[otrs-cvs] FAQ/Kernel/Output/HTML LayoutFAQ.pm,1.57,1.58

Comments:
Update of /home/cvs/FAQ/Kernel/Output/HTML
In directory lancelot:/tmp/cvs-serv25618/Kernel/Output/HTML

Modified Files:
	LayoutFAQ.pm 
Log Message:
Fixed possible security issue by filtering out active HTML content.

Author: ub

Index: LayoutFAQ.pm
===================================================================
RCS file: /home/cvs/FAQ/Kernel/Output/HTML/LayoutFAQ.pm,v
retrieving revision 1.57
retrieving revision 1.58
diff -2 -u -d -r1.57 -r1.58
--- LayoutFAQ.pm	6 Dec 2012 21:34:28 -0000	1.57
+++ LayoutFAQ.pm	25 Mar 2013 17:50:43 -0000	1.58
@@ -1,5 +1,5 @@
 # --
 # Kernel/Output/HTML/LayoutFAQ.pm - provides generic agent HTML output
-# Copyright (C) 2001-2012 OTRS AG, http://otrs.org/
+# Copyright (C) 2001-2013 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -430,4 +430,20 @@
         my $Content = $Param{FAQData}->{$Field} || '';
 
+        # remove active html content (scripts, applets, etc...)
+        my %SafeContent = $Self->{HTMLUtilsObject}->Safety(
+            String       => $Content,
+            NoApplet     => 1,
+            NoObject     => 1,
+            NoEmbed      => 1,
+            NoIntSrcLoad => 0,
+            NoExtSrcLoad => 0,
+            NoJavaScript => 1,
+        );
+
+        # take the safe content if neccessary
+        if ( $SafeContent{Replace} ) {
+            $Content = $SafeContent{String};
+        }
+
         # show the field
         $Self->Block(
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log