Skip to content

Commit

Permalink
Removes any html tags (or data between "<" and ">" in playlist arguments
Browse files Browse the repository at this point in the history
This appears to be safe to me.  We do allow arguments to be sent to scripts,
and this would prevent ">" from being used, but I think that is a good thing.
Releated to https://www.huntr.dev/bounties/30-other-FalconChristmas/fpp/
  • Loading branch information
ghormann committed Jun 27, 2021
1 parent 09d6d3e commit a10c8a3
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion www/js/fpp.js
Expand Up @@ -1761,7 +1761,7 @@ function AddPlaylistEntry(mode) {
}
pe[a.name] = arr;
} else if ((a.type == 'string') || (a.type == 'file')) {
pe[a.name] = $('#playlistEntryOptions').find('.arg_' + a.name).val();
pe[a.name] = $('#playlistEntryOptions').find('.arg_' + a.name).val().replace(/<\/?[^>]+(>|$)/g, "");
} else {
pe[a.name] = $('#playlistEntryOptions').find('.arg_' + a.name).html();
}
Expand Down

0 comments on commit a10c8a3

Please sign in to comment.