Changeset 26920 for branches

Timestamp:

Jan 23, 2014, 12:08:56 PM (11 years ago)

Author:

mistic100

Message:

Merged revision(s) 26916 from trunk:
bug 3029: XSS on website_url comment form

File:

• branches/2.5/include/functions_comment.inc.php (modified) (2 diffs)

branches/2.5/include/functions_comment.inc.php

@@ -136 +136 @@
   if (!empty($comm['website_url']))
   {
+    $comm['website_url'] = strip_tags($comm['website_url']);
     if (!preg_match('/^https?/i', $comm['website_url']))
     {
@@ -339 +340 @@
   if (!empty($comment['website_url']))
   {
+    $comm['website_url'] = strip_tags($comm['website_url']);
     if (!preg_match('/^https?/i', $comment['website_url']))
     {