fix(YesWiki/Href): escape params via urlencode to prevent XSS

YesWiki · Dec 14, 2021 · 0b7a584 · 0b7a584
1 parent ab9838f
commit 0b7a584
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/includes/YesWiki.php b/includes/YesWiki.php
@@ -418,7 +418,7 @@ public function Href($method = null, $tag = null, $params = null, $htmlspchars =
                 $paramsArray = [];
                 foreach ($params as $key => $value) {
                     if ($value) {
-                        $paramsArray[] = "$key=$value";
+                        $paramsArray[] = "$key=".urlencode($value);
                     }
                 };
                 if (count($paramsArray)>0) {
@@ -1429,7 +1429,7 @@ public function replaceRecursivelyIndexedArrays(&$array1, &$array2)
         foreach ($array2 as $key => $val) {
             if (is_array($val)) {
                 if (!$this->isAssocArray($val)) {
-                    if(!isset($array1[$key]) || $array1[$key] != $val) {
+                    if (!isset($array1[$key]) || $array1[$key] != $val) {
                         $array1[$key] = $val;
                     }
                 } else {