the origin of the photo is unsecure (user upload), we
+            // remove HTML tags to avoid XSS (malicious execution of
+            // javascript)
+            $result[$pwg_key] = strip_tags($value);
           }
         }
       }
@@ -140,6 +143,13 @@ function get_exif_data($filename, $map)
     }
   }
 
+  foreach ($result as $key => $value)
+  {
+    // in case the origin of the photo is unsecure (user upload), we remove
+    // HTML tags to avoid XSS (malicious execution of javascript)
+    $result[$key] = strip_tags($value);
+  }
+
   return $result;
 }
 ?>