[TikiWiki-commits] [Git][tikiwiki/tiki][28.x] [BP][FIX] Fix issue in Tiki Forum

Elifeleti Mukisa Dan pushed to branch 28.x at Tiki Wiki CMS Groupware / Tiki


Commits:
8e43ddfe by Elifeleti Mukisa Dan at 2026-02-04T12:11:04+00:00
[BP][FIX] Fix issue in Tiki Forum
---
* [BP][FIX] Fix issue in Tiki Forum
---
* [FIX] Fix issue in Tiki Forum
---
* [FIX] Fix Reflected XSS vulnerability by escaping href attributes in SelfLink.php


(cherry picked from commit 749ad254d06e13f1f05ac097b2be01a016e5c1d1)

3239fa37 [FIX] Reflected XSS vulnerability by replacing PHP_SELF with SCRIPT_NAME...
e61707e5 Revert "[FIX] Admin warning about scheduler not running when no active schedulers exist"

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9037


(cherry picked from commit 05869ecc026476b4a9400e4ef4e682aa9964372e)

b450fe07 [FIX] Fix Reflected XSS vulnerability by escaping href attributes in SelfLink.php

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9038


(cherry picked from commit 4a0bf526425db2098ebff2418887e26a9a2b353f)

61265a09 [FIX] Fix issue in Tiki Forum

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9494

- - - - -


1 changed file:

- lib/smarty_tiki/BlockHandler/SelfLink.php


Changes:

=====================================
lib/smarty_tiki/BlockHandler/SelfLink.php
=====================================
@@ -138,7 +138,8 @@ class SelfLink extends Base
                         );
                         unset($params['_onclick']); // Prevent addition to $link later
                     } else {
-                        $ret = 'href="' . $ret . '"';
+                        // Escape href value to prevent XSS injection
+                        $ret = 'href="' . htmlspecialchars($ret, ENT_QUOTES, 'UTF-8') . '"';
                     }
                 }
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/8e43ddfe9e9c0298e90573eef10fb16d3de12570

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/8e43ddfe9e9c0298e90573eef10fb16d3de12570
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs