[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Fix issue in Tiki Forum

Elifeleti Mukisa Dan pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
05869ecc by Elifeleti Mukisa Dan at 2025-11-17T07:50:59+00:00
[FIX] Fix issue in Tiki Forum
---
* [FIX] Fix Reflected XSS vulnerability by escaping href attributes in SelfLink.php


(cherry picked from commit 749ad254d06e13f1f05ac097b2be01a016e5c1d1)

3239fa37 [FIX] Reflected XSS vulnerability by replacing PHP_SELF with SCRIPT_NAME...
e61707e5 Revert "[FIX] Admin warning about scheduler not running when no active schedulers exist"

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9037

- - - - -


1 changed file:

- lib/smarty_tiki/BlockHandler/SelfLink.php


Changes:

=====================================
lib/smarty_tiki/BlockHandler/SelfLink.php
=====================================
@@ -138,7 +138,8 @@ class SelfLink extends Base
                         );
                         unset($params['_onclick']); // Prevent addition to $link later
                     } else {
-                        $ret = 'href="' . $ret . '"';
+                        // Escape href value to prevent XSS injection
+                        $ret = 'href="' . htmlspecialchars($ret, ENT_QUOTES, 'UTF-8') . '"';
                     }
                 }
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/05869ecc026476b4a9400e4ef4e682aa9964372e

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/05869ecc026476b4a9400e4ef4e682aa9964372e
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs