← All changes | app/Modules/Form/FormDataParser.php +9 -3 6.2.8 → 6.2.14 View file →

		@@ -120,9 +120,13 @@
120	120	foreach ($values as $value) {
121	121	if (!$value) {
122	122	continue;
123	123	}
124		- $html .= '<li><a href="' . $value . '" target="_blank">' . basename($value) . '</a></li>';
	124	+ // SECURITY (FINDING-23): escape the submitted upload value. It reaches this HTML sink
	125	+ // via an unauthenticated submission and is only sanitize_text_field'd (keeps " and :),
	126	+ // so a javascript: URL or an " onmouseover=" attribute breakout would otherwise render
	127	+ // in the admin entry view, notification email and PDF. esc_url enforces a safe scheme.
	128	+ $html .= '<li><a href="' . esc_url($value) . '" target="_blank">' . esc_html(basename($value)) . '</a></li>';
125	129	}
126	130
127	131	$html .= '</ul>';
128	132	return $html;
		@@ -151,9 +155,10 @@
151	155	$value = $values[0];
152	156	if (!$value) {
153	157	return '';
154	158	}
155		- return '<a href="' . $value . '" target="_blank"><img style="max-width:180px" src="' . $value . '" /></a>';
	159	+ // SECURITY (FINDING-23): escape the submitted upload value (see formatFileValues).
	160	+ return '<a href="' . esc_url($value) . '" target="_blank"><img style="max-width:180px" src="' . esc_url($value) . '" /></a>';
156	161	}
157	162
158	163	$html = '<ul class="ff_entry_list ff_entry_images">';
159	164	foreach ($values as $value) {
		@@ -159,9 +164,10 @@
159	164	foreach ($values as $value) {
160	165	if (!$value) {
161	166	continue;
162	167	}
163		- $html .= '<li style="margin: 20px 20px 20px 0px; display: inline-block; margin-right: 20px;"><a href="' . $value . '" target="_blank"><img style="max-width:180px" src="' . $value . '" /></a></li>';
	168	+ // SECURITY (FINDING-23): escape the submitted upload value (see formatFileValues).
	169	+ $html .= '<li style="margin: 20px 20px 20px 0px; display: inline-block; margin-right: 20px;"><a href="' . esc_url($value) . '" target="_blank"><img style="max-width:180px" src="' . esc_url($value) . '" /></a></li>';
164	170	}
165	171
166	172	$html .= '</ul>';
167	173	return $html;