summaryrefslogtreecommitdiffhomepage
path: root/modules
diff options
context:
space:
mode:
authorHauke Mehrtens <hauke@hauke-m.de>2021-06-09 01:28:44 +0200
committerHauke Mehrtens <hauke@hauke-m.de>2021-06-09 01:33:44 +0200
commit5cbd79d7e31c0f0feaea2770bf102bbae7831e3c (patch)
treeac1d330cb1d8ecb385ccaad940ee5e4b6e685783 /modules
parentda97288015e0a8919c55075d71d88890e2f339f3 (diff)
themes: Call striptags() on hostname to prevent XSS
This calls striptags() on the hostname to prevent any XSS over the hostname. This should fix CVE-2021-33425 as far as I understood it. If someone adds some Javascript into system.@system[0].hostname it would have been directly added to the page, this prevents the problem. This can only be exploited by someone being able to modify the uci configuration, normally a user with such privileges could also just modify the webpage. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Diffstat (limited to 'modules')
0 files changed, 0 insertions, 0 deletions