iSharkFly-Open
/
DiscuzX
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

修复 完善XSS漏洞的修复

This commit is contained in:
康盛Discuz! 2017-10-21 09:20:29 +08:00
parent a90b72af51
commit 4887604d80
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
upload/source/function/function_core.php
View File

@ -210,7 +210,7 @@ function dhtmlspecialchars($string, $flags = null) {
if($flags === null) {
$string = str_replace(array('&', '"', '<', '>'), array('&amp;', '&quot;', '&lt;', '&gt;'), $string);
if(strpos($string, '&amp;#') !== false) {
$string = preg_replace('/&amp;((#(\d{3,5}|x[a-fA-F0-9]{4}));)/', '&\\1', $string);
$string = preg_replace('/&amp;((#(\d{3,5}));)/', '&\\1', $string);
}
} else {
if(PHP_VERSION < '5.4.0') {

4
upload/template/default/ranklist/ranklist.htm
View File

@ -31,13 +31,13 @@
<ul class="biduser cl">
<li class="bidtop">
<!--{if $memberlist}-->
<a href="home.php?mod=space&uid=$memberlist[0][uid]&do=profile" target="_blank" id="bid_$memberlist[0][uid]" class="hm" {if $memberlist[0][note]} onmouseover="showTip(this)" tip="$memberlist[0][username]: {echo htmlspecialchars($memberlist[0][note])}"{/if}><!--{avatar($memberlist[0][uid],middle)}--></a>
<a href="home.php?mod=space&uid=$memberlist[0][uid]&do=profile" target="_blank" id="bid_$memberlist[0][uid]" class="hm" {if $memberlist[0][note]} onmouseover="showTip(this)" tip="$memberlist[0][username]: $memberlist[0][note]"{/if}><!--{avatar($memberlist[0][uid],middle)}--></a>
<!--{/if}-->
</li>
<!--{eval unset($memberlist[0]);}-->
<!--{loop $memberlist $member}-->
<li>
<a href="home.php?mod=space&uid=$member[uid]&do=profile" target="_blank" id="bid_$member[uid]" {if $member[note]} onmouseover="showTip(this)" tip="$member[username]: {echo htmlspecialchars($member[note])}"{/if}>$member[avatar]</a>
<a href="home.php?mod=space&uid=$member[uid]&do=profile" target="_blank" id="bid_$member[uid]" {if $member[note]} onmouseover="showTip(this)" tip="$member[username]: $member[note]"{/if}>$member[avatar]</a>
</li>
<!--{/loop}-->
</ul>