Skip to content

Conversation

@Pytal
Copy link
Member

@Pytal Pytal commented Nov 8, 2022

Fix #34990

Affects the HTML entities:
& - &
&lt; - <
&gt; - >
&quot; - "
&#39; - '

Backport to 25 only which introduced the headline #34039

Signed-off-by: Christopher Ng <[email protected]>
@Pytal Pytal added bug 3. to review Waiting for reviews labels Nov 8, 2022
@Pytal Pytal added this to the Nextcloud 25.0.2 milestone Nov 8, 2022
@Pytal Pytal self-assigned this Nov 8, 2022
@Pytal
Copy link
Member Author

Pytal commented Nov 8, 2022

/backport to stable25

Copy link
Contributor

@szaimen szaimen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, didnt test

@szaimen szaimen modified the milestones: Nextcloud 25.0.2, Nextcloud 26 Nov 8, 2022
@szaimen szaimen requested a review from skjnldsv November 8, 2022 16:17
Copy link
Member

@skjnldsv skjnldsv left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if someone put <a href="http://evil-link.com">Nextcloud</a> as their product name? 😛

@szaimen
Copy link
Contributor

szaimen commented Nov 8, 2022

What if someone put <a href="http://evil-link.com">Nextcloud</a> as their product name? 😛

Great idea, I'll do that XD

@szaimen
Copy link
Contributor

szaimen commented Nov 8, 2022

But more serious: @skjnldsv can you approve?

@Pytal
Copy link
Member Author

Pytal commented Nov 8, 2022

What if someone put <a href="http://evil-link.com">Nextcloud</a> as their product name? 😛

Tested and is stripped by

return strip_tags($this->config->getAppValue('theming', 'name', $this->name));

@szaimen szaimen requested review from a team, PVince81 and skjnldsv and removed request for a team November 8, 2022 17:46
@PVince81
Copy link
Member

@skjnldsv do the last changes address your concern ?

@skjnldsv skjnldsv merged commit baf74f0 into master Nov 15, 2022
@skjnldsv skjnldsv deleted the fix/login-headline branch November 15, 2022 08:29
@skjnldsv skjnldsv added 4. to release Ready to be released and/or waiting for tests to finish and removed 3. to review Waiting for reviews labels Nov 15, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

4. to release Ready to be released and/or waiting for tests to finish bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Name in Theme: tick/quote is incorrectly escaped to HTML code

5 participants