MightyPork
/
airsonic-custom
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix yet an other XSS

Browse Source
master
jvoisin 7 years ago
parent 10e90beb30
commit af4165310f
1 changed files with 2 additions and 2 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 4
      airsonic-main/src/main/webapp/WEB-INF/jsp/allmusic.jsp

4
airsonic-main/src/main/webapp/WEB-INF/jsp/allmusic.jsp
Unescape View File

@ -5,10 +5,10 @@
</head> </head>
<body onload="document.allmusic.submit();" class="mainframe bgcolor1"> <body onload="document.allmusic.submit();" class="mainframe bgcolor1">
<h2><fmt:message key="allmusic.text"><fmt:param value="${album}"/></fmt:message></h2> <h2><fmt:message key="allmusic.text"><fmt:param value="${fn:escapeXml(album)}"/></fmt:message></h2>
<form name="allmusic" action="https://www.allmusic.com/search" method="POST" accept-charset="iso-8859-1"> <form name="allmusic" action="https://www.allmusic.com/search" method="POST" accept-charset="iso-8859-1">
<input type="hidden" name="search_term" value="${album}"/> <input type="hidden" name="search_term" value="${fn:escapeXml(album)}"/>
<input type="hidden" name="search_type" value="album"/> <input type="hidden" name="search_type" value="album"/>
</form> </form>

Write Preview
Loading…
Cancel
Save