Commit Graph
4 Commits
Author SHA1 Message Date
paperethandGitHub 0dd064b2ea Fix Exif leak in JPEG orientation conversion code
https://github.com/vichan-devel/vichan/issues/735
2024-05-04 15:01:17 +01:00
paperethandGitHub 6ccaf19045 Fixed thread.html template (#380)
* Update functions.php

` $_SERVER['REMOTE_ADDR']` was hardcoded in ban lookup instead of `$ip` variable

* Fix information leak in thread.html

Sensitive information can be leaked due to inadequate/absent escaping.

Line 14 is truncating before removing tags, this can cause some tags to be cut and therefore not be removed by the `remove_` functions.
Line 22 is just leaking it all, not removing anything.

* Fixed thread template

`remove_markup` is not available on vichan, arguably it makes things better but it's out of scope for this CHANGE, removing modifiers is enough to stop the info leak
consider adding it again after pulling:
fallenPineapple@a5b3336

also moving truncation before escaping for extra safety
2020-08-15 07:19:47 -07:00
paperethandGitHub 2275735fdf Fix information leak in thread.html (#377)
Sensitive information can be leaked due to inadequate/absent escaping, if proxy_save enabled

Line 14 is truncating before removing tags, this can cause some tags to be cut and therefore not be removed by the `remove_` functions.
Line 22 is just leaking it all, not removing anything.
2020-08-10 09:50:02 -07:00
paperethandGitHub a268004c7a Fix wrong variable used in ban lookup (#376)
` $_SERVER['REMOTE_ADDR']` was hardcoded in ban lookup instead of `$ip` variable
2020-08-09 18:31:50 -07:00