Feeling Lucky
?
[#19720] - [4.0] Switch escape() methods to ENT_QUOTES to also cover single quotes
- Fixed in Code Base
- 18 Feb 2018
- Medium
- Build: 4.0-dev
- # 19720
- Diff
- SniperSister:htmlview-escape-fix
User tests: Successful: Unsuccessful:
Summary of Changes
In earlier versions, the escape method of JViewHtml, HtmlView and BaseLayout was using the ENT_COMPAT flag for escaping, which does not escape single quotes. This leads to potential XSS-issues in some situations and therefore should be changed in 4.0.
This is done with this PR.
Testing Instructions
- Add
echo $this->escape("'");to a component template of your choice. - Inspect the generated markup in the browser, see the plaintext output of the single quote
- Apply this patch, refresh the page
- Inspect markup again, see that the quote is now escaped
Expected result
Single quotes are escaped
Actual result
Single quotes aren't escaped.
Documentation Changes Required
None
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Libraries |
Quy
- | Title |
|
||||||
wilsonge
- | Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2018-02-18 17:22:38 |
| Closed_By | ⇒ | wilsonge | |
| Labels |
Added:
?
|
||