composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-02-13 07:24:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

More fixes for Trac#446: XSS vulnerabilities with vectors containing double quotes

Browse Source 
SVN:trunk[1563]
This commit is contained in:
Denis Flaven
2011-09-08 13:21:32 +00:00
parent 205e80f8a5
commit c4db9cd84e
17 changed files with 54 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
core/dbobject.class.php
View File

@@ -622,7 +622,23 @@ abstract class DBObject
return MetaModel::GetClassIcon(get_class($this), $bImgTag);
}
/**
* Gets the name of an object in a safe manner for displaying inside a web page
* @return string
*/
public function GetName()
{
return htmlentities($this->GetRawName(), ENT_QUOTES, 'UTF-8');
}
/**
* Gets the raw name of an object, this is not safe for displaying inside a web page
* since the " < > characters are not escaped and the name may contain some XSS script
* instructions.
* Use this function only for internal computations or for an output to a non-HTML destination
* @return string
*/
public function GetRawName()
{
return $this->Get('friendlyname');
}