T402147.patch
SomeRandomDeveloper
Actions

Authored By

	SomeRandomDeveloper
	Aug 17 2025, 10:24 PM

Size

871 B

Referenced Files

None

Subscribers

None

T402147.patch
View Options

	From 00e27fde395ef86da12db9ec12adf97aaaf8fd3b Mon Sep 17 00:00:00 2001
	From: SomeRandomDeveloper <thisisnotmyname275@gmail.com>
	Date: Mon, 18 Aug 2025 00:24:16 +0200
	Subject: [PATCH] SECURITY: Escape filter values

	This fixes a stored XSS vulnerability.

	Bug: T402147
	Change-Id: I93c2be20a518b4a1c31eb3100ca6a1b48d2eb5ee
	---
	drilldown/CargoDrilldownPage.php \| 2 +-
	1 file changed, 1 insertion(+), 1 deletion(-)

	diff --git a/drilldown/CargoDrilldownPage.php b/drilldown/CargoDrilldownPage.php
	index 6713f1b..2221dc1 100644
	--- a/drilldown/CargoDrilldownPage.php
	+++ b/drilldown/CargoDrilldownPage.php
	@@ -347,7 +347,7 @@ END;
	preg_match( "/^~within_(.+)/", $value, $matches );
	return $this->msg( 'cargo-drilldown-hierarchy-within', $matches[1] )->parse();
	} else {
	- return $value;
	+ return htmlspecialchars( $value, ENT_QUOTES );
	}
	}

	--
	2.50.1