Browse Source

Fixed two XSS bugs.

Keanu Poeschko 2 years ago
parent
commit
63d099ffb2
2 changed files with 7 additions and 7 deletions
  1. 1 1
      engines/special/wikipedia.php
  2. 6 6
      settings.php

+ 1 - 1
engines/special/wikipedia.php

@@ -15,7 +15,7 @@
             $response = array(
                 "special_response" => array(
                     "response" => htmlspecialchars($description),
-                    "source" => $source
+                    "source" => urlencode($source)
                 )
             );
 

+ 6 - 6
settings.php

@@ -87,42 +87,42 @@
                       <div>
                         <a for="invidious" href="https://docs.invidious.io/instances/" target="_blank">Invidious</a>
                         <input type="text" name="invidious" placeholder="Replace YouTube" value=
-                            <?php echo isset($_COOKIE["invidious"]) ? $_COOKIE["invidious"]  : "\"$config->invidious\""; ?>
+                            <?php echo isset($_COOKIE["invidious"]) ? urlencode($_COOKIE["invidious"])  : "\"$config->invidious\""; ?>
                         >
                       </div>
 
                       <div>
                         <a for="bibliogram" href="https://git.sr.ht/~cadence/bibliogram-docs/tree/master/docs/Instances.md" target="_blank">Bibliogram</a>
                         <input type="text" name="bibliogram" placeholder="Replace Instagram" value=
-                            <?php echo isset($_COOKIE["bibliogram"]) ? $_COOKIE["bibliogram"]  : "\"$config->bibliogram\""; ?>
+                            <?php echo isset($_COOKIE["bibliogram"]) ? urlencode($_COOKIE["bibliogram"]) : "\"$config->bibliogram\""; ?>
                         >
                       </div>
 
                       <div>
                         <a for="nitter" href="https://github.com/zedeus/nitter/wiki/Instances" target="_blank">Nitter</a>
                         <input type="text" name="nitter" placeholder="Replace Twitter" value=
-                            <?php echo isset($_COOKIE["nitter"]) ? $_COOKIE["nitter"]  : "\"$config->nitter\""; ?>
+                            <?php echo isset($_COOKIE["nitter"]) ? urlencode($_COOKIE["nitter"])  : "\"$config->nitter\""; ?>
                         >
                       </div>
 
                       <div>
                         <a for="libreddit" href="https://github.com/spikecodes/libreddit" target="_blank">Libreddit</a>
                         <input type="text" name="libreddit" placeholder="Replace Reddit" value=
-                            <?php echo isset($_COOKIE["libreddit"]) ? $_COOKIE["libreddit"]  : "\"$config->libreddit\""; ?>
+                            <?php echo isset($_COOKIE["libreddit"]) ? urlencode($_COOKIE["libreddit"])  : "\"$config->libreddit\""; ?>
                         >
                       </div>
 
                       <div>
                         <a for="proxitok" href="https://github.com/pablouser1/ProxiTok/wiki/Public-instances" target="_blank">ProxiTok</a>
                         <input type="text" name="proxitok" placeholder="Replace TikTok" value=
-                            <?php echo isset($_COOKIE["proxitok"]) ? $_COOKIE["proxitok"]  : "\"$config->proxitok\""; ?>
+                            <?php echo isset($_COOKIE["libreddit"]) ? urlencode($_COOKIE["libreddit"])  : "\"$config->libreddit\""; ?>
                         >
                       </div>
 
                       <div>
                         <a for="wikiless" href="https://codeberg.org/orenom/wikiless" target="_blank">Wikiless</a>
                         <input type="text" name="wikiless" placeholder="Replace Wikipedia" value=
-                            <?php echo isset($_COOKIE["wikiless"]) ? $_COOKIE["wikiless"]  : "\"$config->wikiless\""; ?>
+                            <?php echo isset($_COOKIE["wikiless"]) ? urlencode($_COOKIE["wikiless"])  : "\"$config->wikiless\""; ?>
                         >
                       </div>
                 </div>