SECURITY: fix XSS using fancy mention hack

2014-07-25 17:26:57 +10:00 · 2014-07-25 17:26:57 +10:00 · 1d1dd43e27
parent ae686e8188
commit 1d1dd43e27
1 changed files with 2 additions and 0 deletions
--- a/app/assets/javascripts/discourse/controllers/poster-expansion.js.es6
+++ b/app/assets/javascripts/discourse/controllers/poster-expansion.js.es6
@ -23,6 +23,8 @@ export default Discourse.ObjectController.extend({
  showMoreBadges: Em.computed.gt('moreBadgesCount', 0),

  show: function(username, uploadedAvatarId) {
+    // XSS protection (should be encapsulated)
+    username = username.replace(/[^A-Za-z0-9_]/g, "");
    var url = "/users/" + username;

    // Don't show on mobile