hazza/Phraseanet
1
0
Fork 0
mirror of https://github.com/alchemy-fr/Phraseanet.git synced 2025-10-09 19:13:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

PHRAS-3800_xss (#4219)

Browse Source 
* add encode option to record::get_title ; render preview.record_title in twig

* html-escape facet values
This commit is contained in:
jygaulier
2023-03-15 11:05:34 +01:00
committed by GitHub
parent 32ff2739ab
commit e7027c7220
31 changed files with 241 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/classes/module/report/nav.php
View File

@@ -519,7 +519,7 @@ class module_report_nav extends module_report
, 'record_id' => $record->getRecordId()
, 'date' => $this->app['date-formatter']->getPrettyString($document->get_creation_date())
, 'type' => $document->get_mime()
, 'titre' => $record->get_title()
, 'titre' => $record->get_title(['encode'=> record_adapter::ENCODE_FOR_HTML])
, 'taille' => $document->get_size()
];