fix: added missing escaping of newly added values

thorsten · Jan 25, 2023 · 26663ef · 26663ef
1 parent d896456
commit 26663ef
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/phpmyfaq/admin/instances.php b/phpmyfaq/admin/instances.php
@@ -243,6 +243,10 @@ class="btn btn-danger pmf-instance-delete"
         const admin = $('#admin').val();
         const password = $('#password').val();
 
+        const escape = (unsafe) => {
+          return unsafe.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
+        }
+
         $.ajax({
           url: 'index.php',
           type: 'GET',
@@ -256,8 +260,8 @@ class="btn btn-danger pmf-instance-delete"
               '<tr id="row-instance-' + data.added + '">' +
               '<td>' + data.added + '</td>' +
               '<td><a href="' + data.url + '">' + data.url + '</a></td>' +
-              '<td>' + instance + '</td>' +
-              '<td>' + comment + '</td>' +
+              '<td>' + escape(instance) + '</td>' +
+              '<td>' + escape(comment) + '</td>' +
               '<td>' +
               '<a href="?action=editinstance&instance_id=' + data.added +
               '" class="btn btn-info"><i aria-hidden="true" class="fa fa-pencil"></i></a>' +