artin/miniPaint
1
0
Fork 0
mirror of https://github.com/viliusle/miniPaint.git synced 2026-02-06 09:41:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

XSS fix update

Browse Source
This commit is contained in:
viliusle 2023-12-01 15:40:32 +02:00
parent 7c2c056642
commit f4aba673d4
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/js/modules/file/save.js
View File

@ -123,6 +123,7 @@ class File_save_class {
if (parts.length > 1)
file_name = parts[parts.length - 2];
file_name = file_name.replace(/ /g, "-");
file_name = this.Helper.escapeHtml(file_name);
var save_types = [];
for(var i in file_types) {

13
src/js/modules/layer/rename.js
View File

@ -30,7 +30,7 @@ class Layer_rename_class {
new app.Actions.Bundle_action('rename_layer', 'Rename Layer', [
new app.Actions.Refresh_layers_gui_action('undo'),
new app.Actions.Update_layer_action(id || config.layer.id, {
name: params.name
name: _this.validate_name(params.name)
}),
new app.Actions.Refresh_layers_gui_action('do')
])
@ -39,6 +39,17 @@ class Layer_rename_class {
};
this.POP.show(settings);
}
validate_name(text) {
text = text
.replace(/&/g, "-")
.replace(/</g, "-")
.replace(/>/g, "-")
.replace(/"/g, "-")
.replace(/'/g, "-");
return text;
}
}
export default Layer_rename_class;