[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [FIX] Add Smarty delimiter escaping to prevent template code injection

Elifeleti Mukisa Dan pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki


Commits:
af086f4f by Elifeleti Mukisa Dan at 2025-11-28T16:12:34+00:00
[FIX] Add Smarty delimiter escaping to prevent template code injection
---
* [FIX] Add Smarty delimiter escaping to prevent template code injection

See merge request tikiwiki/tiki!9144

- - - - -


1 changed file:

- lib/parser/parserlib.php


Changes:

=====================================
lib/parser/parserlib.php
=====================================
@@ -2138,6 +2138,10 @@ class ParserLib extends TikiDb_Bridge
                         default:
                             if (isset($_GET[$name])) {
                                 $value = $_GET[$name];
+                                // Escape Smarty template delimiters to prevent template code injection in wiki context
+                                if ($this->option['inside_pretty'] ?? false) {
+                                    $value = str_replace(['{', '}'], ['{', '}'], $value);
+                                }
                             } else {
                                 $value = '';
                                 include_once('lib/wiki-plugins/wikiplugin_showpref.php');



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/af086f4f002ceaca16a4a2250136d2d3d37d3601

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/af086f4f002ceaca16a4a2250136d2d3d37d3601
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs