GNUsocial
/
gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

Remove XSS attack vector in JoinListItem

This commit is contained in:
Mikael Nordfeldth 2015-10-03 23:51:06 +02:00
parent 30a4393afa
commit bc9e3b1843
1 changed files with 0 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
plugins/Activity/lib/joinlistitem.php
View File

@ -46,30 +46,4 @@ if (!defined('STATUSNET')) {
*/
class JoinListItem extends SystemListItem
{
function showContent()
{
$notice = $this->nli->notice;
$out = $this->nli->out;
$mem = Group_member::getKV('uri', $notice->uri);
if (!empty($mem)) {
$out->elementStart('div', 'join-activity');
$profile = $mem->getMember();
$group = $mem->getGroup();
// TRANS: Text for "joined list" item in activity plugin.
// TRANS: %1$s is a profile URL, %2$s is a profile name,
// TRANS: %3$s is a group home URL, %4$s is a group name.
$out->raw(sprintf(_m('<a href="%1$s">%2$s</a> joined the group <a href="%3$s">%4$s</a>.'),
$profile->profileurl,
$profile->getBestName(),
$group->homeUrl(),
$group->getBestName()));
$out->elementEnd('div');
} else {
parent::showContent();
}
}
}