From 8c5687ca308e441742725e0aff9075779fa1a498 Mon Sep 17 00:00:00 2001 From: Matt N Date: Fri, 25 Jan 2019 05:35:07 -0800 Subject: [PATCH] Fix name/protocol XSS in controlcaps.php. Fixes #2445 (#2479) --- web/includes/functions.php | 3 +++ web/skins/classic/views/controlcaps.php | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/web/includes/functions.php b/web/includes/functions.php index 05761ddeb..a9cf815b4 100644 --- a/web/includes/functions.php +++ b/web/includes/functions.php @@ -450,6 +450,9 @@ function makeLink( $url, $label, $condition=1, $options='' ) { return( $string ); } +/** + * $label must be already escaped. It can't be done here since it sometimes contains HTML tags. + */ function makePopupLink( $url, $winName, $winSize, $label, $condition=1, $options='' ) { // Avoid double-encoding since some consumers incorrectly pass a pre-escaped URL. $string = ' - + - +