Fix XSS vectors in HTML attributes (mostly t() calls)

2026-05-04 12:09:08 -04:00 · 2009-08-31 21:51:57 -07:00
parent 8c3a2db380
commit 2bc73e2e36
24 changed files with 63 additions and 63 deletions
--- a/modules/comment/views/admin_block_recent_comments.html.php
+++ b/modules/comment/views/admin_block_recent_comments.html.php
@@ -4,7 +4,7 @@
  <li class="<?= ($i % 2 == 0) ? "gEvenRow" : "gOddRow" ?>">
    <img src="<?= $comment->author()->avatar_url(32, $theme->url("images/avatar.jpg", true)) ?>"
         class="gAvatar"
-         alt="<?= html::clean($comment->author_name()) ?>"
+         alt="<?= html::clean_attribute($comment->author_name()) ?>"
         width="32"
         height="32" />
    <?= gallery::date_time($comment->created) ?>