fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-03 16:51:40 +09:00
Code Issues Projects Releases Packages Wiki Activity

RVE-2024-1 also apply escape() when updating document

Browse source
This commit is contained in:
Kijin Sung 2024-01-30 20:43:39 +09:00
parent 1854700e77
commit 7cb9b8c786
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/document/document.controller.php
View file

@ -1049,7 +1049,7 @@ class DocumentController extends Document
$obj->title = escape($obj->title, false);
if($obj->title == '')
{
$obj->title = cut_str(strip_tags($obj->content),20,'...');
$obj->title = escape(cut_str(trim(utf8_normalize_spaces(strip_tags($obj->content))), 20, '...'), false);
}
if($obj->title == '')
{