Merge pull request #1148 from warcooft/patch-escape-string

fix: escape string to prevent XSS attack
codeigniter4 · Jul 22, 2024 · 81a0bef · 81a0bef
2 parents a38b3cc + 9e283d3
commit 81a0bef
Show file tree

Hide file tree

Showing 5 changed files with 10 additions and 10 deletions.
diff --git a/src/Views/email_2fa_show.php b/src/Views/email_2fa_show.php
@@ -12,7 +12,7 @@
             <p><?= lang('Auth.confirmEmailAddress') ?></p>
 
             <?php if (session('error')) : ?>
-                <div class="alert alert-danger"><?= session('error') ?></div>
+                <div class="alert alert-danger"><?= esc(session('error')) ?></div>
             <?php endif ?>
 
             <form action="<?= url_to('auth-action-handle') ?>" method="post">

diff --git a/src/Views/email_2fa_verify.php b/src/Views/email_2fa_verify.php
@@ -12,7 +12,7 @@
             <p><?= lang('Auth.emailConfirmCode') ?></p>
 
             <?php if (session('error') !== null) : ?>
-            <div class="alert alert-danger"><?= session('error') ?></div>
+            <div class="alert alert-danger"><?= esc(session('error')) ?></div>
             <?php endif ?>
 
             <form action="<?= url_to('auth-action-verify') ?>" method="post">

diff --git a/src/Views/email_activate_show.php b/src/Views/email_activate_show.php
@@ -10,7 +10,7 @@
             <h5 class="card-title mb-5"><?= lang('Auth.emailActivateTitle') ?></h5>
 
             <?php if (session('error')) : ?>
-                <div class="alert alert-danger"><?= session('error') ?></div>
+                <div class="alert alert-danger"><?= esc(session('error')) ?></div>
             <?php endif ?>
 
             <p><?= lang('Auth.emailActivateBody') ?></p>

diff --git a/src/Views/login.php b/src/Views/login.php
@@ -10,22 +10,22 @@
                 <h5 class="card-title mb-5"><?= lang('Auth.login') ?></h5>
 
                 <?php if (session('error') !== null) : ?>
-                    <div class="alert alert-danger" role="alert"><?= session('error') ?></div>
+                    <div class="alert alert-danger" role="alert"><?= esc(session('error')) ?></div>
                 <?php elseif (session('errors') !== null) : ?>
                     <div class="alert alert-danger" role="alert">
                         <?php if (is_array(session('errors'))) : ?>
                             <?php foreach (session('errors') as $error) : ?>
-                                <?= $error ?>
+                                <?= esc($error) ?>
                                 <br>
                             <?php endforeach ?>
                         <?php else : ?>
-                            <?= session('errors') ?>
+                            <?= esc(session('errors')) ?>
                         <?php endif ?>
                     </div>
                 <?php endif ?>
 
                 <?php if (session('message') !== null) : ?>
-                <div class="alert alert-success" role="alert"><?= session('message') ?></div>
+                    <div class="alert alert-success" role="alert"><?= esc(session('message')) ?></div>
                 <?php endif ?>
 
                 <form action="<?= url_to('login') ?>" method="post">

diff --git a/src/Views/register.php b/src/Views/register.php
@@ -10,16 +10,16 @@
                 <h5 class="card-title mb-5"><?= lang('Auth.register') ?></h5>
 
                 <?php if (session('error') !== null) : ?>
-                    <div class="alert alert-danger" role="alert"><?= session('error') ?></div>
+                    <div class="alert alert-danger" role="alert"><?= esc(session('error')) ?></div>
                 <?php elseif (session('errors') !== null) : ?>
                     <div class="alert alert-danger" role="alert">
                         <?php if (is_array(session('errors'))) : ?>
                             <?php foreach (session('errors') as $error) : ?>
-                                <?= $error ?>
+                                <?= esc($error) ?>
                                 <br>
                             <?php endforeach ?>
                         <?php else : ?>
-                            <?= session('errors') ?>
+                            <?= esc(session('errors')) ?>
                         <?php endif ?>
                     </div>
                 <?php endif ?>