Bug #50760
closedMissing htmlspecialchars for link title render_textpic
100%
Description
When an image is inserted with a title that contains special chars (like quotes) the title tag of the image tag is escaped correctly.
But the title tag of the surrounding link (tested in lightbox mode) is not escaped!
The reason seems to be the initialization of the $GLOBALS['TSFE']->ATagParams
variable in line 668 in the render_textpic()
method in the CssStyledContentController
.
$GLOBALS['TSFE']->ATagParams .= ' title="' . $titleText . '"';
As far as I can see it should be used like this:
$GLOBALS['TSFE']->ATagParams .= ' title="' . htmlspecialchars($titleText) . '"';
It does not seem to be a security issue because script tags used in the image title are stripped out.
Updated by Gerrit Code Review over 11 years ago
- Status changed from New to Under Review
Patch set 1 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/22803
Updated by Gerrit Code Review over 11 years ago
Patch set 2 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/22803
Updated by Gerrit Code Review over 11 years ago
Patch set 1 for branch TYPO3_6-1 has been pushed to the review server.
It is available at https://review.typo3.org/23344
Updated by Gerrit Code Review over 11 years ago
Patch set 1 for branch TYPO3_6-0 has been pushed to the review server.
It is available at https://review.typo3.org/23345
Updated by Gerrit Code Review over 11 years ago
Patch set 1 for branch TYPO3_4-7 has been pushed to the review server.
It is available at https://review.typo3.org/23348
Updated by Gerrit Code Review over 11 years ago
Patch set 1 for branch TYPO3_4-5 has been pushed to the review server.
It is available at https://review.typo3.org/23349
Updated by Alexander Stehlik over 11 years ago
- Status changed from Under Review to Resolved
- % Done changed from 0 to 100
Applied in changeset 4b98bb598b0d6f8dd4d83ca369db6d89200fa9da.
Updated by Riccardo De Contardi about 7 years ago
- Status changed from Resolved to Closed