Project

General

Profile

Actions
Copy link

Bug #50760

closed

Missing htmlspecialchars for link title render_textpic

Added by Alexander Stehlik over 11 years ago. Updated about 7 years ago.

Status:
Closed
Priority:
Must have
Assignee:
-
Category:
Content Rendering
Target version:
6.2.0
Start date:
2013-08-04
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
6.2
PHP Version:
5.4
Tags:
Complexity:
easy
Is Regression:
Sprint Focus:

Description

When an image is inserted with a title that contains special chars (like quotes) the title tag of the image tag is escaped correctly.

But the title tag of the surrounding link (tested in lightbox mode) is not escaped!

The reason seems to be the initialization of the $GLOBALS['TSFE']->ATagParams variable in line 668 in the render_textpic() method in the CssStyledContentController.

$GLOBALS['TSFE']->ATagParams .= ' title="' . $titleText . '"';

As far as I can see it should be used like this:

$GLOBALS['TSFE']->ATagParams .= ' title="' . htmlspecialchars($titleText) . '"';

It does not seem to be a security issue because script tags used in the image title are stripped out.

Actions
Copy link

Also available in: Atom PDF