From 2f9046d6b4cfbfd0cef624ca301c321a1dc7825a Mon Sep 17 00:00:00 2001 From: jvoisin Date: Thu, 28 Mar 2019 23:38:37 +0100 Subject: [PATCH] Fix a xss and clean up some js - Fix a stupid self-XSS. I doubt that there are ways to use it against other users, but well, better safe than sorry - Replace the javascript-on-focus hacks with the `autofocus` attribute --- .../src/main/webapp/WEB-INF/jsp/avatarUploadResult.jsp | 4 ++-- airsonic-main/src/main/webapp/WEB-INF/jsp/login.jsp | 4 ++-- airsonic-main/src/main/webapp/WEB-INF/jsp/recover.jsp | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/airsonic-main/src/main/webapp/WEB-INF/jsp/avatarUploadResult.jsp b/airsonic-main/src/main/webapp/WEB-INF/jsp/avatarUploadResult.jsp index a9c6466a..4b1973b5 100644 --- a/airsonic-main/src/main/webapp/WEB-INF/jsp/avatarUploadResult.jsp +++ b/airsonic-main/src/main/webapp/WEB-INF/jsp/avatarUploadResult.jsp @@ -14,7 +14,7 @@

- + @@ -33,4 +33,4 @@

- \ No newline at end of file + diff --git a/airsonic-main/src/main/webapp/WEB-INF/jsp/login.jsp b/airsonic-main/src/main/webapp/WEB-INF/jsp/login.jsp index 08b4d80e..4d74aa49 100644 --- a/airsonic-main/src/main/webapp/WEB-INF/jsp/login.jsp +++ b/airsonic-main/src/main/webapp/WEB-INF/jsp/login.jsp @@ -10,7 +10,7 @@ - +
" method="POST"> @@ -21,7 +21,7 @@
- "> + "> "> diff --git a/airsonic-main/src/main/webapp/WEB-INF/jsp/recover.jsp b/airsonic-main/src/main/webapp/WEB-INF/jsp/recover.jsp index ff26a610..4e2d92df 100644 --- a/airsonic-main/src/main/webapp/WEB-INF/jsp/recover.jsp +++ b/airsonic-main/src/main/webapp/WEB-INF/jsp/recover.jsp @@ -5,7 +5,7 @@ <%@ include file="head.jsp" %> - + @@ -17,7 +17,7 @@

- + ">