diff options
Diffstat (limited to 'www/typolight28/patches/patch-af')
| -rw-r--r-- | www/typolight28/patches/patch-af | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/www/typolight28/patches/patch-af b/www/typolight28/patches/patch-af new file mode 100644 index 00000000000..c6f6586b410 --- /dev/null +++ b/www/typolight28/patches/patch-af @@ -0,0 +1,15 @@ +$NetBSD: patch-af,v 1.1.2.2 2011/01/08 15:01:11 tron Exp $ + +* Prevent the X_FORWARDED_FOR header against XSS attacks, from repository r587. + +--- system/modules/comments/dca/tl_comments.php.orig 2010-04-08 15:11:44.000000000 +0000 ++++ system/modules/comments/dca/tl_comments.php +@@ -469,7 +469,7 @@ class tl_comments extends Backend + + return ' + <div class="comment_wrap"> +-<div class="cte_type ' . $key . '"><strong><a href="mailto:' . $arrRow['email'] . '" title="' . specialchars($arrRow['email']) . '">' . $arrRow['name'] . '</a></strong>' . (strlen($arrRow['website']) ? ' (<a href="' . $arrRow['website'] . '" title="' . specialchars($arrRow['website']) . '"' . LINK_NEW_WINDOW . '>' . $GLOBALS['TL_LANG']['MSC']['com_website'] . '</a>)' : '') . ' - ' . $this->parseDate($GLOBALS['TL_CONFIG']['datimFormat'], $arrRow['date']) . ' - IP ' . $arrRow['ip'] . '<br />' . $title . '</div> ++<div class="cte_type ' . $key . '"><strong><a href="mailto:' . $arrRow['email'] . '" title="' . specialchars($arrRow['email']) . '">' . $arrRow['name'] . '</a></strong>' . (strlen($arrRow['website']) ? ' (<a href="' . $arrRow['website'] . '" title="' . specialchars($arrRow['website']) . '"' . LINK_NEW_WINDOW . '>' . $GLOBALS['TL_LANG']['MSC']['com_website'] . '</a>)' : '') . ' - ' . $this->parseDate($GLOBALS['TL_CONFIG']['datimFormat'], $arrRow['date']) . ' - IP ' . specialchars($arrRow['ip']) . '<br />' . $title . '</div> + <div class="limit_height mark_links' . (!$GLOBALS['TL_CONFIG']['doNotCollapse'] ? ' h52' : '') . ' block"> + ' . $arrRow['comment'] . ' + </div> |