diff options
| author | E99p1ant <i@github.red> | 2022-06-05 00:53:15 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-06-05 00:53:15 +0800 |
| commit | 155cae1de8916fc3fde78f350763034b7422caee (patch) | |
| tree | 1607f6b5b90d90ea9d6ca6401a7fa4ca2e39f5b2 | |
| parent | 64e09476c7993ded9b9881eac9e2419a471b6310 (diff) | |
issues: sanitize `DisplayName` (#7009)
* issues: display issue poster’s `Name` instead of `DisplayName`
* sanitize display name
* update changelog
| -rw-r--r-- | CHANGELOG.md | 1 | ||||
| -rw-r--r-- | templates/repo/issue/list.tmpl | 2 |
2 files changed, 2 insertions, 1 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index e09a29cc..e81c32b2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,7 @@ All notable changes to Gogs are documented in this file. ### Fixed - _Security:_ OS Command Injection in file editor. [#7000](https://github.com/gogs/gogs/issues/7000) +- _Security:_ Sanitize `DisplayName` in repository issue list. [#7009](https://github.com/gogs/gogs/pull/7009) - Unable to use LDAP authentication on ARM machines. [#6761](https://github.com/gogs/gogs/issues/6761) - Unable to init repository during creation on Windows. [#6967](https://github.com/gogs/gogs/issues/6967) - Mysterious panic on `Value not found for type *repo.HTTPContext`. [#6963](https://github.com/gogs/gogs/issues/6963) diff --git a/templates/repo/issue/list.tmpl b/templates/repo/issue/list.tmpl index 9aea699e..13a44806 100644 --- a/templates/repo/issue/list.tmpl +++ b/templates/repo/issue/list.tmpl @@ -113,7 +113,7 @@ {{end}} <p class="desc"> - {{$.i18n.Tr "repo.issues.opened_by" $timeStr .Poster.HomeLink .Poster.DisplayName | Safe}} + {{$.i18n.Tr "repo.issues.opened_by" $timeStr .Poster.HomeLink .Poster.DisplayName | Sanitize | Safe}} {{if .Milestone}} <a class="milestone" href="{{$.Link}}?type={{$.ViewType}}&state={{$.State}}&labels={{$.SelectLabels}}&milestone={{.Milestone.ID}}&assignee={{$.AssigneeID}}"> <span class="octicon octicon-milestone"></span> {{.Milestone.Name | Sanitize}} |