mirror of
https://github.com/jellyfin/jellyfin.git
synced 2024-09-06 19:37:55 +02:00
fixes #1075 - XSS in "Active Devices" Panel of Admin Dashboard
This commit is contained in:
parent
94ec8d87b8
commit
2fa34a236b
1 changed files with 12 additions and 1 deletions
|
@ -175,11 +175,22 @@ namespace MediaBrowser.Server.Implementations.HttpServer.Security
|
|||
|
||||
if (param.Length == 2)
|
||||
{
|
||||
result.Add(param[0], param[1].Trim(new[] { '"' }));
|
||||
var value = NormalizeValue (param[1].Trim(new[] { '"' }));
|
||||
result.Add(param[0], value);
|
||||
}
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
private string NormalizeValue(string value)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace (value))
|
||||
{
|
||||
return value;
|
||||
}
|
||||
|
||||
return System.Net.WebUtility.HtmlEncode(value);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue