]> git.sesse.net Git - vlc/commitdiff
lua http: fix two xss vulnerabilities
authorLudovic Fauvet <etix@videolan.org>
Mon, 8 Apr 2013 12:10:50 +0000 (14:10 +0200)
committerLudovic Fauvet <etix@videolan.org>
Mon, 8 Apr 2013 13:01:38 +0000 (15:01 +0200)
share/lua/http/requests/vlm_cmd.xml
share/lua/intf/http.lua

index 2e49db3bc4306b4338131d1fe6e79c76fe45b857..10a9a4a42b466b820690f6060d821295920f9dd4 100644 (file)
@@ -27,7 +27,7 @@
 if _GET["command"] then
   local msg = vlm:execute_command(_GET["command"])
   if msg.value then
-    print(msg.name,":",msg.value)
+    print(msg.name,":",vlc.strings.convert_xml_special_chars(msg.value))
   end
 else
 ?>No command<?vlc
index 47e965150c70616443fbeddb33b2ecab72635ed8..ea6ce87e2263a0f370148b7f9cfffb51a8b21477 100644 (file)
@@ -107,7 +107,8 @@ function callback_error(path,url,msg)
 <title>Error loading ]]..url..[[</title>
 </head>
 <body>
-<h1>Error loading ]]..url..[[</h1><pre>]]..(config.no_error_detail and "Remove configuration option `no_error_detail' on the server to get more information." or tostring(msg))..[[</pre>
+<h1>Error loading ]]..url..[[</h1><pre>]]..(config.no_error_detail and "Remove configuration option `no_error_detail' on the server to get more information."
+or vlc.strings.convert_xml_special_chars(tostring(msg)))..[[</pre>
 <p>
 <a href="http://www.videolan.org/">VideoLAN</a><br/>
 <a href="http://www.lua.org/manual/5.1/">Lua 5.1 Reference Manual</a>