Fix a DOM Based XSS in comment, #43

2019-03-14 10:34:57 +08:00
parent 64f5afb13b
commit 2dc23b8b0f
1 changed files with 1 additions and 1 deletions
@@ -10,7 +10,7 @@ function go_to_reply(id, author_name) {
    $('#reply-dialog-box').remove();
    $('#submit-comment-container').prepend('<div class="alert alert-info alert-dismissable" id="reply-dialog-box">' +
            '<button type="button" class="close" data-dismiss="alert" onclick="undo_reply()">&times;</button>' +
-            '回复给<strong><i>' + author_name +'</i></strong> </div>');
+            '回复给<strong><i>' + $('<div/>').text(author_name).html() +'</i></strong> </div>');
 }

 //Reset the follow value when refresh page