libretic
/
etherpad-lite
5
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a possible xss attack in iframe link

This commit is contained in:
Stefan 2016-03-20 16:28:06 +01:00
parent 175c29ff66
commit 02551d772c
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/static/js/pad_editbar.js
View File

@ -315,13 +315,13 @@ var padeditbar = (function()
{ {
var basePath = document.location.href.substring(0, document.location.href.indexOf("/p/")); var basePath = document.location.href.substring(0, document.location.href.indexOf("/p/"));
var readonlyLink = basePath + "/p/" + clientVars.readOnlyId; var readonlyLink = basePath + "/p/" + clientVars.readOnlyId;
$('#embedinput').val("<iframe name='embed_readonly' src='" + readonlyLink + "?showControls=true&showChat=true&showLineNumbers=true&useMonospaceFont=false' width=600 height=400></iframe>"); $('#embedinput').val('<iframe name="embed_readonly" src="' + readonlyLink + '?showControls=true&showChat=true&showLineNumbers=true&useMonospaceFont=false" width=600 height=400></iframe>');
$('#linkinput').val(readonlyLink); $('#linkinput').val(readonlyLink);
} }
else else
{ {
var padurl = window.location.href.split("?")[0]; var padurl = window.location.href.split("?")[0];
$('#embedinput').val("<iframe name='embed_readwrite' src='" + padurl + "?showControls=true&showChat=true&showLineNumbers=true&useMonospaceFont=false' width=600 height=400></iframe>"); $('#embedinput').val('<iframe name="embed_readwrite" src="' + padurl + '?showControls=true&showChat=true&showLineNumbers=true&useMonospaceFont=false" width=600 height=400></iframe>');
$('#linkinput').val(padurl); $('#linkinput').val(padurl);
} }
} }