fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-07 02:31:40 +09:00
Code Issues Projects Releases Packages Wiki Activity

Fix RVE-2023-1 editor module XSS

Browse source
This commit is contained in:
Kijin Sung 2023-07-05 01:34:48 +09:00
parent 103f5ce884
commit ed7a0bd4e2
2 changed files with 7 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

10
modules/editor/editor.model.php
View file

@ -208,11 +208,11 @@ class editorModel extends editor
// Load editor components. // Load editor components.
if($option->enable_component) if($option->enable_component)
{ {
if(!Context::get('component_list')) Context::set('component_list', self::getComponentList(true));
{ }
$component_list = self::getComponentList(true); else
Context::set('component_list', $component_list); {
} Context::set('component_list', []);
} }
Context::set('enable_component', $option->enable_component ? true : false); Context::set('enable_component', $option->enable_component ? true : false);
Context::set('enable_default_component', $option->enable_default_component ? true : false); Context::set('enable_default_component', $option->enable_default_component ? true : false);

6
modules/editor/skins/ckeditor/editor.html
View file

@ -143,11 +143,9 @@ var auto_saved_msg = "{$lang->msg_auto_saved}";
<!--@if($enable_component)--> <!--@if($enable_component)-->
{@ $xe_component = array(); } {@ $xe_component = array(); }
<!--@foreach($component_list as $component_name => $component)--> <!--@foreach($component_list as $component_name => $component)-->
{@ $xe_component[] = $component_name . ":'" . htmlentities($component->title, ENT_QUOTES, 'UTF-8') . "'"; } {@ $xe_component[$component_name] = escape($component->title, false)}
<!--@endforeach--> <!--@endforeach-->
{@ $xe_component = implode(',', $xe_component); } settings.ckeconfig.xe_component_arrays = {json_encode($xe_component)};
settings.ckeconfig.xe_component_arrays = {{$xe_component}};
<!--@else--> <!--@else-->
settings.ckeconfig.xe_component_arrays = {}; settings.ckeconfig.xe_component_arrays = {};
<!--@endif--> <!--@endif-->