Leahnaya/pkmn-classic-framework
1
0
Fork 0
mirror of https://github.com/mm201/pkmn-classic-framework.git synced 2026-10-01 13:46:56 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed (rather hilarious) XSS injection possibility on trainer names.

Browse Source
This commit is contained in:
Greg Edwards
2014-05-24 01:06:16 -04:00
parent 342facd194
commit 649bf3521d
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
gts/AllPokemon.aspx.cs
View File

@@ -57,7 +57,7 @@ namespace PkmnFoundations.GTS
protected String CreateTrainer4(object DataItem)
{
GtsRecord4 record = (GtsRecord4)DataItem;
return record.TrainerName.Text;
return Common.HtmlEncode(record.TrainerName.Text);
}
protected String CreateOffer5(object DataItem)
@@ -75,7 +75,7 @@ namespace PkmnFoundations.GTS
protected String CreateTrainer5(object DataItem)
{
GtsRecord5 record = (GtsRecord5)DataItem;
return record.TrainerName.Text;
return Common.HtmlEncode(record.TrainerName.Text);
}

5
gts/src/Common.cs
View File

@@ -72,6 +72,9 @@ namespace PkmnFoundations.GTS
return result.ToArray();
}
public static string HtmlEncode(string s)
{
return HttpUtility.HtmlEncode(s);
}
}
}