Skip to content

Commit 39b3162

Browse files
committed
Security: Protect agenda events using Security::remove_XSS
1 parent b9b48e4 commit 39b3162

File tree

1 file changed

+22
-0
lines changed

1 file changed

+22
-0
lines changed

main/inc/lib/agenda.lib.php

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1319,6 +1319,8 @@ public function getEvents(
13191319
break;
13201320
}
13211321

1322+
$this->cleanEvents();
1323+
13221324
switch ($format) {
13231325
case 'json':
13241326
if (empty($this->events)) {
@@ -1337,6 +1339,26 @@ public function getEvents(
13371339
}
13381340
}
13391341

1342+
/**
1343+
* Clean events
1344+
*
1345+
* @return bool
1346+
*/
1347+
public function cleanEvents()
1348+
{
1349+
if (empty($this->events)) {
1350+
1351+
return false;
1352+
}
1353+
1354+
foreach ($this->events as &$event) {
1355+
$event['description'] = Security::remove_XSS($event['description']);
1356+
$event['title'] = Security::remove_XSS($event['title']);
1357+
}
1358+
1359+
return true;
1360+
}
1361+
13401362
/**
13411363
* @param int $id
13421364
* @param int $minute_delta

0 commit comments

Comments
 (0)