Show
Ignore:
Timestamp:
04/01/09 18:43:57 (4 years ago)
Author:
d0nut
Message:

xss bug

Files:
1 modified

Legend:

Unmodified
Added
Removed

  • bbcode.google/files/lib/data/message/bbcode/GoogleBBCode.class.php

    r192 r842  
    4040 
    4141                if ($parser->getOutputType() == 'text/html') { 
    42                         return '<a href="'.$url.'" class="google" style="background-image:url(\''.RELATIVE_WCF_DIR.'icon/wysiwyg/googleS.png\');background-repeat:no-repeat;background-position:left;padding-left:25px">'.$text.'</a>'; 
     42                        return '<a href="'.StringUtil::encodeHTML($url).'" class="google" style="background-image:url(\''.RELATIVE_WCF_DIR.'icon/wysiwyg/googleS.png\');background-repeat:no-repeat;background-position:left;padding-left:25px">'.StringUtil::encodeHTML($text).'</a>'; 
    4343                } 
    4444                else if ($parser->getOutputType() == 'text/plain') {