Changeset 6793 for CKEditor/trunk

Timestamp:

04/28/11 13:54:37 (2 years ago)

Author:

wwalc

Message:

Added protection against XSS attacks in PHP samples when displaying element names.

Location:

CKEditor/trunk

Files:

• CHANGES.html (modified) (1 diff)
• _samples/assets/_posteddata.php (modified) (1 diff)

CKEditor/trunk/CHANGES.html

@@ -45 +45 @@
                         Fixed issues:</p>
         <ul>
+                <li>Added protection against XSS attacks in PHP samples when displaying element names.</li>
                 <li><a href="http://dev.ckeditor.com/ticket/7347">#7347</a> : The ENTER key will not any more be caught by the dialog cover element.</li>
                 <li><a href="http://dev.ckeditor.com/ticket/6718">#6718</a> : Paste from word command dominates over force paste as plain text configuration.</li>

CKEditor/trunk/_samples/assets/_posteddata.php

@@ -40 +40 @@
 ?>
                 <tr>
-                        <th style="vertical-align: top"><?php echo $sForm?></th>
+                        <th style="vertical-align: top"><?php echo htmlspecialchars($sForm); ?></th>
                         <td><pre class="samples"><?php echo $postedValue?></pre></td>
                 </tr>